SOC Prime Bias: High

24 Nov 2025 19:49
newspaper icon AttackIQ

Akira Ransomware: Response to CISA Advisory AA24-109A

Author Photo
Ruslan Mikhalov Chief of Threat Research at SOC Prime linkedin icon Follow
Akira Ransomware: Response to CISA Advisory AA24-109A
shield icon

Detection stack

  • AIDR
  • Alert
  • ETL
  • Query


Akira Ransomware: Response to CISA Advisory AA24-109A SUMMARY

The advisory profiles the Akira ransomware operation, a Ransomware-as-a-Service (RaaS) threat that both encrypts victim data and exfiltrates it prior to encryption. First observed in March 2023, Akira quickly rose to prominence and is believed to share code lineage with the Conti ransomware family. The document details the group’s tactics, techniques, and procedures, including brute-force attacks against RDP, credential dumping, and reliance on a TOR-hosted leak portal. Victims are typically pressured to pay either for decryption keys or for the promise of stolen data deletion.

Investigation

A coordinated investigation by CISA, the FBI, NCSC-NL, and several European law-enforcement partners refreshed Akira’s threat profile through November 2025. Technical findings highlight persistence through the creation of new local accounts, broad reconnaissance using native Windows APIs, and the use of credential-theft utilities such as Mimikatz, LaZagne, and Rubeus. File encryption is implemented with the ChaCha20 algorithm, with keys protected using RSA-4096.

Akira Ransomware Mitigation

Defensive priorities include enforcing strong, unique RDP credentials, monitoring for unusual account creation and privilege enumeration activity, and blocking commonly abused offensive tools. Organizations should maintain regular, tested backups, disable non-essential services, and deploy host-based controls to prevent LSASS memory dumping. Additional safeguards involve filtering TOR traffic at the network edge and tracking potential data exfiltration to .onion infrastructure.

Response

When Akira activity is suspected, immediately quarantine the affected host, acquire memory and disk images, and preserve all relevant indicators of compromise. Reset exposed credentials, remove unauthorized accounts, and restore systems from trusted, verified backups. A thorough forensic review should map out lateral movement paths and pivot points, with results reported to appropriate authorities and information-sharing partners.

“`mermaid graph TB %% Class Definitions classDef technique fill:#e6f5ff %% Nodes – Techniques tech_bruteforce[“<b>Technique</b> – <b>T1110.004 Brute Force – Credential Stuffing</b><br/><b>Description</b>: Attacker attempts to log in using large numbers of previously compromised credentials over a remote service.”] class tech_bruteforce technique tech_rdp[“<b>Technique</b> – <b>T1021.001 Remote Services: RDP</b><br/><b>Description</b>: Use of the Remote Desktop Protocol to establish a remote interactive session.”] class tech_rdp technique tech_createacct[“<b>Technique</b> – <b>T1136.001 Create Account: Local Account</b><br/><b>Description</b>: Adversary creates a new local user account for persistence or privilege escalation.”] class tech_createacct technique tech_localgroup[“<b>Technique</b> – <b>T1069.001 Permission Groups Discovery: Local Groups</b><br/><b>Description</b>: Enumerates local group memberships to identify privileged accounts.”] class tech_localgroup technique tech_domaingroup[“<b>Technique</b> – <b>T1069.002 Permission Groups Discovery: Domain Groups</b><br/><b>Description</b>: Enumerates domain group memberships to locate additional privileged groups.”] class tech_domaingroup technique tech_processdisc[“<b>Technique</b> – <b>T1057 Process Discovery</b><br/><b>Description</b>: Uses utilities such as tasklist to list running processes on the host.”] class tech_processdisc technique tech_remotesysdisc[“<b>Technique</b> – <b>T1018 Remote System Discovery</b><br/><b>Description</b>: Identifies remote systems, for example domain controllers, using tools like nltest.”] class tech_remotesysdisc technique tech_trustdisc[“<b>Technique</b> – <b>T1482 Domain Trust Discovery</b><br/><b>Description</b>: Queries trusted domain relationships using nltest trusted_domains.”] class tech_trustdisc technique tech_kerberoast[“<b>Technique</b> – <b>T1558.003 Kerberoasting</b><br/><b>Description</b>: Extracts service tickets and cracks them offline, often with tools such as Rubeus.”] class tech_kerberoast technique tech_lsassdump[“<b>Technique</b> – <b>T1003.001 OS Credential Dumping</b><br/><b>Description</b>: Dumps LSASS memory via comsvcs.dll and Mimikatz to obtain plaintext credentials.”] class tech_lsassdump technique tech_regdump[“<b>Technique</b> – <b>T1003.002 Registry Hive Dump</b><br/><b>Description</b>: Saves the SYSTEM registry hive (e.g., using reg save) for offline analysis.”] class tech_regdump technique tech_wmiexec[“<b>Technique</b> – <b>T1047 Windows Management Instrumentation</b><br/><b>Description</b>: Executes commands remotely through WMI, commonly using utilities like wmiexec.”] class tech_wmiexec technique tech_rdp_lateral[“<b>Technique</b> – <b>T1021.001 Remote Services: RDP (Lateral)</b><br/><b>Description</b>: Moves laterally to additional hosts via Remote Desktop Protocol connections.”] class tech_rdp_lateral technique tech_ssh[“<b>Technique</b> – <b>T1021.004 Remote Services: SSH</b><br/><b>Description</b>: Falls back to Secure Shell for lateral movement when RDP is unavailable.”] class tech_ssh technique tech_sysinfo[“<b>Technique</b> – <b>T1082 System Information Discovery</b><br/><b>Description</b>: Gathers operating system and hardware details using commands such as GetSystemInfo.”] class tech_sysinfo technique tech_queryreg[“<b>Technique</b> – <b>T1012 Query Registry</b><br/><b>Description</b>: Reads registry values like MachineGUID to uniquely identify the host.”] class tech_queryreg technique tech_filedisc[“<b>Technique</b> – <b>T1083 File and Directory Discovery</b><br/><b>Description</b>: Enumerates files and directories using FindFirstFile/FindNextFile API calls.”] class tech_filedisc technique tech_logdrive[“<b>Technique</b> – <b>T1680 Logical Drive Discovery</b><br/><b>Description</b>: Retrieves logical drive letters and types via GetLogicalDriveStringsW and GetDriveTypeW.”] class tech_logdrive technique tech_permmod[“<b>Technique</b> – <b>T1222.001 File and Directory Permissions Modification</b><br/><b>Description</b>: Changes ACLs on files or directories using icacls to enable further access.”] class tech_permmod technique tech_inhibitrec[“<b>Technique</b> – <b>T1490 Inhibit System Recovery</b><br/><b>Description</b>: Deletes Volume Shadow Copies through WMI to prevent restoration.”] class tech_inhibitrec technique tech_encrypt[“<b>Technique</b> – <b>T1486 Data Encrypted for Impact</b><br/><b>Description</b>: Encrypts victim data using ChaCha20 symmetric encryption and RSA‑4096 for key protection.”] class tech_encrypt technique %% Connections – Attack Flow tech_bruteforce –>|leads_to| tech_rdp tech_rdp –>|leads_to| tech_createacct tech_createacct –>|leads_to| tech_localgroup tech_localgroup –>|leads_to| tech_domaingroup tech_domaingroup –>|leads_to| tech_processdisc tech_processdisc –>|leads_to| tech_remotesysdisc tech_remotesysdisc –>|leads_to| tech_trustdisc tech_trustdisc –>|leads_to| tech_kerberoast tech_kerberoast –>|leads_to| tech_lsassdump tech_lsassdump –>|leads_to| tech_regdump tech_regdump –>|leads_to| tech_wmiexec tech_wmiexec –>|leads_to| tech_rdp_lateral tech_rdp_lateral –>|leads_to| tech_ssh tech_ssh –>|leads_to| tech_sysinfo tech_sysinfo –>|leads_to| tech_queryreg tech_queryreg –>|leads_to| tech_filedisc tech_filedisc –>|leads_to| tech_logdrive tech_logdrive –>|leads_to| tech_permmod tech_permmod –>|leads_to| tech_inhibitrec tech_inhibitrec –>|leads_to| tech_encrypt “`

