AKIRA Ransomware Gang: 6 New Listings Claimed — US Sector Targeting Analysis & Detection Rules

---
title: AKIRA Ransomware - VPN Authentication Anomaly
id: a1b2c3d4-1111-4222-8333-444455556666
status: experimental
description: Detects potential AKIRA initial access via VPN brute force or credential stuffing followed by successful authentication
author: Security Arsenal Threat Intelligence
references:
  - https://www.cisa.gov/news-events/cybersecurity-advisories
  - https://attack.mitre.org/groups/G1024/
date: 2026/10/31
modified: 2026/10/31
logsource:
  category: authentication
  product: vpn
  service: ssl-vpn
detection:
  selection_failed:
    EventID:
      - '4625'
      - '4771'
      - '4776'
    LogonType:
      - '3'
      - '10'
    IpAddress|contains:
      - '10.'
      - '192.168.'
      - '172.16.'
      - '172.17.'
      - '172.18.'
      - '172.19.'
      - '172.20.'
      - '172.21.'
      - '172.22.'
      - '172.23.'
      - '172.24.'
      - '172.25.'
      - '172.26.'
      - '172.27.'
      - '172.28.'
      - '172.29.'
      - '172.30.'
      - '172.31.'
  selection_success:
    EventID: '4624'
    LogonType: '10'
  condition: selection_failed | count() by SourceIp > 10 and selection_success
  timeframe: 15m
falsepositives:
  - Legitimate user password mistakes
  - Service accounts with misconfigured credentials
level: high
tags:
  - attack.initial_access
  - attack.t1078
  - attack.t1133
  - attack.brute_force
  - attack.t1110

---
title: AKIRA Ransomware - PsExec and WMI Lateral Movement
id: a1b2c3d4-2222-4333-8444-555566667777
status: experimental
description: Detects PsExec service installation and WMI process creation consistent with AKIRA lateral movement techniques
author: Security Arsenal Threat Intelligence
references:
  - https://attack.mitre.org/groups/G1024/
  - https://www.cisa.gov/news-events/cybersecurity-advisories
date: 2026/10/31
modified: 2026/10/31
logsource:
  category: process_creation
  product: windows
detection:
  selection_psexec:
    Image|endswith:
      - '\PSEXESVC.exe'
      - '\psexec.exe'
    CommandLine|contains:
      - '-accepteula'
      - '-s'
      - '-d'
  selection_wmi:
    Image|endswith: '\wmic.exe'
    CommandLine|contains:
      - 'process call create'
      - '/node:'
      - 'process start'
  selection_service_install:
    EventID: '7045'
    ServiceName|contains:
      - 'PSEXESVC'
      - 'PAExec'
      - 'csexec'
  condition: 1 of selection_*
falsepositives:
  - Legitimate administrative tools
  - IT management software
  - SCCM or similar deployment tools
level: high
tags:
  - attack.lateral_movement
  - attack.t1021.002
  - attack.t1047
  - attack.execution
  - attack.t1569.002

---
title: AKIRA Ransomware - Data Staging and Exfiltration Preparation
id: a1b2c3d4-3333-4444-8555-666677778888
status: experimental
description: Detects archive creation, cloud storage tool execution, and mass file access patterns consistent with AKIRA pre-encryption data staging
author: Security Arsenal Threat Intelligence
references:
  - https://attack.mitre.org/groups/G1024/
  - https://www.cisa.gov/news-events/cybersecurity-advisories
date: 2026/10/31
modified: 2026/10/31
logsource:
  category: process_creation
  product: windows
detection:
  selection_archive_tools:
    Image|endswith:
      - '\7z.exe'
      - '\7za.exe'
      - '\rar.exe'
      - '\winrar.exe'
      - '\tar.exe'
      - '\gzip.exe'
    CommandLine|contains:
      - 'a'
      - 'u'
      - '-p'
  selection_cloud_tools:
    Image|endswith:
      - '\rclone.exe'
      - '\megacmd.exe'
      - '\aws.exe'
      - '\azcopy.exe'
      - '\gsutil.exe'
      - '\dropbox.exe'
      - '\onedrive.exe'
  selection_mass_access:
    Image|endswith: '\powershell.exe'
    CommandLine|contains:
      - 'Get-ChildItem'
      - 'Recurse'
      - 'Select-String'
      - 'Copy-Item'
  condition: selection_archive_tools or selection_cloud_tools or (selection_mass_access and not selection_mass_access_exclusions)
  selection_mass_access_exclusions:
    CommandLine|contains:
      - 'WindowsUpdate'
      - 'Microsoft'
      - 'Program Files'
      - 'ProgramData'
falsepositives:
  - Legitimate backup operations
  - Software deployment
  - User file compression
  - Cloud synchronization tools
level: medium
tags:
  - attack.collection
  - attack.t1560
  - attack.t1560.001
  - attack.exfiltration
  - attack.t1567
  - attack.t1567.002

