AKIRA Ransomware Gang: 4 New Victims Posted — US/Brazil Targeting, CVE Correlation & Detection Rules

Classification: TLP:CLEAR | Briefing Date: 2026-09-21 | Source: Live monitoring of AKIRA .onion leak site via ransomware.live | Confidence: High (direct leak site observation)

Executive Summary

Dark web monitoring of the Akira ransomware gang's leak site confirms four new victim postings between September 17–18, 2026, concentrated in the United States and Brazil. Targeting spans Manufacturing, Professional Services, Technology, and Retail & E-Commerce — a sector mix consistent with Akira's opportunistic, access-driven victim selection rather than industry-specific campaigns. The timing of this activity correlates with several edge-device and remote-access CVEs currently listed in CISA's Known Exploited Vulnerabilities catalog with confirmed ransomware use, reinforcing Akira's well-documented preference for perimeter appliance exploitation as an initial access vector.

Organizations operating VMware vCenter, Cisco FMC, Check Point gateways, or ConnectWise ScreenConnect instances should treat this briefing as an immediate action item.

Threat Actor Profile — AKIRA

Akira affiliates are known for a disciplined playbook: establish persistence via VPN account, disable or tamper with security tooling, exfiltrate to cloud storage (historically Rclone to Mega/file.io), destroy backups, then deploy the encryptor during off-hours to maximize impact and minimize response windows.

Current Campaign Analysis

Observed Victim Postings (Last 100 Leak Site Entries — 4 New)

Sector Targeting

The cluster skews toward small-to-midsize enterprises (SMEs) — Akira's historical sweet spot. Manufacturing remains their most consistent vertical globally, and professional services firms (billing/revenue cycle, legal, accounting) are prized for the sensitivity of third-party data they hold, which amplifies extortion leverage.

Geographic Concentration

50% United States, 50% Brazil in this posting batch. Akira's US focus is long-standing; the Brazilian postings align with the group's expanding Latin American affiliate activity, where VPN/RDP hygiene in mid-market organizations tends to lag. Organizations with Brazilian subsidiaries or shared AD forests should extend hunting to those environments.

Victim Profile

Based on sector mix, estimated victim revenue range is $10M–$250M — organizations large enough to pay meaningful ransoms but frequently lacking 24/7 SOC coverage, EDR maturity, or enforced MFA on remote access. The automotive dealership (Javep Chevrolet) and revenue-cycle management firm fit Akira's pattern of targeting vertically-dependent SMBs where downtime is immediately existential.

Posting Frequency / Escalation

Four postings across a 48-hour window (Sept 17–18) suggests either a single affiliate working through a pipeline or multiple affiliates detonating nearly simultaneously — a pattern observed when a fresh initial access vector (e.g., a newly weaponized edge CVE) yields a batch of concurrent intrusions. Expect follow-on postings within 7–14 days from this wave.

CVE Correlation — Probable Initial Access Vectors

Akira's documented tradecraft maps directly onto several KEV entries with confirmed ransomware use:

• CVE-2026-59310 (VMware vCenter Path Traversal) — Post-compromise gold: vCenter access enables ESXi datastore encryption at hypervisor scale, Akira's highest-impact attack path.
• CVE-2026-20316 (Cisco FMC Hard-coded Password) — Firewall management plane compromise yields network-wide visibility and policy manipulation — consistent with Akira's Cisco-centric perimeter targeting.
• CVE-2026-50751 (Check Point IKEv1 Improper Authentication) — Direct VPN gateway authentication bypass; a textbook Akira entry vector.
• CVE-2026-48027 (Nx Console Malicious Code) — Supply chain/developer workstation foothold, relevant to the Technology-sector victim (Vetta).
• CVE-2024-1708 (ConnectWise ScreenConnect Path Traversal / RCE) — MSP/RMM tool exploitation; ransomware-confirmed and heavily abused for SME access — matches the SMB victim profile in this batch.

Assessment (Moderate Confidence): At least two of the four intrusions likely originated via edge-device or RMM-tool exploitation rather than phishing, given the compressed detonation timeline.

