In a significant evolution of its operational tactics, the Akira ransomware group has begun using a Rust variant specifically targeting ESXi servers, reflecting a growing sophistication in their approach. First discovered in March 2023, Akira ransomware previously attacked both Windows and Linux systems, employing a double-extortion technique to maximize their impact. This method involves not just encrypting victims’ data but also threatening to release sensitive information unless a ransom is paid. Initially utilizing C++, Akira has since transitioned to Rust for its ESXi encryptor variant, released as version 2024.1.30. This move to Rust, a language known for its performance and safety features, highlights the group’s commitment to refining their techniques. By employing the rust-crypto 0.3.26 library instead of the previously used Crypto++ library, the group is showcasing their technical adaptability and increasing the sophistication of their attacks.
Technical Shifts and Exploits
Cybersecurity experts at Cisco Talos have closely monitored the advancements made by the Akira ransomware group, noting several critical vulnerabilities they exploit to gain entry into networks. Specifically, Akira targets flaws like CVE-2024-40766 in SonicWall SonicOS, CVE-2023-20269 in Cisco VPN services, and CVE-2023-48788 in FortiClientEMS software. Once inside a network, the ransomware operators employ various tactics to escalate their privileges and spread within the system. They use PowerShell scripts for credential harvesting, WMI for deleting system shadow copies, and Remote Desktop Protocol (RDP) for lateral movement. These techniques are indicative of a deep understanding of network architectures and the systemic weaknesses within them.
The group’s modified tactics involve deploying the Megazord encryptor alongside their main payload, further complicating defense strategies for organizations. They start their attacks by compromising VPN credentials and exploiting vulnerable network appliances. Following initial penetration, they focus on privilege escalation through tools like Veeam.Backup.MountService.exe. Their primary targets have predominantly been organizations in the manufacturing and professional technical services sectors. This focused targeting suggests a strategic decision aimed at maximizing operational impact and potential financial gain. Despite these advancements, there has been a notable reversion to traditional C++ programming in recent samples, indicating a dual approach in their toolset.
Advanced Encryption Techniques and Strategic Focus
In addition to their programming shifts, Akira has also enhanced the technical efficiency of their encryption methods. The group has adopted the use of the ChaCha8 stream cipher, which provides faster encryption operations compared to the previously utilized ChaCha20 algorithm. This change signifies a move towards more performant and effective encryption strategies. The Windows variant of their ransomware now includes new command-line arguments like "-localonly" and "–exclude," providing more control over the encryption process. On the Linux side, the ransomware uses the "–fork" argument to create child processes during encryption, allowing it to target specific file extensions more effectively.
Akira’s strategic focus remains sharply directed at VMware’s ESXi and Linux environments, with particular attention to "vmdk" files to maximize operational disruption. By concentrating on these environments, the group minimizes the need for extensive lateral movement and credential theft within the targeted networks. Their streamlined toolset now prominently features the Megazord encryptor for Windows environments, consolidating their attack payload and reducing complexity. This focused approach underscores their objective of causing maximum disruption while maintaining operational efficiency, a balance that is critical for the success of their ransomware campaigns.
Recommended Mitigation Measures
Akira has not only shifted their programming methods but also improved their encryption efficiency. They now use the ChaCha8 stream cipher, which offers faster encryption than the previously used ChaCha20 algorithm, marking a move towards more effective encryption strategies. In the Windows version of their ransomware, new command-line arguments like "-localonly" and "–exclude" give users greater control over the encryption process. For Linux, the "–fork" argument allows the ransomware to create child processes, targeting specific file extensions more efficiently during encryption.
Akira’s strategy remains largely centered on VMware’s ESXi and Linux environments, focusing particularly on "vmdk" files to cause maximum operational disruption. By honing in on these areas, they reduce the need for broad lateral movements and credential theft within targeted networks. They have streamlined their toolkit to feature the Megazord encryptor for Windows, thus simplifying their attack payload and reducing complexity. This focused approach highlights their goal of maximizing disruption while ensuring operational efficiency—an essential balance for the success of their ransomware operations.