// AKIRA Ransomware - Lateral Movement and Pre-Staging Hunt
// Target: PsExec execution, WMI process creation, suspicious archive creation, and VSS deletion
// Time range: Last 14 days (adjust as needed)
let Lookback = 14d;
let SuspiciousProcesses = dynamic(["psexec.exe", "psexesvc.exe", "wmic.exe", "7z.exe", "rar.exe", "winrar.exe", "rclone.exe", "vssadmin.exe", "wbadmin.exe", "bcdedit.exe", "powershell.exe"]);
let HighRiskExtensions = dynamic([".bak", ".sql", ".mdb", ".accdb", ".pst", ".ost", ".zip", ".7z", ".rar", ".tar", ".gz"]);
// PsExec and WMI lateral movement indicators
let LateralMovement = union
    (SecurityEvent
    | where TimeGenerated > ago(Lookback)
    | where EventID == 4688
    | where Process has_any (SuspiciousProcesses)
    | extend ProcessName = tolower(Process)
    | extend CommandLine = tolower(CommandLine)
    | where CommandLine has_any ("-accepteula", "-s", "-d", "process call create", "/node:", "shadowcopy delete", "delete shadows", "resize shadowstorage", "bootstatuspolicy ignoreallfailures", "recoveryenabled no")
    | project TimeGenerated, Computer, Account, ProcessName, CommandLine, ParentProcessName, NewProcessName, EventID),
    (DeviceProcessEvents
    | where TimeGenerated > ago(Lookback)
    | where FileName has_any (SuspiciousProcesses)
    | where ProcessCommandLine has_any ("-accepteula", "-s", "-d", "process call create", "/node:", "shadowcopy delete", "delete shadows", "resize shadowstorage")
    | project TimeGenerated, DeviceName, AccountName, FileName, ProcessCommandLine, InitiatingProcessFileName, InitiatingProcessCommandLine, SHA256));
// Data staging indicators: mass file access, archive creation, suspicious network connections to cloud storage
let DataStaging = union
    (SecurityEvent
    | where TimeGenerated > ago(Lookback)
    | where EventID == 4663
    | where ObjectName has_any (HighRiskExtensions)
    | summarize FileAccessCount = count(), DistinctFiles = dcount(ObjectName), FirstAccess = min(TimeGenerated), LastAccess = max(TimeGenerated) by Account, Computer, ProcessName
    | where FileAccessCount > 100 or DistinctFiles > 50
    | extend SuspicionScore = case(
        FileAccessCount > 1000 and DistinctFiles > 500, "Critical - Mass file access",
        FileAccessCount > 500 and DistinctFiles > 200, "High - Significant file access",
        FileAccessCount > 100 and DistinctFiles > 50, "Medium - Elevated file access",
        "Low"
    )
    | project FirstAccess, LastAccess, Account, Computer, ProcessName, FileAccessCount, DistinctFiles, SuspicionScore),
    (DeviceFileEvents
    | where TimeGenerated > ago(Lookback)
    | where FileName has_any (HighRiskExtensions)
    | where ActionType == "FileCreated"
    | summarize ArchiveCount = count(), FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated) by DeviceName, InitiatingProcessFileName, InitiatingProcessAccountName
    | where ArchiveCount > 5
    | project FirstSeen, LastSeen, DeviceName, InitiatingProcessFileName, InitiatingProcessAccountName, ArchiveCount));
// Shadow copy deletion and backup tampering
let TamperingIndicators = union
    (SecurityEvent
    | where TimeGenerated > ago(Lookback)
    | where EventID == 4688
    | where (Process has "vssadmin.exe" and CommandLine has "delete shadows")
        or (Process has "wbadmin.exe" and CommandLine has "delete catalog")
        or (Process has "bcdedit.exe" and CommandLine has_any ("bootstatuspolicy", "recoveryenabled"))
    | project TimeGenerated, Computer, Account, Process, CommandLine, ParentProcessName, EventID
    | extend IndicatorType = "VSS/Backup Tampering"),
    (DeviceProcessEvents
    | where TimeGenerated > ago(Lookback)
    | where (FileName == "vssadmin.exe" and ProcessCommandLine has "delete shadows")
        or (FileName == "wbadmin.exe" and ProcessCommandLine has "delete catalog")
        or (FileName == "bcdedit.exe" and ProcessCommandLine has_any ("bootstatuspolicy", "recoveryenabled"))
    | project TimeGenerated, DeviceName, AccountName, FileName, ProcessCommandLine, InitiatingProcessFileName, SHA256
    | extend IndicatorType = "VSS/Backup Tampering"));
// Combine and correlate
let AllIndicators = union LateralMovement, DataStaging, TamperingIndicators;
AllIndicators
| extend DetectionTimestamp = now()
| extend ThreatGroup = "AKIRA"
| extend MITRETechniques = case(
    IndicatorType == "VSS/Backup Tampering", "T1490 - Inhibit System Recovery",
    ProcessName has "psexec" or ProcessName has "wmic", "T1021.002 - SMB/Windows Admin Shares, T1047 - WMI",
    ProcessName has "vssadmin" or ProcessName has "wbadmin", "T1490 - Inhibit System Recovery",
    ArchiveCount > 0 or FileAccessCount > 0, "T1560 - Archive Collected Data, T1567 - Exfiltration Over Web Service",
    "T1059 - Command and Scripting Interpreter"
)
| sort by TimeGenerated desc
| take 1000