Detection Engineering

Sigma Rules

---
title: Akira Ransomware - Shadow Copy Deletion via vssadmin or WMIC
id: 8f2a1c4e-akira-0001-4d2a-9e3f-1a2b3c4d5e01
status: production
description: Detects Volume Shadow Copy deletion, a near-universal pre-encryption step in Akira intrusions
author: Security Arsenal Threat Intelligence
references:
  - https://securityarsenal.com/darkside
date: 2026/09/21
modified: 2026/09/21
tags:
  - attack.impact
  - attack.t1490
logsource:
  category: process_creation
  product: windows
level: critical
detection:
  selection_img:
    Image|endswith:
      - '\vssadmin.exe'
      - '\wmic.exe'
      - '\bcdedit.exe'
      - '\wbadmin.exe'
  selection_cmd:
    CommandLine|contains:
      - 'delete shadows'
      - 'shadowcopy delete'
      - 'delete catalog'
      - 'recoveryenabled no'
      - 'bootstatuspolicy ignoreallfailures'
  condition: selection_img and selection_cmd
falsepositives:
  - Legitimate backup maintenance windows (rare; correlate with admin change tickets)

---
title: Akira Ransomware - Lateral Movement via PsExec Service Creation
id: 8f2a1c4e-akira-0002-4d2a-9e3f-1a2b3c4d5e02
status: production
description: Detects PsExec-style remote service installation and execution consistent with Akira affiliate lateral movement
author: Security Arsenal Threat Intelligence
date: 2026/09/21
modified: 2026/09/21
tags:
  - attack.lateral_movement
  - attack.t1569.002
  - attack.t1021.002
logsource:
  product: windows
  service: system
level: high
detection:
  selection_event:
    EventID: 7045
  selection_service:
    ServiceName|contains:
      - 'PSEXESVC'
      - 'PAExec'
      - 'csexec'
    ImagePath|contains:
      - 'ADMIN$'
      - '\\.\pipe\'
  condition: selection_event and 1 of selection_service*
falsepositives:
  - Authorized administrative tooling deployments

---
title: Akira Ransomware - Data Exfiltration Tool Execution (Rclone / WinSCP / Cloud Sync)
id: 8f2a1c4e-akira-0003-4d2a-9e3f-1a2b3c4d5e03
status: production
description: Detects execution of file transfer tools Akira affiliates use for pre-encryption data exfiltration
author: Security Arsenal Threat Intelligence
date: 2026/09/21
modified: 2026/09/21
tags:
  - attack.exfiltration
  - attack.t1567.002
  - attack.t1105
logsource:
  category: process_creation
  product: windows
level: high
detection:
  selection_img:
    Image|endswith:
      - '\rclone.exe'
      - '\winscp.exe'
      - '\filezilla.exe'
      - '\megacmd.exe'
  selection_suspicious_path:
    Image|contains:
      - '\Users\Public\'
      - '\ProgramData\'
      - '\AppData\Local\Temp\'
      - '\Windows\Temp\'
  selection_rclone_args:
    CommandLine|contains:
      - 'copy'
      - 'sync'
      - 'move'
      - '--transfers'
      - 'mega:'
      - 's3:'
  condition: (selection_img and selection_suspicious_path) or (selection_img and selection_rclone_args)
falsepositives:
  - Legitimate cloud backup tooling (whitelist known business rclone configs by path and account)

Microsoft Sentinel KQL — Pre-Encryption Staging & Lateral Movement Hunt

// Akira TTP hunt: VPN logon -> admin share access -> staging tool drop -> shadow copy deletion
// Run over 14 days; pivot on any host hitting 2+ stages
let Lookback = 14d;
let SuspiciousTools = dynamic(["rclone.exe","winscp.exe","psexec.exe","psexesvc.exe","anydesk.exe","advanced_ip_scanner.exe","netscan.exe","vssadmin.exe"]);
let VPNLogons =
    SigninLogs
    | where TimeGenerated > ago(Lookback)
    | where AppDisplayName has_any ("VPN","AnyConnect","SSL","GlobalProtect","SonicWall") or AuthenticationRequirement == "singleFactorAuthentication"
    | summarize VPNEvents=count(), FirstVPN=min(TimeGenerated) by UserPrincipalName, IPAddress, bin(TimeGenerated, 1h);
let ToolExecution =
    DeviceProcessEvents
    | where TimeGenerated > ago(Lookback)
    | where FileName in~ (SuspiciousTools) or ProcessCommandLine has_any ("delete shadows","shadowcopy delete","bootstatuspolicy ignoreallfailures","net stop","taskkill /f")
    | extend Stage = case(
        ProcessCommandLine has_any ("delete shadows","shadowcopy"), "ShadowDeletion",
        FileName in~ ("rclone.exe","winscp.exe"), "ExfilStaging",
        FileName has "psexec", "LateralMovement",
        "ToolDrop")
    | summarize StageHits=make_set(Stage), ToolCount=count() by DeviceName, InitiatingProcessAccountName, bin(TimeGenerated, 1h);
let AdminShareAccess =
    DeviceNetworkEvents
    | where TimeGenerated > ago(Lookback)
    | where RemotePort == 445
    | summarize SMBTargets=dcount(RemoteIP) by DeviceName, InitiatingProcessAccountName, bin(TimeGenerated, 1h)
    | where SMBTargets > 5;  // fan-out SMB = lateral movement signature
ToolExecution
| join kind=inner AdminShareAccess on DeviceName, TimeGenerated
| join kind=leftouter VPNLogons on $left.InitiatingProcessAccountName == $right.UserPrincipalName
| project TimeGenerated, DeviceName, InitiatingProcessAccountName, StageHits, SMBTargets, VPNEvents, IPAddress
| sort by TimeGenerated desc;

