AKIRA Ransomware: Critical VPN & RMM Exploitation Alert — 4 New Victims | Security Arsenal

Threat Actor Profile — AKIRA

Aliases: None confirmed (acts primarily under the AKIRA brand).

Operating Model: Closed-group operation. Unlike RaaS models, AKIRA functions as a dedicated collective, managing their own negotiations and data leak site operations without recruiting affiliates. This typically indicates tighter operational security and a consistent TTP set.

Ransom Demands: Historically ranges from $200,000 to upwards of $4 million, depending on victim revenue and the exfiltrated data volume. They recently began accepting cryptocurrency payments exclusively, often negotiating aggressively if evidence of data restoration is not provided.

Initial Access Methods: AKIRA heavily favors external remote services. Their primary vectors include:

Exploited VPNs: Targeting unpatched security appliances (e.g., Cisco VPNs, FortiGate, and now Check Point gateways per KEV data).
Compromised RMM Tools: Leveraging valid credentials or vulnerabilities in remote monitoring and management software (ScreenConnect) to bypass perimeter defenses.
Phishing: Less common but observed using macro-laced documents targeting specific industries.

Double Extortion Approach: Standard operation involves exfiltrating sensitive data (P II, financials, CAD drawings) prior to encryption. They use tools like WinSCP, Rclone, and Mega to stage data. Leaks are posted on their TOR site if ransom is not paid.

Average Dwell Time: 3 to 10 days. AKIRA moves quickly once initial access is established, often achieving domain admin privileges within 48 hours.

Current Campaign Analysis

Sectors Targeted: The recent cluster of victims indicates a pivot towards Manufacturing, Professional Services, and Retail & E-Commerce. This suggests AKIRA is targeting organizations with high operational uptime requirements and complex supply chains, where the pressure to pay to restore operations is higher.

Geographic Concentration:

North America: Canada (CA), United States (US)
Europe: Czech Republic (CZ)

Victim Profile:

Kruse Construction (Manufacturing): Likely mid-market, given the construction sector profile.
University Sprinkler Systems (Prof. Services): Likely SMB to mid-market, regional specialization.
Novasport s.r.o. & Finer & Finer (Retail): E-commerce entities often hold high volumes of customer credit card data (PCI), increasing extortion leverage.

Posting Frequency: AKIRA posted 4 victims within a 48-hour window (July 21-22). This escalation suggests a successful exploitation of a widely used vulnerability or a batch of compromised credentials being utilized simultaneously.

CVE & Initial Access Vector Connection: There is a high probability that the recent victims were compromised via the following CISA KEV-listed vulnerabilities:

CVE-2024-1708 (ConnectWise ScreenConnect): A critical path traversal vulnerability allowing authentication bypass and RCE. Given the Professional Services and Retail targets, reliance on RMM tools is high, making this a prime candidate for initial access.
CVE-2026-50751 (Check Point Security Gateway): Improper authentication in IKEv1. Manufacturing targets often rely on VPNs for remote site management; exploitation here would provide direct network entry.
CVE-2026-20131 (Cisco Secure Firewall FMC): Deserialization vulnerability. If active, this allows an attacker to bypass firewall management controls.

Detection Engineering

The following detection logic targets AKIRA's specific TTPs observed in recent campaigns, focusing on their use of RMM exploitation and common exfil tools.

Sigma Rules

YAML

---
title: Potential ScreenConnect Authentication Bypass (CVE-2024-1708)
id: 3a1b2c3d-4e5f-6789-0123-456789abcdef
description: Detects suspicious path traversal patterns or anomalous access to ScreenConnect web interface characteristic of CVE-2024-1708 exploitation.
status: experimental
date: 2026/07/24
author: Security Arsenal Research
references:
    - https://www.cisa.gov/known-exploited-vulnerabilities-catalog
logsource:
    category: webserver
detection:
    selection:
        cs-uri-query|contains:
            - '..%2f'
            - '..%255c'
            - 'App_Extensions'
        c-uri|contains:
            - '/Bin/'
    condition: selection
falsepositives:
    - Unknown
level: critical
---
title: Suspicious Rclone/WinSCP Execution via PowerShell
id: b2c3d4e5-6f78-9012-3456-7890abcdef1
description: Detects execution of data exfiltration tools Rclone or WinSCP initiated by PowerShell, a common method for AKIRA data staging.
status: experimental
date: 2026/07/24
author: Security Arsenal Research
logsource:
    category: process_creation
    product: windows
detection:
    selection_img:
        Image|endswith:
            - '\powershell.exe'
            - '\pwsh.exe'
    selection_cli:
        CommandLine|contains:
            - 'rclone'
            - 'winscp'
            - 'megacmd'
    condition: all of selection_*
falsepositives:
    - Legitimate administrative data transfers
level: high
---
title: IKEv1 Anomaly Check Point Gateway (CVE-2026-50751)
id: c3d4e5f6-7890-1234-5678-90abcdef12
description: Detects potential exploitation of Check Point Security Gateway IKEv1 vulnerability via log anomalies or unexpected VPN session spikes.
status: experimental
date: 2026/07/24
author: Security Arsenal Research
logsource:
    product: firewall
    service: vpn
detection:
    selection:
        action: 'accept'
        protocol: 'ike'
        vpn_version: 'v1'
    filter_main:
        src_ip_range:
            - '10.0.0.0/8'
            - '192.168.0.0/16'
            - '172.16.0.0/12'
    condition: selection and not filter_main
falsepositives:
    - Legacy VPN clients from trusted ranges
level: medium

KQL (Microsoft Sentinel)

Hunt for lateral movement and staging indicators associated with AKIRA's use of PsExec and WMI for deployment, and vssadmin for recovery disruption.