<#
.SYNOPSIS
    AKIRA Ransomware - Rapid Response Detection Script
.DESCRIPTION
    Checks for exposed RDP, enumerates recently added scheduled tasks (last 7 days),
    finds recently modified Volume Shadow Copies, and identifies suspicious process execution
    consistent with AKIRA pre-encryption staging.
.PARAMETER OutputPath
    Path for output report. Default: .\AKIRA_RapidResponse_Report.txt
.PARAMETER DaysBack
    Number of days to look back for artifacts. Default: 7
.EXAMPLE
    .\AKIRA-RapidResponse.ps1 -OutputPath "C:\IR\AKIRA_Report.txt" -DaysBack 14
.NOTES
    Author: Security Arsenal Threat Intelligence
    Date: 2026-10-31
    Requires: Run as Administrator for full visibility
#>

[CmdletBinding()]
param(
    [Parameter(Mandatory=$false)]
    [string]$OutputPath = ".\AKIRA_RapidResponse_Report.txt",
    
    [Parameter(Mandatory=$false)]
    [int]$DaysBack = 7
)

$StartTime = Get-Date
$ReportDate = Get-Date -Format "yyyy-MM-dd HH:mm:ss"
$LookbackDate = (Get-Date).AddDays(-$DaysBack)

# Initialize report
$Report = @()
$Report += "=" * 80
$Report += "AKIRA RANSOMWARE - RAPID RESPONSE DETECTION REPORT"
$Report += "Generated: $ReportDate"
$Report += "Hostname: $env:COMPUTERNAME"
$Report += "Lookback Period: $DaysBack days"
$Report += "=" * 80
$Report += ""

# Function to add section headers
function Add-Section {
    param([string]$Title)
    $script:Report += ""
    $script:Report += "-" * 60
    $script:Report += $Title
    $script:Report += "-" * 60
}

# 1. CHECK FOR EXPOSED RDP
Add-Section "RDP EXPOSURE ASSESSMENT"

$RDPStatus = @()
$RDPPort = (Get-ItemProperty -Path 'HKLM:\System\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp' -Name PortNumber -ErrorAction SilentlyContinue).PortNumber
$RDPEnabled = (Get-ItemProperty -Path 'HKLM:\System\CurrentControlSet\Control\Terminal Server' -Name fDenyTSConnections -ErrorAction SilentlyContinue).fDenyTSConnections

$RDPStatus += "RDP Port: $RDPPort"
if ($RDPEnabled -eq 0) {
    $RDPStatus += "RDP Status: ENABLED (fDenyTSConnections = 0)"
    $RDPStatus += "[ALERT] RDP is enabled - verify MFA and network restrictions"
    
    # Check for NLA requirement
    $NLA = (Get-ItemProperty -Path 'HKLM:\System\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp' -Name UserAuthentication -ErrorAction SilentlyContinue).UserAuthentication
    if ($NLA -eq 0) {
        $RDPStatus += "[CRITICAL] Network Level Authentication (NLA) is DISABLED"
    } else {
        $RDPStatus += "NLA Status: Enabled"
    }
    
    # Check firewall rules for RDP
    $RDPRules = Get-NetFirewallRule -DisplayGroup "Remote Desktop" -ErrorAction SilentlyContinue | Where-Object { $_.Enabled -eq 'True' }
    if ($RDPRules) {
        $RDPStatus += "Active RDP Firewall Rules: $($RDPRules.Count)"
        foreach ($rule in $RDPRules) {
            $RDPStatus += "  - $($rule.DisplayName): $($rule.Direction), $($rule.Action)"
        }
    }
} else {
    $RDPStatus += "RDP Status: DISABLED (fDenyTSConnections = 1)"
    $RDPStatus += "[INFO] RDP is disabled - good defensive posture"
}

