{
  "slug": "akira",
  "group": "akira",
  "name": "Akira",
  "note": null,
  "attck": [
    {
      "id": "G1024",
      "name": "Akira",
      "kind": "intrusion-set",
      "url": "https://attack.mitre.org/groups/G1024"
    },
    {
      "id": "S1129",
      "name": "Akira",
      "kind": "malware",
      "url": "https://attack.mitre.org/software/S1129"
    }
  ],
  "activity": {
    "postings": 116,
    "first": "2026-08-10",
    "last": "2026-11-06",
    "countries": {
      "FR": 1,
      "US": 30,
      "??": 60,
      "CA": 3,
      "CH": 1,
      "KR": 1,
      "NL": 2,
      "DE": 6,
      "GB": 3,
      "MX": 4,
      "BR": 4,
      "IT": 1
    },
    "sectors": {
      "consumer": 13,
      "manufacturing": 31,
      "services": 17,
      "unknown": 24,
      "technology": 8,
      "energy": 4,
      "finance": 5,
      "transportation": 4,
      "healthcare": 3,
      "insurance": 1,
      "education": 1,
      "agriculture": 6
    },
    "recent": [
      {
        "date": "2026-11-06",
        "name": "Ligne Roset",
        "country": "FR",
        "sectors": [
          "consumer"
        ],
        "url": "https://www.ransomware.live/id/TGlnbmUgUm9zZXRAYWtpcmE"
      },
      {
        "date": "2026-11-06",
        "name": "Houston Machine and Thread",
        "country": "US",
        "sectors": [
          "manufacturing"
        ],
        "url": "https://www.ransomware.live/id/SG91c3RvbiBNYWNoaW5lIGFuZCBUaHJlYWRAYWtpcmE"
      },
      {
        "date": "2026-11-06",
        "name": "Hudson & Hudson SignProducts",
        "country": "US",
        "sectors": [
          "manufacturing"
        ],
        "url": "https://www.ransomware.live/id/SHVkc29uICYgSHVkc29uIFNpZ25Qcm9kdWN0c0Bha2lyYQ"
      },
      {
        "date": "2026-11-06",
        "name": "Boyle, Pecharich, Cline, Whittington andStallings",
        "country": "??",
        "sectors": [
          "services"
        ],
        "url": "https://www.ransomware.live/id/Qm95bGUsIFBlY2hhcmljaCwgQ2xpbmUsIFdoaXR0aW5ndG9uIGFuZFN0YWxsaW5nc0Bha2lyYQ"
      },
      {
        "date": "2026-11-05",
        "name": "Westboro Partners",
        "country": "??",
        "sectors": [
          "unknown"
        ],
        "url": "https://www.ransomware.live/id/V2VzdGJvcm8gUGFydG5lcnNAYWtpcmE"
      },
      {
        "date": "2026-11-05",
        "name": "System Plus",
        "country": "??",
        "sectors": [
          "technology"
        ],
        "url": "https://www.ransomware.live/id/U3lzdGVtIFBsdXNAYWtpcmE"
      },
      {
        "date": "2026-11-05",
        "name": "David L Wade & Associates",
        "country": "??",
        "sectors": [
          "services"
        ],
        "url": "https://www.ransomware.live/id/RGF2aWQgTCBXYWRlICYgQXNzb2NpYXRlc0Bha2lyYQ"
      },
      {
        "date": "2026-11-05",
        "name": "Source Energy Services",
        "country": "CA",
        "sectors": [
          "energy"
        ],
        "url": "https://www.ransomware.live/id/U291cmNlIEVuZXJneSBTZXJ2aWNlc0Bha2lyYQ"
      },
      {
        "date": "2026-11-04",
        "name": "Krishnan",
        "country": "??",
        "sectors": [
          "unknown"
        ],
        "url": "https://www.ransomware.live/id/S3Jpc2huYW5AYWtpcmE"
      },
      {
        "date": "2026-11-04",
        "name": "Erowa",
        "country": "CH",
        "sectors": [
          "manufacturing"
        ],
        "url": "https://www.ransomware.live/id/RXJvd2FAYWtpcmE"
      },
      {
        "date": "2026-11-03",
        "name": "Bison Bag",
        "country": "??",
        "sectors": [
          "consumer"
        ],
        "url": "https://www.ransomware.live/id/Qmlzb24gQmFnQGFraXJh"
      },
      {
        "date": "2026-11-03",
        "name": "SK Global Software",
        "country": "KR",
        "sectors": [
          "technology"
        ],
        "url": "https://www.ransomware.live/id/U0sgR2xvYmFsIFNvZnR3YXJlQGFraXJh"
      }
    ]
  },
  "convergences": [
    {
      "name": "Cascade Coffee, LLC",