KQL — Microsoft Sentinel / Defender

// Hunt for AKIRA lateral movement and pre-encryption activity
let TimeFrame = 1d;
let CommonLaunchers = dynamic(["powershell.exe", "cmd.exe", "rundll32.exe"]);
let LateralTools = dynamic(["psexec.exe", "psexec64.exe", "wmic.exe"]);
let DestructionTools = dynamic(["vssadmin.exe", "wbadmin.exe"]);
DeviceProcessEvents
| where Timestamp >= ago(TimeFrame)
| where FileName in (CommonLaunchers) or ProcessVersionInfoOriginalFileName in (CommonLaunchers)
| where ProcessCommandLine has any(LateralTools) or ProcessCommandLine has any(DestructionTools)
| extend ParsedCommand = parse_command_line(ProcessCommandLine, "windows")
| project Timestamp, DeviceName, FileName, ProcessCommandLine, InitiatingProcessFileName
| where ProcessCommandLine contains "accepteula" 
   or ProcessCommandLine contains "delete shadows" 
   or ProcessCommandLine contains "process call create"

Rapid Response Script (PowerShell)

This script enumerates scheduled tasks created in the last 7 days (common AKIRA persistence) and checks for the presence of known exfiltration tools in user directories.

PowerShell

# AKIRA Rapid Response Check
Write-Host "[+] Checking for suspicious scheduled tasks created in the last 7 days..." -ForegroundColor Cyan

$DateCutoff = (Get-Date).AddDays(-7)
$SuspiciousTasks = Get-ScheduledTask | Where-Object { 
    $_.Date -ge $DateCutoff -and 
    ($_.TaskName -notmatch "Microsoft" -and $_.TaskName -notmatch "Google" -and $_.TaskName -notmatch "Adobe") 
}

if ($SuspiciousTasks) {
    Write-Host "[!] ALERT: Found non-standard scheduled tasks created recently:" -ForegroundColor Red
    $SuspiciousTasks | Select-Object TaskName, Date, Author, TaskPath | Format-Table -AutoSize
} else {
    Write-Host "[-] No suspicious scheduled tasks found." -ForegroundColor Green
}

Write-Host "[+] Scanning for common AKIRA exfil tools (WinSCP, Rclone)..." -ForegroundColor Cyan

$Users = Get-ChildItem "C:\Users" -Directory
$ToolsFound = @()

foreach ($User in $Users) {
    $Paths = @(
        "$($User.FullName)\Downloads\rclone.exe",
        "$($User.FullName)\Downloads\winscp.exe",
        "$($User.FullName)\AppData\Local\Temp\rclone.exe"
    )
    foreach ($Path in $Paths) {
        if (Test-Path $Path) {
            $ToolsFound += $Path
        }
    }
}

if ($ToolsFound.Count -gt 0) {
    Write-Host "[!] ALERT: Found potential exfiltration tools:" -ForegroundColor Red
    $ToolsFound | ForEach-Object { Write-Host $_ -ForegroundColor Yellow }
} else {
    Write-Host "[-] No known exfil tools found in standard user paths." -ForegroundColor Green
}


---

Incident Response Priorities

T-Minus Detection Checklist:

RMM Logs: Immediate forensic review of ScreenConnect, ConnectWise, or similar RMM logs for path traversal attempts (looking for ..%2f or /Bin/ anomalies) on 2026-07-21 to 2026-07-22.
VPN Sessions: Audit Check Point VPN logs for successful IKEv1 handshakes from anomalous geolocations (non-US/CA/CZ connections for the victims listed).
Process Artifacts: Hunt for rclone.exe or winscp.exe execution via EDR or PowerShell script block logs.

Critical Assets for Exfiltration:

Retail: Customer databases (PII, PCI), inventory management systems.
Manufacturing: CAD designs, intellectual property, ERP systems (SAP/Oracle).
Professional Services: Client financial records, legal documents, contract databases.

Containment Actions (Ordered by Urgency):

Isolate: Disconnect infected hosts from the network immediately; preserve RAM for forensic volatile analysis.
Disable Access: Suspend all RMM service accounts and VPN accounts that show recent activity from the impacted periods. Force password resets for service accounts.
Block Outbound C2: Block network traffic to known cloud storage endpoints utilized by AKIRA (Mega, specific Mega.io subnets) at the firewall.

Hardening Recommendations

Immediate (24 Hours):

Patch CVE-2024-1708: Apply the ScreenConnect patch immediately or enforce MFA on all RMM access if patching is delayed.
VPN Hygiene: Disable IKEv1 on Check Point Security Gateways; enforce IKEv2 with MFA and strict Geo-IP blocking.
Account Hygiene: Ensure all privileged accounts (Domain Admins) have distinct, complex passwords and are not used for logons to internet-facing systems.

Short-Term (2 Weeks):

Network Segmentation: Implement strict VLAN segmentation to separate ICS/SCADA (Manufacturing) and POS (Retail) networks from the corporate IT domain.
EDR Deployment: Ensure endpoint detection is deployed on all critical assets, specifically focusing on visibility for PowerShell and WMI execution.
Identity Assurance: Move to phishing-resistant MFA (FIDO2) for all remote access solutions.

Related Resources

Security Arsenal Incident Response Managed SOC & MDR Services AlertMonitor Threat Detection From The Dark Side Intel Hub

AKIRA Ransomware: Critical VPN & RMM Exploitation Alert — 4 New Victims