Classification: TLP:CLEAR | Publication Date: 2026-09-26 | Source: ransomware.live leak-site monitoring (single-source for some listings — see Sourcing & Verification) | Nature of data: Unverified threat-actor claims

AKIRA Ransomware Gang: 5 New Victim Claims Posted

Executive Summary

Between 2026-09-23 and 2026-09-24, the AKIRA ransomware operation listed five organizations on its dark web leak site: Wallatec, Strack Companies, Urban Engineering, HIT dd, and Apex Litigation Support. The claimed victim set clusters around US-based manufacturing and professional services organizations — consistent with AKIRA's long-standing preference for mid-market enterprises with mature data stores and limited security operations coverage.

These are claims by a criminal actor, not confirmed breaches. However, AKIRA's historical posting-to-disclosure correlation is among the strongest of any active ransomware-as-a-service operation, which means organizations in the targeted sectors should treat this activity as a leading indicator, not noise. This briefing provides AKIRA's current tradecraft profile, sector-level exposure analysis against actively exploited CVEs, and deployable detection content for SOC teams.

Sourcing & Verification

Of the five listings covered in this briefing:

• 2 listings (Wallatec, Strack Companies) were independently observed by a second leak-site crawler [MULTI-SOURCE] — meaning two separate monitoring services saw AKIRA post the claim.
• 3 listings (Urban Engineering, HIT dd, Apex Litigation Support) appear on ransomware.live only [SINGLE-SOURCE] — no second-crawler confirmation that the posting even exists.

Multi-source corroboration confirms only that the gang made the claim. It does not confirm that any breach occurred. No tier in this dataset confirms a breach — only the named organization or its regulator can do that.

A named organization may dispute a listing, and a denial is likewise not proof the claim is false. Disclosure obligations vary by jurisdiction and sector, and not every incident is reportable — so neither silence nor denial settles the question. Security Arsenal will publish corrections as warranted and welcomes contact from any named organization at security@securityarsenal.com.

Threat Actor Profile — AKIRA

Aliases and lineage: AKIRA emerged in March 2023 and is assessed with moderate confidence to share code lineage and possible personnel overlap with the defunct Conti operation, based on early binary similarities and cryptocurrency wallet overlap reported across industry research. The group operates separate Windows and Linux/ESXi encryptor variants.

Operating model: AKIRA runs a ransomware-as-a-service (RaaS) program with affiliates handling intrusion and deployment while the core group manages the leak site, negotiation infrastructure, and decryptor delivery. Affiliate quality varies, which produces inconsistent tradecraft between intrusions — defenders should not anchor on a single TTP set.

Ransom demands: Demands typically range from roughly $200,000 to several million dollars, scaled to the victim's estimated revenue. AKIRA negotiators are known to accept substantial reductions from opening demands and to offer "delete-only" options (pay for data deletion without a decryptor).

Initial access methods (historical):

• Compromised VPN credentials, particularly against appliances lacking MFA (Cisco ASA, SonicWall, Fortinet, Check Point)
• Exploitation of known vulnerabilities in edge devices and remote access services
• Phishing with malicious attachments or credential-harvesting lures
• Exposed RDP and brute-forced remote access

Extortion model: Double extortion is standard. AKIRA affiliates exfiltrate data before encryption and publish victim names — often with staged data releases — on their Tor-hosted leak site to pressure payment. The group has historically been willing to leak data in tranches to escalate pressure.

Dwell time: Observed dwell time from initial access to encryption typically ranges from a few days to approximately two weeks, with hands-on-keyboard lateral movement, credential dumping, and exfiltration occurring in the days immediately before detonation. Data staging and exfiltration frequently occur outside business hours.

Current Campaign Analysis

Claimed victim set (2026-09-23 through 2026-09-24)

Sector targeting

Manufacturing and professional services dominate this posting batch — two manufacturing listings and one professional services listing (litigation support), with two listings lacking clear sector classification. This mirrors AKIRA's established pattern: mid-market manufacturers with flat networks and OT-adjacent IT, and professional services firms holding sensitive client data (litigation support providers are especially attractive because the data they hold is inherently adversarial and time-sensitive).

