Tuesday, October 8, 2024
HomeCyber Security NewsAkira Ransomware Expanded its Toolkit to Attack Linux Machines

Akira Ransomware Expanded its Toolkit to Attack Linux Machines

Published on

A newly emerged ransomware known as Akira expands its operations to target Linux-based platforms which add the “.akira” file extension to each compromised file. 

Akira ransomware mostly operating since April 2023, and actively targeting numerous organizations, compromising their sensitive data. 

The Akira ransomware specifically targeted a wide range of industries during its attacks, encompassing sectors including Education, Banking, Financial Services and Insurance (BFSI), Manufacturing, Professional Services, and more. 

- Advertisement - EHA

The group has already compromised 46 publicly disclosed victims, most of whom are in the United States, according to Cyble report.

Technical Analysis of Akira Ransomware: 

The execution of the attack was achieved through the malicious 64-bit Linux executable Linkable Format (ELF) file. 

In order to execute the Akira executable, specific parameters need to be provided.  

The required parameters for running the Akira executable are as follows: 

  • “-p” / “–encryption_path” – Path of files/folder to be encrypted. 
  • “-s” / “–share_file” – Path of the shared network drive to be encrypted 
  • “-n” / “–encryption_percent” – Percentage of the files to be encrypted. 
  • “-fork” – Creating a child process for encryption.   

Upon execution, the Akira ransomware loads a pre-determined RSA public key to encrypt files in the system.

Once the public key is initialized, the Akira ransomware loads a list of predetermined file extensions it intends to target and encrypt. 

encrypt file
Figure: File Extensions Targeted by the Akira Ransomware 

The ransomware incorporates routines associated with multiple symmetric key algorithms, including AES, CAMELLIA, IDEA-CB, and DES. 

When encountering a file with an extension listed, the ransomware proceeds to encrypt the file and leave the ransomware note on the infectious machine. 

akira

The ransomware notes detailed how to reach the group to negotiate ransom and guidance to decrypt their data. 

Akira Ransomware, which was initially focused on Windows systems, has now expanded its target range to include Linux platforms.  

During attacks, Akira uses a combination of AES and RSA encryption to render the victim’s files inaccessible.  

In addition to encrypting the victim’s files, Akira will also remove the Shadow Volume copies of the files.  

This is done to prevent users from recovering their files using alternative methods.  

The proliferation of ransomware and shift in tactics reflects a growing trend among ransomware groups. 

Indicator of compromise: 

Indicators Indicator Type Description 
302f76897e4e5c8c98a52a38c4c98443 
9180ea8ba0cdfe0a769089977ed8396a68761b40 
1d3b5c650533d13c81e325972a912e3ff8776e36e18bca966dae50735f8ab296 
MD5 
SHA1 
SHA256 
Akira Ransomware 
ELF 
Gurubaran
Gurubaran
Gurubaran is a co-founder of Cyber Security News and GBHackers On Security. He has 10+ years of experience as a Security Consultant, Editor, and Analyst in cybersecurity, technology, and communications.

Latest articles

Hackers Gained Unauthorized Network Access to Casio Networks

Casio Computer Co., Ltd. has confirmed that a third party illegally accessed its network...

Open-Source Scanner Released to Detect CUPS Vulnerability

A new open-source scanner has been released to detect a critical vulnerability in the...

Comcast Cyber Attack Impacts 237,000+ Users Personal Data

Comcast Cable Communications LLC has reported that over 237,000 users' data has been compromised....

American Water Works Cyber Attack Impacts IT Systems

American Water Works Company, Inc., a leading provider of water and wastewater services, announced...

Free Webinar

Protect Websites & APIs from Malware Attack

Malware targeting customer-facing websites and API applications poses significant risks, including compliance violations, defacements, and even blacklisting.

Join us for an insightful webinar featuring Vivek Gopalan, VP of Products at Indusface, as he shares effective strategies for safeguarding websites and APIs against malware.

Discussion points

Scan DOM, internal links, and JavaScript libraries for hidden malware.
Detect website defacements in real time.
Protect your brand by monitoring for potential blacklisting.
Prevent malware from infiltrating your server and cloud infrastructure.

More like this

Hackers Gained Unauthorized Network Access to Casio Networks

Casio Computer Co., Ltd. has confirmed that a third party illegally accessed its network...

Open-Source Scanner Released to Detect CUPS Vulnerability

A new open-source scanner has been released to detect a critical vulnerability in the...

Comcast Cyber Attack Impacts 237,000+ Users Personal Data

Comcast Cable Communications LLC has reported that over 237,000 users' data has been compromised....