AKIRA Ransomware: 2 New Victims in Hospitality & Arts — Critical Firewall & RCE Exploits

Threat Actor Profile — AKIRA

AKIRA is a prominent ransomware-as-a-service (RaaS) operation that emerged in early 2023. Known for its distinct ransomware written in C++, the group targets businesses globally with a focus on double extortion—encrypting systems and exfiltrating sensitive data for leverage.

• Model: RaaS with a decentralized affiliate network.
• Typical Ransom Demands: $200,000 to $4,000,000 USD, often negotiated down based on victim revenue.
• Initial Access Vectors: Historically relies on exploiting exposed VPN services (Fortinet, Cisco, Check Point) and valid credentials obtained via info-stealers or initial access brokers. Phishing remains a secondary vector.
• Tactics: Heavy use of PowerShell for discovery, PsExec and WMI for lateral movement, and WinRAR or megasync for data exfiltration prior to encryption.
• Dwell Time: Typically 3 to 10 days, indicating a "smash-and-grab" or opportunistic approach rather than long-term persistence.

Current Campaign Analysis

Based on live data from the AKIRA leak site on 2026-07-29, the group has shifted focus toward softer targets in the United States, specifically within the Hospitality and Arts sectors.

Targeting Overview

• Sectors: Hospitality (Private Clubs), Arts/Design.
• Geographic Concentration: 100% United States (based on recent victim Franz Krause artworksgroup).
• Victim Profile: Small to Medium-sized Businesses (SMBs). These organizations typically lack dedicated 24/7 SOC monitoring, making them prime candidates for VPN exploitation.

Observed Activity

• Victims:
  • Northwood Country Club: Posted 2026-07-29. High-value member data likely at risk.
  • Franz Krause artworksgroup: Posted 2026-07-28. Intellectual property and client lists likely prioritized for exfiltration.
• Posting Frequency: Low volume (2 victims in recent dump), suggesting a high-degree of manual targeting or specific exploitation of a vulnerability chain rather than automated mass spraying.

CVE Correlation & Initial Access

The recent victims likely fell victim to the cluster of actively exploited vulnerabilities AKIRA affiliates are weaponizing:

1. CVE-2026-50751 (Check Point Security Gateway): An improper authentication vulnerability in IKEv1. Given the prevalence of Check Point in enterprise perimeter defense, this is a probable initial access vector for the Northwood Country Club victim.
2. CVE-2024-1708 (ConnectWise ScreenConnect): A path traversal vulnerability allowing RCE. RMM tools are frequently exploited by AKIRA to establish a foothold on internal networks without tripping standard VPN alerts.
3. CVE-2026-20131 (Cisco Secure Firewall FMC): Deserialization vulnerability allowing unauthenticated remote code execution.

Detection Engineering

Sigma Rules

---
title: Potential Check Point VPN IKEv1 Exploitation CVE-2026-50751
id: d1a6c8b9-0e2d-4b1a-9f8c-3d2e5f6a7b8c
description: Detects potential exploitation of CVE-2026-50751 involving improper authentication in IKEv1 key exchanges on Check Point Security Gateways.
status: experimental
author: Security Arsenal Research
date: 2026/07/29
tags:
  - attack.initial_access
  - cve.2026.50751
  - detection.emerging_threats
logsource:
  product: firewall
  service: check_point
detection:
  selection:
    action|contains: 'accept'
    service: 'ike'
    ike_version: 'v1'
    error|contains:
      - 'authentication failure'
      - 'invalid cookie'
  condition: selection | count() > 10
falsepositives:
  - Legacy VPN misconfigurations
level: high
---
title: Suspicious ConnectWise ScreenConnect Path Traversal CVE-2024-1708
id: e2b7d9c0-1f3e-5c2b-0a9d-4e3f6g7h8i9j
description: Detects web request patterns associated with CVE-2024-1708 exploitation on ConnectWise ScreenConnect servers.
status: experimental
author: Security Arsenal Research
date: 2026/07/29
tags:
  - attack.initial_access
  - cve.2024.1708
  - attack.t1190
logsource:
  category: webserver
detection:
  selection_uri:
    cs-uri-query|contains:
      - '..\'
      - '%2e%2e%5c'
      - 'Authorization='
  selection_agent:
    cs-user-agent|contains: 'ScreenConnect'
  condition: all of selection_*
falsepositives:
  - Rare legitimate testing (unlikely)
level: critical
---
title: AKIRA Ransomware Lateral Movement and Staging
id: f3c8e0d1-2g4f-6d3c-1b0e-5f4g7h8i9j0k
description: Detects patterns consistent with AKIRA ransomware operations, including WinRAR usage for compression and PsExec for lateral movement.
status: experimental
author: Security Arsenal Research
date: 2026/07/29
tags:
  - attack.lateral_movement
  - attack.exfiltration
  - attack.t1021.002
logsource:
  category: process_creation
detection:
  selection_psexec:
    Image|endswith: '\PsExec.exe'
    CommandLine|contains: '-accepteula'
  selection_staging:
    Image|endswith:
      - '\winrar.exe'
      - '\rar.exe'
    CommandLine|contains:
      - '-hp'  # Password protected
      - '-m5'  # Best compression
  condition: 1 of selection_*
falsepositives:
  - Administrative backups
level: high