Geographic concentration

The only country-tagged listing is US-based (Strack Companies). The remaining four listings have no country tag in the source data, and we will not speculate. AKIRA's historical victim base is predominantly North American and Western European.

Victim profile

AKIRA's affiliate playbook targets the mid-market: organizations typically in the tens to low hundreds of millions of dollars in annual revenue — large enough to pay, small enough to lack 24/7 detection. Manufacturing and professional services listings in this batch fit that profile: organizations likely running hybrid infrastructure, VPN-dependent remote access, and limited EDR coverage on servers.

Posting cadence

Five listings across 48 hours (2026-09-23 to 2026-09-24) represents a burst rather than a drip. Burst posting often indicates either a batch of affiliates completing intrusions in parallel, or a deliberate pressure tactic where the gang publishes multiple names simultaneously to fill the leak site. Watch for follow-on data-sample releases from these listings over the next 7–14 days.

CVE exposure context (hypothesis — not victim attribution)

We have no evidence linking any specific CVE to any named organization above. What we can say is that AKIRA is historically an edge-device and remote-access exploiter, and the current CISA KEV catalog contains several vulnerabilities that align with that access model and that defenders in the targeted sectors should treat as urgent:

• CVE-2026-50751 (Check Point Security Gateway, improper authentication in IKEv1 key exchange) — VPN gateway compromise is AKIRA's signature initial access vector. Any unpatched Check Point gateway should be treated as a standing invitation.
• CVE-2026-20316 (Cisco Secure Firewall Management Center, hard-coded password) — management-plane compromise of network security infrastructure enables persistent, stealthy access.
• CVE-2026-59310 (VMware vCenter path traversal) — AKIRA operates an ESXi encryptor variant; vCenter access is the shortest path to mass hypervisor encryption.
• CVE-2026-63077 (JetBrains TeamCity deserialization) — CI/CD server compromise yields source code, secrets, and deployment credentials — high-value exfiltration and lateral movement material.
• CVE-2026-48027 (Nx Console embedded malicious code) — supply-chain exposure in developer tooling; relevant to the professional services and engineering-adjacent sectors in this batch.

Patch priority should follow internet exposure first, then management-plane access, then developer infrastructure.

Detection Engineering

The following detections target AKIRA's documented tradecraft: VPN/edge-device initial access, net/nltest discovery, VSS deletion before encryption, PsExec/WMI lateral movement, and staging of data for exfiltration via common archiving and cloud-sync tooling.