$RDPStatus | ForEach-Object { $Report += $_ }

# 2. ENUMERATE SCHEDULED TASKS (LAST 7 DAYS)
Add-Section "SCHEDULED TASKS - CREATED/MODIFIED IN LAST $DaysBack DAYS"

$SuspiciousTasks = @()
$AllTasks = Get-ScheduledTask -ErrorAction SilentlyContinue

foreach ($task in $AllTasks) {
    $taskInfo = Get-ScheduledTaskInfo -TaskName $task.TaskName -TaskPath $task.TaskPath -ErrorAction SilentlyContinue
    if ($taskInfo) {
        $created = $taskInfo.Date
        if ($created -gt $LookbackDate) {
            $taskDetails = $task | Select-Object TaskName, TaskPath, State, @{N='Author';E={$_.Author}}, @{N='Description';E={$_.Description}}
            $taskActions = $task.Actions | Select-Object Execute, Arguments
            
            $SuspiciousTasks += "Task Name: $($task.TaskPath)$($task.TaskName)"
            $SuspiciousTasks += "  Created: $created"
            $SuspiciousTasks += "  State: $($task.State)"
            $SuspiciousTasks += "  Author: $($taskDetails.Author)"
            if ($taskActions.Execute) {
                $SuspiciousTasks += "  Action: $($taskActions.Execute) $($taskActions.Arguments)"
            }
            
            # Flag suspicious characteristics
            $suspicious = $false
            if ($task.TaskName -match '^[a-zA-Z0-9]{8,}$') { $suspicious = $true; $SuspiciousTasks += "  [ALERT] Randomized task name pattern" }
            if ($taskActions.Execute -match 'powershell|cmd|wscript|cscript|mshta|rundll32|regsvr32') { $suspicious = $true; $SuspiciousTasks += "  [ALERT] Script interpreter execution" }
            if ($taskDetails.Author -notmatch 'Microsoft|SYSTEM|Administrator') { $SuspiciousTasks += "  [WARN] Non-standard author" }
            
            $SuspiciousTasks += ""
        }
    }
}

if ($SuspiciousTasks.Count -eq 0) {
    $Report += "No scheduled tasks created in the last $DaysBack days"
} else {
    $SuspiciousTasks | ForEach-Object { $Report += $_ }
}

# 3. VOLUME SHADOW COPY ANALYSIS
Add-Section "VOLUME SHADOW COPY (VSS) STATUS"

$VSSInfo = @()
$ShadowCopies = Get-WmiObject -Class Win32_ShadowCopy -ErrorAction SilentlyContinue

if ($ShadowCopies) {
    $VSSInfo += "Total Shadow Copies: $($ShadowCopies.Count)"
    $VSSInfo += ""
    
    foreach ($shadow in $ShadowCopies) {
        $installDate = $shadow.InstallDate
        $shadowDate = [Management.ManagementDateTimeConverter]::ToDateTime($installDate)
        $VSSInfo += "Shadow ID: $($shadow.ID)"
        $VSSInfo += "  Created: $shadowDate"
        $VSSInfo += "  Volume: $($shadow.VolumeName)"
        $VSSInfo += "  Device: $($shadow.DeviceObject)"
        
        if ($shadowDate -gt $LookbackDate) {
            $VSSInfo += "  [INFO] Recent shadow copy (within lookback period)"
        }
        $VSSInfo += ""
    }
    
    # Check for VSS deletion events in System event log
    $VSSEvents = Get-WinEvent -FilterHashtable @{LogName='System'; ID=8222, 8224, 8225, 8226; StartTime=$LookbackDate} -ErrorAction SilentlyContinue
    if ($VSSEvents) {
        $VSSInfo += "VSS-Related Events (Last $DaysBack days): $($VSSEvents.Count)"
        $deletionEvents = $VSSEvents | Where-Object { $_.Id -eq 8222 }
        if ($deletionEvents) {
            $VSSInfo += "[ALERT] Shadow copy deletion events detected: $($deletionEvents.Count)"
        }
    }
} else {
    $VSSInfo += "[ALERT] No Volume Shadow Copies found"
    $VSSInfo += "This may indicate VSS deletion or VSS service issues"
    $VSSInfo += "AKIRA commonly deletes shadow copies before encryption"
}