      "flagged": "2026-08-27",
      "classes": [
        "leak",
        "notice"
      ],
      "curated": false,
      "hand_picked": false
    }
  ],
  "reports": [
    {
      "url": "https://unit42.paloaltonetworks.com/europes-refrigeration-systems-attacks/",
      "publisher": "Unit 42",
      "published": "2026-11-06",
      "title": "Turning Up the Heat: Inside the Attacks on Europe’s Refrigeration System",
      "origin": "feed",
      "primary": false
    },
    {
      "url": "https://reliaquest.com/blog/manufacturing-attackers-using-more-paths-in-security-operations-need-to-move-first/",
      "publisher": "ReliaQuest",
      "published": "2026-11-05",
      "title": "Manufacturing Attackers Are Using More Paths In. Security Operations Need to Move First.",
      "origin": "feed",
      "primary": false
    },
    {
      "url": "https://unit42.paloaltonetworks.com/unwrapping-retail-cyber-threats/",
      "publisher": "Unit 42",
      "published": "2026-10-28",
      "title": "Unwrapping Retail Peak Season Cyber Threats",
      "origin": "feed",
      "primary": false
    },
    {
      "url": "https://flashpoint.io/blog/2026-ransomware-survival-guide/",
      "publisher": "Flashpoint",
      "published": "2026-10-27",
      "title": "Ransomware in the Age of AI: How Defenders Can Break the Attack Chain",
      "origin": "feed",
      "primary": false
    },
    {
      "url": "https://asec.ahnlab.com/en/95949/",
      "publisher": "AhnLab ASEC",
      "published": "2026-10-11",
      "title": "September 2026 Threat Trend Report on Ransomware",
      "origin": "feed",
      "primary": false
    },
    {
      "url": "https://flare.io/learn/resources/blog/healthcare-ransomware-attack-surface",
      "publisher": "Flare",
      "published": "2026-10-08",
      "title": "Healthcare Is Cybercrime’s Highest-Value Target: Ransomware, Exposure, and the Expanding Attack Surface",
      "origin": "feed",
      "primary": false
    },
    {
      "url": "https://www.intel471.com/blog/agentic-hunting-needs-guardrails-start-with-your-methodology",
      "publisher": "Intel 471",
      "published": "2026-10-07",
      "title": "Agentic Hunting Needs Guardrails. Start With Your Methodology.",
      "origin": "feed",
      "primary": false
    },
    {
      "url": "https://www.huntress.com/blog/mapping-akira-ransomware-attack",
      "publisher": "Huntress",
      "published": "2026-10-06",
      "title": "Up a Creek Without a Command Line: Mapping an Akira Ransomware Attack",
      "origin": "feed",
      "primary": true
    },
    {
      "url": "https://www.huntress.com/blog/what-happens-during-a-ransomware-attack",
      "publisher": "Huntress",
      "published": "2026-10-02",
      "title": "The First 24 Hours: What Happens When Ransomware Lands",
      "origin": "feed",
      "primary": true
    },
    {
      "url": "https://www.intel471.com/blog/follow-the-money-the-financial-sectors-threat-landscape-in-2026",
      "publisher": "Intel 471",
      "published": "2026-09-10",
      "title": "Follow the Money: The Financial Sector's Threat Landscape in 2026",
      "origin": "feed",
      "primary": false
    },
    {
      "url": "https://www.huntress.com/blog/akira-hits-safe-mode-ransomware-rebooting-around-edr",
      "publisher": "Huntress",
      "published": "2026-08-12",
      "title": "Akira Hits Safe Mode: Ransomware Rebooting Around EDR",
      "origin": "feed",
      "primary": true
    }
  ],
  "techniques": [
    {
      "id": "T1018",
      "name": "Remote System Discovery",
      "tactics": [
        "discovery"
      ],
      "sources": [
        "attck",
        "report"
      ],
      "structural": false,
      "own": [],
      "community": 17,
      "related": 0
    },
    {
      "id": "T1021.001",
      "name": "Remote Desktop Protocol",
      "tactics": [
        "lateral-movement"
      ],
      "sources": [
        "attck"
      ],
      "structural": false,
      "own": [],
      "community": 16,
      "related": 10
    },
    {