Rapid Response PowerShell — Akira Pre-Detonation Indicator Sweep

#Requires -RunAsAdministrator
# Akira Rapid Triage: run on suspected hosts or fleet-wide via your RMM/EDR
# Checks: shadow copies, new services (7d), scheduled tasks (7d), suspicious tools, RDP exposure

$report = @()
$cutoff = (Get-Date).AddDays(-7)

Write-Host "=== [1/5] Volume Shadow Copies ===" -ForegroundColor Cyan
$shadows = Get-CimInstance Win32_ShadowCopy -ErrorAction SilentlyContinue
if (-not $shadows) { $report += "ALERT: NO shadow copies found - possible vssadmin deletion (Akira pre-encryption step)" }
else { $report += "OK: $($shadows.Count) shadow copies present, newest: $(($shadows | Sort-Object InstallDate -Descending | Select-Object -First 1).InstallDate)" }

Write-Host "=== [2/5] Services Created in Last 7 Days ===" -ForegroundColor Cyan
$newSvc = Get-WinEvent -FilterHashtable @{LogName='System'; Id=7045; StartTime=$cutoff} -ErrorAction SilentlyContinue
foreach ($e in $newSvc) {
    $report += "NEW SERVICE: $($e.TimeCreated) - $($e.Message -split "`n" | Select-Object -First 2)"
    if ($e.Message -match 'PSEXESVC|PAExec|ADMIN\$|Temp') { $report += "  ^^ HIGH RISK: matches Akira lateral movement pattern" }
}

Write-Host "=== [3/5] Scheduled Tasks Created/Modified in Last 7 Days ===" -ForegroundColor Cyan
Get-ScheduledTask | Where-Object { $_.Date -and ([datetime]$_.Date) -gt $cutoff } | ForEach-Object {
    $report += "TASK: $($_.TaskName) | $($_.TaskPath) | $($_.Date)"
}

Write-Host "=== [4/5] Akira Staging Tool Artifacts ===" -ForegroundColor Cyan
$toolPaths = @("$env:PUBLIC","$env:ProgramData","$env:TEMP","C:\Windows\Temp")
$toolNames = @("rclone*.exe","winscp*.exe","anydesk*.exe","advanced*scanner*.exe","netscan*.exe","psexec*.exe","*.akira","*.powerranges")
foreach ($p in $toolPaths) {
    foreach ($n in $toolNames) {
        Get-ChildItem -Path $p -Filter $n -Recurse -ErrorAction SilentlyContinue | ForEach-Object {
            $report += "TOOL FOUND: $($_.FullName) | Modified: $($_.LastWriteTime)"
        }
    }
}

Write-Host "=== [5/5] RDP / Remote Access Exposure ===" -ForegroundColor Cyan
$rdpEnabled = (Get-ItemProperty 'HKLM:\SYSTEM\CurrentControlSet\Control\Terminal Server').fDenyTSConnections -eq 0
$nla = (Get-ItemProperty 'HKLM:\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp' -ErrorAction SilentlyContinue).UserAuthentication
$report += "RDP Enabled: $rdpEnabled | NLA: $nla"
if ($rdpEnabled -and $nla -ne 1) { $report += "ALERT: RDP enabled WITHOUT NLA - brute-force exposure" }
$failedLogons = (Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4625; StartTime=(Get-Date).AddDays(-3)} -ErrorAction SilentlyContinue | Where-Object { $_.Message -match 'Logon Type:\s+(3|10)' }).Count
$report += "Failed network/RDP logons (72h): $failedLogons"
if ($failedLogons -gt 100) { $report += "ALERT: High failed-logon volume - possible brute force against VPN/RDP-adjacent account" }