KQL (Microsoft Sentinel)

// Hunt for AKIRA pre-encryption staging and lateral movement
// Looks for PowerShell spawning archiving tools or PsExec
DeviceProcessEvents
| where Timestamp >= ago(7d)
| where InitiatingProcessFileName == "powershell.exe"
| where FileName in~ ("winrar.exe", "rar.exe", "7z.exe", "psexec.exe", "wmic.exe")
| project Timestamp, DeviceName, AccountName, InitiatingProcessCommandLine, CommandLine, FileName
| order by Timestamp desc

Rapid Response Hardening Script

# AKIRA Response Checklist: Check for recent scheduled tasks and exposed RDP
# Must be run as Administrator

Write-Host "[+] Checking for Scheduled Tasks created in the last 7 days..." -ForegroundColor Cyan
Get-ScheduledTask | Where-Object {
    $_.Date -gt (Get-Date).AddDays(-7)
} | Select-Object TaskName, Date, Author, Actions | Format-Table -AutoSize

Write-Host "[+] Checking Event Logs for VSS Shadow Copy Deletion (Pre-Encryption)..." -ForegroundColor Cyan
$VSSEvents = Get-WinEvent -FilterHashtable @{LogName='Application'; ProviderName='VSS'; ID=12343} -ErrorAction SilentlyContinue
if ($VSSEvents) {
    $VSSEvents | Select-Object TimeCreated, Message | Format-List
} else {
    Write-Host "No VSS deletion events found." -ForegroundColor Green
}

Write-Host "[+] Auditing RDP Users currently logged in..." -ForegroundColor Cyan
$query = "SELECT * FROM Win32_LogonSession WHERE LogonType = 10"
Get-CimInstance -Query $query | ForEach-Object {
    $sessionId = $_.LogonId
    $user = Get-CimInstance -Query "ASSOCIATORS OF {Win32_LogonSession.LogonId='$sessionId'} WHERE ResultClass=Win32_UserAccount"
    if ($user) { Write-Host "User: $($user.Name) on Session: $sessionId" }
}

Incident Response Priorities

T-Minus Detection Checklist (Pre-Encryption)

1. VPN/RMM Logs: Immediate review of Check Point and Cisco FMC logs for anomalies matching CVE-2026-50751 and CVE-2026-20131.
2. Process Anomalies: Hunt for instances of powershell.exe spawning winrar.exe or rclone.
3. Mass File Modification: Monitor for simultaneous modification of file extensions (e.g., .akira) on network shares.

Critical Assets at Risk

AKIRA historically targets:

• Hospitality: Member PII databases, payment card histories (PCI), reservation systems.
• Arts/Design: High-resolution intellectual property, client lists, financial contracts.

Containment Actions

1. Isolate VPN Concentrators: Disconnect Check Point and Cisco FMC management interfaces from the internet immediately if unpatched.
2. Disable RMM Tools: Temporarily disable ConnectWise ScreenConnect services until CVE-2024-1708 is verified patched.
3. Segmentation: Sever connectivity between guest Wi-Fi networks (common in Hospitality) and the administrative back-office network.

Hardening Recommendations

Immediate (24 Hours)

• Patch Critical CVEs: Apply patches for CVE-2026-50751 (Check Point), CVE-2026-20131 (Cisco FMC), and CVE-2024-1708 (ConnectWise).
• MFA Enforcement: Ensure all VPN and RMM access requires hardware token MFA (FIDO2), blocking push notifications if possible to prevent MFA fatigue attacks.
• Block RDP: Ensure TCP/3389 is blocked from the internet at the edge firewall.

Short-term (2 Weeks)

• Network Segmentation: Implement Zero Trust segmentation to limit the blast radius of compromised VPN credentials.
• EDR Deployment: Extend EDR coverage to legacy systems often found in Hospitality management (e.g., older POS terminals).

Related Resources

Security Arsenal Incident Response Managed SOC & MDR Services AlertMonitor Threat Detection From The Dark Side Intel Hub