Akira

Who they hit

Latest 12 of 116, from ransomware.live. These are the group's claims.

Confirmed elsewhere

Victims of Akira that a second, independent source also named inside two weeks. How convergence works.

• 2026-08-27 Cascade Coffee, LLC leak + notice

Reports about them

• 2026-10-06 Huntress: Up a Creek Without a Command Line: Mapping an Akira Ransomware Attack
• 2026-10-02 Huntress: The First 24 Hours: What Happens When Ransomware Lands
• 2026-08-12 Huntress: Akira Hits Safe Mode: Ransomware Rebooting Around EDR

Also named in passing in 8 more: Unit 42, ReliaQuest, Unit 42, Flashpoint, AhnLab ASEC, Flare, Intel 471, Intel 471. Those don't feed the techniques or indicators below.

What they do

27 techniques, in kill-chain order. 3 have no rule anywhere we can find. "Their side" is infrastructure work you can't see from your network.

SigmaHQ counts are rules tagged with that exact technique; "~n" is rules on its parent or sub-techniques. A close match does not mean the technique is covered.

Rules to deploy

Ours on the same techniques but written for something else, so check the logic fits before you lean on them: t1557-recaptcha-skinned-turnstile-gate, t1505-003-peoplesoft-psemhub-webshell-drop.

Sweep

4 sha256, 2 ipv4. iocs.csv · package.json