      "id": "T1027.001",
      "name": "Binary Padding",
      "tactics": [
        "stealth"
      ],
      "sources": [
        "attck"
      ],
      "structural": false,
      "own": [],
      "community": 3,
      "related": 94
    },
    {
      "id": "T1036.005",
      "name": "Match Legitimate Resource Name or Location",
      "tactics": [
        "stealth"
      ],
      "sources": [
        "attck"
      ],
      "structural": false,
      "own": [
        "t1557-recaptcha-skinned-turnstile-gate"
      ],
      "community": 21,
      "related": 40
    },
    {
      "id": "T1047",
      "name": "Windows Management Instrumentation",
      "tactics": [
        "execution"
      ],
      "sources": [
        "attck"
      ],
      "structural": false,
      "own": [],
      "community": 52,
      "related": 0
    },
    {
      "id": "T1057",
      "name": "Process Discovery",
      "tactics": [
        "discovery"
      ],
      "sources": [
        "attck"
      ],
      "structural": false,
      "own": [],
      "community": 8,
      "related": 0
    },
    {
      "id": "T1059.001",
      "name": "PowerShell",
      "tactics": [
        "execution"
      ],
      "sources": [
        "attck"
      ],
      "structural": false,
      "own": [],
      "community": 220,
      "related": 94
    },
    {
      "id": "T1059.003",
      "name": "Windows Command Shell",
      "tactics": [
        "execution"
      ],
      "sources": [
        "attck"
      ],
      "structural": false,
      "own": [],
      "community": 46,
      "related": 94
    },
    {
      "id": "T1078",
      "name": "Valid Accounts",
      "tactics": [
        "stealth",
        "persistence",
        "privilege-escalation",
        "initial-access"
      ],
      "sources": [
        "attck"
      ],
      "structural": false,
      "own": [],
      "community": 55,
      "related": 54
    },
    {
      "id": "T1082",
      "name": "System Information Discovery",
      "tactics": [
        "discovery"
      ],
      "sources": [
        "attck"
      ],
      "structural": false,
      "own": [],
      "community": 33,
      "related": 0
    },
    {
      "id": "T1083",
      "name": "File and Directory Discovery",
      "tactics": [
        "discovery"
      ],
      "sources": [
        "attck"
      ],
      "structural": false,
      "own": [],
      "community": 24,
      "related": 0
    },
    {
      "id": "T1087",
      "name": "Account Discovery",
      "tactics": [
        "discovery"
      ],
      "sources": [
        "report"
      ],
      "structural": false,
      "own": [],
      "community": 16,
      "related": 37
    },
    {
      "id": "T1106",
      "name": "Native API",
      "tactics": [
        "execution"
      ],
      "sources": [
        "attck"
      ],
      "structural": false,
      "own": [],
      "community": 14,
      "related": 0
    },
    {
      "id": "T1133",
      "name": "External Remote Services",
      "tactics": [
        "persistence",
        "initial-access"
      ],
      "sources": [
        "attck"
      ],
      "structural": false,
      "own": [],
      "community": 20,
      "related": 0
    },
    {
      "id": "T1135",
      "name": "Network Share Discovery",
      "tactics": [
        "discovery"
      ],
      "sources": [
        "attck"
      ],
      "structural": false,
      "own": [],
      "community": 7,
      "related": 0
    },
    {
      "id": "T1213.002",
      "name": "Sharepoint",
      "tactics": [
        "collection"
      ],
      "sources": [
        "attck"
      ],
      "structural": false,
      "own": [],
      "community": 0,
      "related": 7
    },
    {
      "id": "T1219",
      "name": "Remote Access Tools",
      "tactics": [
        "command-and-control"
      ],
      "sources": [
        "attck"
      ],
      "structural": false,
      "own": [
        "t1505-003-peoplesoft-psemhub-webshell-drop"
      ],
      "community": 6,
      "related": 46
    },
    {
      "id": "T1482",