$report | Out-File "$env:ProgramData\akira_triage_$(Get-Date -Format 'yyyyMMdd_HHmm').txt"
$report | ForEach-Object { Write-Host $_ }
Write-Host "`nReport saved. If any ALERT lines: isolate host, preserve memory, engage IR." -ForegroundColor Yellow

Incident Response Priorities — Akira Playbook

T-Minus Detection Checklist (Before Encryption Fires)

1. New VPN logons from unusual geographies/ASNs on accounts without MFA — Akira's #1 entry signal.
2. EDR/AV tampering events — service stops on Defender, SentinelOne, CrowdStrike; registry modification of exclusion paths.
3. Rclone or WinSCP execution anywhere — treat as exfiltration-in-progress until disproven.
4. vssadmin / bcdedit / wbadmin execution — you are likely <6 hours from detonation.
5. PsExec service installs across multiple hosts in short windows — encryptor staging.
6. Veeam/backup server access anomalies — Akira targets backup infrastructure deliberately before detonation.
7. Net-scanning tool drops (advanced_ip_scanner, netscan) — recon preceding lateral spread.

Assets Akira Historically Prioritizes for Exfiltration

• Financial records, accounting exports, and payroll data
• HR files (PII, SSNs, background checks) — maximum regulatory pressure
• Legal documents, contracts, and client/customer databases
• For professional services victims: third-party client data (used as secondary extortion leverage)
• For manufacturing victims: CAD files, IP, schematics, ERP exports

Containment Actions — Ordered by Urgency

1. Disable the compromised VPN/remote-access account(s) and force credential reset for all accounts with remote access rights.
2. Isolate affected hosts at the network layer (EDR network containment or switch-level), not just software-level.
3. Block egress to known exfil destinations (Mega, file.io, anonymous S3 buckets) at the proxy/firewall — if exfil is still running, every minute matters.
4. Protect backup infrastructure: take backup management consoles offline, verify immutable/offline copies are intact and unreachable from the compromised segment.
5. Preserve forensic evidence before rebuild: memory capture on patient zero, VPN logs, firewall session logs (edge-device compromise evidence is volatile).
6. Assume domain-wide compromise if lateral movement is observed — initiate enterprise credential rotation (KRBTGT twice, all service accounts, all privileged accounts).
7. Engage IR counsel before any leak-site negotiation — Akira publishes on schedule; the leak timer does not pause for deliberation.

Hardening Recommendations

Immediate (24 Hours)

• Patch or isolate any internet-facing instance of: VMware vCenter (CVE-2026-59310), Cisco FMC (CVE-2026-20316), Check Point gateways (CVE-2026-50751), ConnectWise ScreenConnect (CVE-2024-1708). If patching is blocked, pull the management interfaces off the public internet today.
• Enforce MFA on every VPN/remote access account — no exceptions for service or legacy accounts; Akira's single highest-yield vector is MFA-less VPN credentials.
• Block execution of rclone, winscp, psexec, and anydesk via AppLocker/WDAC or EDR policy where not explicitly business-required.
• Alert on vssadmin delete shadows and bcdedit execution — deploy the Sigma rules above.
• Audit service accounts for interactive/VPN logon rights and revoke where not needed.

Short-Term (2 Weeks)

• Segment backup infrastructure onto a dedicated management network with no route from production VLANs; move to immutable or offline backup copies.
• Deploy EDR in block mode fleet-wide, including servers and ESXi-adjacent management hosts — Akira's Linux encryptor targets environments where hypervisors lack coverage.
• Implement identity-based segmentation so a single compromised VPN account cannot reach domain controllers, backup servers, or hypervisor management planes.
• Enable tamper protection and configure alerting on any security-tool service stop or exclusion change.
• Run a purple-team exercise replaying the Akira kill chain (VPN entry → discovery → exfil → shadow deletion → ESXi encryption) against your detection stack.
• Establish dark web monitoring for your organization and key subsidiaries — leak site postings often provide the first external confirmation of a breach, and pre-posting chatter can provide advance warning.

This briefing is based on direct observation of Akira's dark web leak infrastructure as of 2026-09-21. Victim names are published as observed; Security Arsenal does not communicate with threat actors. Indicators and rules should be validated in a test environment before production deployment.

Related Resources

Security Arsenal Incident Response Managed SOC & MDR Services AlertMonitor Threat Detection From The Dark Side Intel Hub