---
title: AKIRA Pre-Encryption Defense Evasion - Volume Shadow Copy Deletion
id: 8f2c1a4e-7b3d-4e9a-a1c2-5d6e7f8a9b01
status: experimental
description: Detects deletion or manipulation of Volume Shadow Copies via vssadmin, wmic, or bcdedit — a near-universal AKIRA pre-encryption step.
author: Security Arsenal Threat Intelligence
references:
  - https://www.cisa.gov/news-events/cybersecurity-advisories
date: 2026/09/26
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    Image|endswith:
      - '\vssadmin.exe'
      - '\wmic.exe'
      - '\bcdedit.exe'
      - '\diskshadow.exe'
  selection_cmd:
    CommandLine|contains:
      - 'delete shadows'
      - 'shadowcopy delete'
      - 'resize shadowstorage'
      - 'recoveryenabled no'
  condition: selection_img and selection_cmd
falsepositives:
  - Legitimate backup administration
  - System administrators resizing shadow storage
level: high
tags:
  - attack.impact
  - attack.t1490
---
title: AKIRA Lateral Movement - PsExec Service Installation and Remote WMI Execution
id: 9a3d2b5f-8c4e-5f0b-b2d3-6e7f8a9b0c12
status: experimental
description: Detects PsExec-style service creation (Event 7045) and WMI remote process execution consistent with AKIRA affiliate lateral movement and encryptor deployment.
author: Security Arsenal Threat Intelligence
date: 2026/09/26
logsource:
  product: windows
  service: system
detection:
  selection_psexec:
    EventID: 7045
    ServiceName|contains:
      - 'PSEXESVC'
      - 'PAExec'
  selection_wmi:
    EventID: 7045
    ImagePath|contains:
      - '\\ADMIN$\\'
      - '\\IPC$\\'
  condition: selection_psexec or selection_wmi
falsepositives:
  - Legitimate remote administration tooling
  - Software deployment systems (SCCM/Intune may generate similar artifacts)
level: high
tags:
  - attack.lateral-movement
  - attack.t1569.002
  - attack.t1047
---
title: AKIRA Discovery and Staging - Batch Reconnaissance and Archive Creation
id: 1b4e3c60-9d5f-601c-c3e4-7f809b1d2e34
status: experimental
description: Detects burst execution of network/domain discovery commands and archiving utility invocation consistent with AKIRA pre-exfiltration staging.
author: Security Arsenal Threat Intelligence
date: 2026/09/26
logsource:
  category: process_creation
  product: windows
detection:
  selection_discovery:
    CommandLine|contains:
      - 'nltest /dclist'
      - 'nltest /domain_trusts'
      - 'net group "domain admins"'
      - 'net localgroup administrators'
      - 'arp -a'
      - 'route print'
  selection_archive:
    Image|endswith:
      - '\rar.exe'
      - '\7z.exe'
      - '\winrar.exe'
    CommandLine|contains:
      - ' a '
      - ' -hp'
      - '.rar'
      - '.7z'
  timeframe: 5m
  condition: selection_discovery | count() > 3 or selection_archive
falsepositives:
  - IT administration scripts
  - Backup and archival jobs
level: medium
tags:
  - attack.discovery
  - attack.t1487
  - attack.collection
  - attack.t1560.001

// AKIRA pre-ransomware staging hunt: lateral movement + exfil staging correlation
// Microsoft Sentinel — look for hosts that (a) execute discovery bursts,
// (b) receive remote service installs, and (c) spawn archiving/sync tooling
// within a 24h window. Tune thresholds to environment baseline.
let DiscoveryCmds = dynamic(["nltest", "net group", "net localgroup", "arp -a", "ipconfig /all", "systeminfo", "quser", "qwinsta"]);
let Discovery =
    DeviceProcessEvents
    | where TimeGenerated > ago(24h)
    | where ProcessCommandLine has_any (DiscoveryCmds)
    | summarize DiscoveryCount = count(), DiscoveryCmdsUsed = make_set(ProcessCommandLine, 20)
      by DeviceName, InitiatingProcessAccountName, bin(TimeGenerated, 1h)
    | where DiscoveryCount >= 5;
let RemoteServiceInstall =
    Event
    | where TimeGenerated > ago(24h)
    | where EventLog == "System" and EventID == 7045
    | extend ServiceName = tostring(parse_json(EventData).ServiceName),
             ImagePath = tostring(parse_json(EventData).ImagePath)
    | where ServiceName has_any ("PSEXESVC", "PAExec") or ImagePath has_any ("ADMIN$", "IPC$")
    | project ServiceInstallTime = TimeGenerated, Computer, ServiceName, ImagePath;
let StagingTools =
    DeviceProcessEvents
    | where TimeGenerated > ago(24h)
    | where FileName in~ ("rar.exe", "7z.exe", "winrar.exe", "rclone.exe", "megasync.exe", "filezilla.exe", "winscp.exe")
       or ProcessCommandLine has_any ("rclone copy", "rclone move", "--transfers", ".mega.nz")
    | project StagingTime = TimeGenerated, DeviceName, FileName, ProcessCommandLine, InitiatingProcessAccountName;
Discovery
| join kind=inner (StagingTools) on DeviceName
| join kind=leftouter (RemoteServiceInstall) on $left.DeviceName == $right.Computer
| project DeviceName, InitiatingProcessAccountName, DiscoveryCount,
          DiscoveryCmdsUsed, FileName, ProcessCommandLine, ServiceName, ImagePath, StagingTime
| order by DiscoveryCount desc;