      "name": "Domain Trust Discovery",
      "tactics": [
        "discovery"
      ],
      "sources": [
        "attck"
      ],
      "structural": false,
      "own": [],
      "community": 17,
      "related": 0
    },
    {
      "id": "T1486",
      "name": "Data Encrypted for Impact",
      "tactics": [
        "impact"
      ],
      "sources": [
        "attck"
      ],
      "structural": false,
      "own": [],
      "community": 16,
      "related": 0
    },
    {
      "id": "T1490",
      "name": "Inhibit System Recovery",
      "tactics": [
        "impact"
      ],
      "sources": [
        "attck"
      ],
      "structural": false,
      "own": [],
      "community": 27,
      "related": 0
    },
    {
      "id": "T1531",
      "name": "Account Access Removal",
      "tactics": [
        "impact"
      ],
      "sources": [
        "attck"
      ],
      "structural": false,
      "own": [],
      "community": 9,
      "related": 0
    },
    {
      "id": "T1558",
      "name": "Steal or Forge Kerberos Tickets",
      "tactics": [
        "credential-access"
      ],
      "sources": [
        "attck"
      ],
      "structural": false,
      "own": [],
      "community": 5,
      "related": 17
    },
    {
      "id": "T1560.001",
      "name": "Archive via Utility",
      "tactics": [
        "collection"
      ],
      "sources": [
        "attck",
        "report"
      ],
      "structural": false,
      "own": [],
      "community": 17,
      "related": 4
    },
    {
      "id": "T1567.002",
      "name": "Exfiltration to Cloud Storage",
      "tactics": [
        "exfiltration"
      ],
      "sources": [
        "attck",
        "report"
      ],
      "structural": false,
      "own": [],
      "community": 14,
      "related": 12
    },
    {
      "id": "T1657",
      "name": "Financial Theft",
      "tactics": [
        "impact"
      ],
      "sources": [
        "attck"
      ],
      "structural": false,
      "own": [],
      "community": 0,
      "related": 0
    },
    {
      "id": "T1685",
      "name": "Disable or Modify Tools",
      "tactics": [
        "defense-impairment"
      ],
      "sources": [
        "attck"
      ],
      "structural": false,
      "own": [],
      "community": 162,
      "related": 44
    },
    {
      "id": "T1688",
      "name": "Safe Mode Boot",
      "tactics": [
        "defense-impairment"
      ],
      "sources": [
        "report"
      ],
      "structural": false,
      "own": [],
      "community": 0,
      "related": 0
    }
  ],
  "cves": [],
  "indicators": {
    "list": [
      {
        "type": "ipv4",
        "value": "64.227.4.134",
        "source": "https://www.huntress.com/blog/mapping-akira-ransomware-attack"
      },
      {
        "type": "ipv4",
        "value": "72.23.77.35",
        "source": "https://www.huntress.com/blog/akira-hits-safe-mode-ransomware-rebooting-around-edr"
      },
      {
        "type": "sha256",
        "value": "1f1bb322591b6d27fd2946e373d7d2efc2f4e1e66818846060d391600b600fba",
        "source": "https://www.huntress.com/blog/mapping-akira-ransomware-attack"
      },
      {
        "type": "sha256",
        "value": "414b9985f46714f44dd1bd63860d2a48dcfababcfe5c712a4b4f575378127a56",
        "source": "https://www.huntress.com/blog/akira-hits-safe-mode-ransomware-rebooting-around-edr"
      },
      {
        "type": "sha256",
        "value": "d00833318a04caa019c6f95dcb3598ad947d405010bfb2f3cbd04530a00bc3a4",
        "source": "https://www.huntress.com/blog/mapping-akira-ransomware-attack"
      },
      {
        "type": "sha256",
        "value": "e2356c742c74cce5c6b6100162d0071a3f71e2fed2ed895c2011061a95b3299a",
        "source": "https://www.huntress.com/blog/akira-hits-safe-mode-ransomware-rebooting-around-edr"
      }
    ],
    "withheld": 0
  },
  "rules": [],
  "coverage": {
    "techniques": 27,
    "defendable": 27,
    "covered": 24,
    "uncovered": [
      "T1213.002",
      "T1657",
      "T1688"
    ]
  }
}