Attack Flow

Simulation Execution

Prerequisite: The Telemetry & Baseline Pre‑flight Check must have passed.

Rationale: This section details the precise execution of the adversary technique (TTP) designed to trigger the detection rule. The commands and narrative directly reflect the identified TTPs and generate the exact telemetry expected by the detection logic.

  • Attack Narrative & Commands:
    The ransomware operator prepares to encrypt a directory of user documents. First, they ensure the files are fully accessible to the ransomware process by granting Everyone full control using icacls.exe. This is a classic “grant‑full‑access before encrypt” step, matching MITRE technique T1222.001. The attacker runs the command from a low‑privilege context but relies on the fact that icacls.exe can modify ACLs if the process has sufficient permissions (e.g., running as SYSTEM via a scheduled task).

    # Path to target directory
$target = "C:\Users\Public\Documents\SensitiveData"

# Recursively grant full control to Everyone
icacls.exe "$target\*" /grant *S-1-1-0:F /T /C

    The above command creates a Sysmon ProcessCreate event where Image ends with icacls.exe, satisfying the detection rule.

  • Regression Test Script:

    # ---------------------------------------------------------------
# Regression Test – Icacls Permission Modification (T1222.001)
# ---------------------------------------------------------------
# Create a temporary test directory
$testDir = "$env:TEMP\IcaclsTest"
New-Item -Path $testDir -ItemType Directory -Force | Out-Null

# Populate with dummy files
1..5 | ForEach-Object {
    New-Item -Path "$testDir\File$_ .txt" -ItemType File -Force | Out-Null
}

# Execute icacls to grant Everyone full control (this should fire the rule)
icacls.exe "$testDir\*" /grant *S-1-1-0:F /T /C

# Pause to allow SIEM ingestion
Start-Sleep -Seconds 10

# End of script

  • Cleanup Commands:

    # ---------------------------------------------------------------
# Cleanup – Remove test ACL changes and delete test data
# ---------------------------------------------------------------
$testDir = "$env:TEMP\IcaclsTest"

# Reset permissions to the defaults (remove the Everyone grant)
icacls.exe "$testDir\*" /reset /T /C

# Delete the test directory
Remove-Item -Path $testDir -Recurse -Force

Join SOC Prime's Detection as Code platform to improve visibility into threats most relevant to your business. To help you get started and drive immediate value, book a meeting now with SOC Prime experts.

Join for Free