# AKIRA Rapid Triage — run on suspected hosts or domain-wide via GPO/Intune/remote shell
# Checks: recent scheduled tasks (7d), shadow copy state, suspicious services,
# exposed RDP config, and unusual archiving/sync binaries.
$Report = @{}; $Cutoff = (Get-Date).AddDays(-7)

Write-Host "=== AKIRA Rapid Triage: $env:COMPUTERNAME ===" -ForegroundColor Cyan

# 1. Scheduled tasks created/modified in last 7 days (common persistence + encryptor launch)
Write-Host "`n[1] Scheduled tasks modified since $Cutoff" -ForegroundColor Yellow
$RecentTasks = Get-ScheduledTask | Where-Object {
    ($_ | Get-ScheduledTaskInfo -ErrorAction SilentlyContinue) -and $_.Date -gt $Cutoff
} | Select-Object TaskName, TaskPath, Date
$RecentTasks | Format-Table -AutoSize
$Report['RecentTasks'] = $RecentTasks

# 2. Volume Shadow Copy status — AKIRA deletes these pre-encryption
Write-Host "`n[2] Volume Shadow Copies present" -ForegroundColor Yellow
$Shadows = Get-CimInstance Win32_ShadowCopy -ErrorAction SilentlyContinue
if (-not $Shadows) {
    Write-Host "  !! NO shadow copies found — investigate for vssadmin deletion (T1490)" -ForegroundColor Red
} else { $Shadows | Select-Object DeviceObject, InstallDate | Format-Table -AutoSize }
$Report['ShadowCopyCount'] = ($Shadows | Measure-Object).Count

# 3. Suspicious remote-access services (PsExec-style)
Write-Host "`n[3] Suspicious services" -ForegroundColor Yellow
Get-Service | Where-Object { $_.Name -match 'PSEXESVC|PAExec|csexec' } |
    Select-Object Name, Status, StartType | Format-Table -AutoSize

# 4. RDP exposure check
Write-Host "`n[4] RDP configuration" -ForegroundColor Yellow
$RdpEnabled = (Get-ItemProperty 'HKLM:\SYSTEM\CurrentControlSet\Control\Terminal Server').fDenyTSConnections -eq 0
$Nla = (Get-ItemProperty 'HKLM:\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp' -ErrorAction SilentlyContinue).UserAuthentication
Write-Host "  RDP Enabled: $RdpEnabled | NLA: $Nla"
if ($RdpEnabled -and $Nla -ne 1) { Write-Host "  !! RDP enabled WITHOUT NLA — brute-force risk" -ForegroundColor Red }
$Report['RdpExposed'] = ($RdpEnabled -and $Nla -ne 1)

# 5. Exfiltration tooling artifacts
Write-Host "`n[5] Common exfil/staging binaries on disk" -ForegroundColor Yellow
$Tools = 'rclone.exe','megasync.exe','filezilla.exe','winscp.exe','rar.exe'
foreach ($t in $Tools) {
    Get-ChildItem -Path 'C:\Users','C:\ProgramData','C:\Windows\Temp' -Recurse -Filter $t -ErrorAction SilentlyContinue |
        Select-Object -First 5 FullName, LastWriteTime | Format-Table -AutoSize
}

# 6. Recent failed logons (brute force signal)
Write-Host "`n[6] Failed logon (4625) count, last 24h" -ForegroundColor Yellow
$Failed = Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4625; StartTime=(Get-Date).AddDays(-1)} -ErrorAction SilentlyContinue
Write-Host "  Count: $(($Failed | Measure-Object).Count)"
$Report['FailedLogons24h'] = ($Failed | Measure-Object).Count

$Report | ConvertTo-Json | Out-File "$env:TEMP\akira_triage_$env:COMPUTERNAME.json"
Write-Host "`nReport saved to $env:TEMP\akira_triage_$env:COMPUTERNAME.json" -ForegroundColor Cyan

Incident Response Priorities

T-minus detection checklist (before encryption fires)

AKIRA intrusions telegraph themselves in the 24–72 hours before detonation. Hunt for, in rough sequence:

1. Anomalous VPN authentication — logins from unusual geographies/ASNs, logins to dormant accounts, authentication outside business hours, especially against appliances missing MFA.
2. Discovery bursts — nltest, net group "domain admins", arp -a, ipconfig /all executed in rapid succession from a single account or host.
3. Credential access — LSASS memory access by non-system processes, NTDS.dit access, comsvcs.dll MiniDump usage.
4. Staging directories — new folders in C:\ProgramData, user profiles, or public folders accumulating archives (.rar, .7z) or staged file trees.
5. Exfiltration tooling — rclone.exe, MEGAsync, FileZilla, WinSCP on hosts that have no business running them; large outbound transfers to unfamiliar cloud endpoints.
6. Security tool tampering — EDR service stops, AV exclusions added, bcdedit /set recoveryenabled no, VSS deletion events.
7. Mass remote execution — simultaneous PsExec service installs or WMI process creation against many hosts from a single source — this is often the encryptor deployment wave itself.

Assets AKIRA historically prioritizes for exfiltration

• File servers containing HR, finance, and legal data
• Executive and legal-team mailboxes or mail archives
• Engineering data: CAD files, schematics, product documentation (highly relevant to the manufacturing claims above)
• Client matter files for professional services firms (relevant to the litigation-support claim)
• Backup catalogs and credentials (to destroy recovery options)
• Database exports, particularly customer/patient/client PII

Containment actions, ordered by urgency

1. Isolate affected network segments at the switch/VLAN level — do not power off hosts (preserve memory and volatile evidence).
2. Disable all VPN access and force credential resets for every account that has authenticated remotely in the last 30 days; invalidate active sessions.
3. Disable suspect accounts identified in authentication anomalies; revoke service account credentials used in lateral movement.
4. Block outbound traffic to known exfiltration endpoints (rclone default remotes, mega.nz, unfamiliar cloud storage) at the egress proxy/firewall.
5. Protect backups immediately — take backup infrastructure off the network, verify offline/immutable copies, rotate backup-service credentials.
6. Snapshot virtual infrastructure (vCenter-level) before any remediation on hosts.
7. Engage IR retainers and legal counsel early — regulatory clocks and notification obligations depend on what was actually accessed, which requires forensic scoping, not the gang's word.

Hardening Recommendations

Immediate (24 hours)

• Patch or mitigate KEV edge vulnerabilities — CVE-2026-50751 (Check Point), CVE-2026-20316 (Cisco FMC). If patching is not possible within 24 hours, restrict management-plane access to trusted networks and monitor authentication logs aggressively.
• Enforce MFA on every remote access path — VPN, RDP gateways, OWA, VDI. AKIRA's access model collapses without phishable or reused VPN credentials.
• Audit VPN and firewall logs for the past 30 days against the anomalous-authentication checklist above.
• Disable RDP on internet-facing systems entirely; require NLA and gateway-mediated access internally.
• Verify VSS and backup integrity — confirm shadow copies exist, backups are immutable or offline, and backup admin credentials are unique.
• Deploy the Sigma and KQL content above and alert (not just log) on VSS deletion and remote service installation.

Short-term (two weeks)

• Segment manufacturing/OT-adjacent networks from corporate IT with enforced east-west inspection; the manufacturing claims in this batch reflect AKIRA's comfort in flat mid-market networks.
• Deploy EDR to servers and hypervisors, not just workstations — AKIRA's ESXi variant means unmonitored virtualization hosts are a mass-casualty vector. Patch vCenter (CVE-2026-59310) and restrict vCenter management access to a dedicated admin VLAN.
• Restrict local admin rights and implement LAPS to blunt credential-reuse lateral movement.
• Block or alert on unauthorized archiving/sync tooling (rclone, MEGAsync, 7-Zip with password flags) via application control policies.
• Harden CI/CD infrastructure — patch TeamCity (CVE-2026-63077), audit developer tooling for supply-chain exposure (CVE-2026-48027), and rotate secrets stored in build systems.
• Tabletop the extortion scenario — decision-makers should rehearse the leak-site pressure playbook before a countdown timer is attached to their organization name.

Related Resources

Security Arsenal Incident Response Managed SOC & MDR Services AlertMonitor Threat Detection From The Dark Side Intel Hub