MDR Case Study: Akira Ransomware

Ransomware continues to be one of the most pervasive and destructive cyber threats facing organizations globally. Among the numerous ransomware-as-a-service (RaaS) operations, the Akira ransomware group has rapidly distinguished itself since its emergence in March 2023. Known for its aggressive tactics, including double extortion by both encrypting and exfiltrating sensitive data, Akira has targeted a wide array of industries, primarily across North America, Europe, and Australia. With reported proceeds of approximately $42 million from over 250 impacted organizations by early 2024.  

Akira represents a significant and evolving challenge to cybersecurity defenses. This case study will delve into the operational methods and impact, along with essential strategies for preventing cyberattacks and protecting against advanced ransomware threats.

What is Akira?

Akira is a potent ransomware strain that emerged in March 2023. It operates as a Ransomware-as-a-Service (RaaS) model, meaning the core group develops and maintains the ransomware, while affiliates carry out individual attacks and share the extorted fees.

A key characteristic of Akira is its use of double extortion. This involves not only encrypting a victim's data to demand a ransom for decryption, but also exfiltrating sensitive data before encryption. If the victim refuses to pay for decryption, Akira threatens to publicly leak or sell the stolen data on its dedicated leak site. As of early 2024, Akira has impacted over 250 organizations and reportedly accrued around $42 million in ransom proceeds.

Akira gains initial access to target networks primarily through credential compromise, often by exploiting vulnerabilities in VPN services that lack multi-factor authentication (MFA). Once inside, they target infrastructure.

How to Prevent Cyber Attacks?

A successful prevention strategy must address all possible known vectors for malware. The Net Friends team recommends overlapping systems to protect against attacks such as Akira.

For example, a defense in depth strategy should include:

• Timely software updates to eliminate vulnerabilities left open to exploitation. ‍
• Strong passwords and MFA to prevent Akira from exploiting stolen credentials.  ‍
• Server Hardening, ensures that changes to infrastructure are continually monitored.  ‍
• Immutable backups protect against Akira’s deletion of shadow backups.

Due to Akira's RaaS model, a diverse array of attack methods is employed, contingent on the affiliate organization's primary strategies.  The primary method of exploitation is through compromised VPN’s, especially ones without MFA. They also employ phishing and exploitation of other vulnerabilities.

The only truly effective response strategy is automation. Automating the detection of suspicious activity, cross-referencing it with known attack patterns, and swiftly isolating compromised systems or applications, allows for rapid detection. This critical, proactive approach is known as Managed Detection and Response (MDR). MDR services combine advanced technology with human expertise to continuously monitor, detect, investigate, and respond to cyber threats, significantly reducing the time to contain and remediate incidents.

How Can NetSafe^® MDR Block Akira?

Companies using NetSafe Managed Detection and Response to block Akira should look at four main tactics:

1. Proactive Detection: NetSafe MDR employs continuous, active monitoring of all network traffic and activity. This allows for the detection of suspicious behaviors, such as Akira attempting to modify administrative files, disabling EDR or antivirus tools, or other unauthorized movements within the network. ‍
2. Human-Led Response: Our MDR service is powered by a team of highly experienced security analysts. These experts are not only adept at identifying sophisticated threats, but also actively and strategically respond to incidents like Aikra, ensuring comprehensive containment and remediation.
3. Contextual Security: NetSafe MDR goes beyond simple alerts by understanding the relationships between emerging threats and existing vulnerabilities. This contextual intelligence enables us to precisely identify activities, such as Akira attempting to exfiltrate data. ‍
4. Quick Reaction: Leveraging advanced detection logic and AI-enhanced alerting capabilities, NetSafe MDR empowers our human-led response team to react with unprecedented speed. This rapid intervention allows us to stop threats like Akira in their tracks.

What’s the Next Step?

If you want more information on NetSafe MDR or are considering ways to implement MDR as part of your broader security strategy, contact Net Friends. When you enroll in NetSafe MDR, you can trust that no matter how an attack begins on your network, it will be stopped with unmatched speed and thoroughness. 

Follow us on LinkedIn.

More Reading:

NetSafe® MDR Protects Your Business Systems
MDR Case Study: RansomHub Ransomware
MDR Case Study: REvil Ransomware