$VSSInfo | ForEach-Object { $Report += $_ }

# 4. SUSPICIOUS PROCESS EXECUTION (LAST 7 DAYS)
Add-Section "SUSPICIOUS PROCESS EXECUTION - AKIRA TTPs"

$SuspiciousProcesses = @(
    "psexec.exe", "psexesvc.exe", "wmic.exe", "7z.exe", "7za.exe", "rar.exe",
    "winrar.exe", "tar.exe", "rclone.exe", "megacmd.exe", "azcopy.exe",
    "vssadmin.exe", "wbadmin.exe", "bcdedit.exe", "net.exe", "net1.exe",
    "whoami.exe", "ipconfig.exe", "systeminfo.exe", "nltest.exe", "dsquery.exe"
)

$ProcessEvents = Get-WinEvent -FilterHashtable @{LogName='Security'; ID=4688; StartTime=$LookbackDate} -ErrorAction SilentlyContinue | 
    Where-Object { $_.Message -match ($SuspiciousProcesses -join '|') }

if ($ProcessEvents) {
    $Report += "Suspicious process executions detected: $($ProcessEvents.Count)"
    $Report += ""
    
    foreach ($event in $ProcessEvents | Select-Object -First 20) {
        $xml = [xml]$event.ToXml()
        $processName = ($xml.Event.EventData.Data | Where-Object {$_.Name -eq 'NewProcessName'}).'#text'
        $commandLine = ($xml.Event.EventData.Data | Where-Object {$_.Name -eq 'CommandLine'}).'#text'
        $parentProcess = ($xml.Event.EventData.Data | Where-Object {$_.Name -eq 'ParentProcessName'}).'#text'
        
        $Report += "Time: $($event.TimeCreated)"
        $Report += "  Process: $processName"
        if ($commandLine) { $Report += "  Command: $commandLine" }
        if ($parentProcess) { $Report += "  Parent: $parentProcess" }
        $Report += ""
    }
} else {
    $Report += "No suspicious process executions detected in Security event log"
}

# 5. NETWORK CONNECTIONS TO SUSPICIOUS DESTINATIONS
Add-Section "NETWORK CONNECTIONS - CLOUD STORAGE AND C2 CHECK"

$SuspiciousIPs = @()
$CloudProviders = @("pastebin", "mega", "dropbox", "mediafire", "wetransfer", "sendspace", "rapidgator", "anonfiles", "gofile")

$NetworkConnections = Get-NetTCPConnection -State Established -ErrorAction SilentlyContinue | 
    Where-Object { $_.RemotePort -eq 443 -or $_.RemotePort -eq 80 } |
    Select-Object -First 50

if ($NetworkConnections) {
    $Report += "Active HTTPS/HTTP connections: $($NetworkConnections.Count)"
    $Report += "Review connections to cloud storage or file-sharing services"
    $Report += ""
    
    # Attempt to resolve remote hostnames (limited for speed)
    $resolved = 0
    foreach ($conn in $NetworkConnections | Select-Object -First 10) {
        try {
            $hostname = [System.Net.Dns]::GetHostEntry($conn.RemoteAddress).HostName
            if ($CloudProviders | Where-Object { $hostname -match $_ }) {
                $Report += "[ALERT] Connection to potential exfiltration service: $hostname ($($conn.RemoteAddress):$($conn.RemotePort))"
            }
            $resolved++
        } catch {
            # Resolution failed, continue
        }
    }
    if ($resolved -eq 0) {
        $Report += "No hostname resolution performed (network restrictions or DNS issues)"
    }
} else {
    $Report += "No established outbound connections detected"
}

# 6. SUMMARY AND RECOMMENDATIONS
Add-Section "EXECUTIVE SUMMARY AND IMMEDIATE ACTIONS"

$Summary = @()
$Summary += "Report Generation Time: $((Get-Date) - $StartTime)"
$Summary += ""
$Summary += "IMMEDIATE ACTIONS IF AKIRA ACTIVITY SUSPECTED:"
$Summary += ""
$Summary += "1. ISOLATE affected systems from network (disable NIC, not power)"
$Summary += "2. PRESERVE memory and disk images before shutdown if possible"
$Summary += "3. DISABLE compromised accounts and reset credentials"
$Summary += "4. BLOCK C2 domains/IPs at network perimeter"
$Summary += "5. ACTIVATE incident response retainer and notify cyber insurance"
$Summary += "6. DOCUMENT all observed artifacts for law enforcement"
$Summary += ""
$Summary += "DETECTION GAPS TO ADDRESS:"
$Summary += ""
$Summary += "- Enable PowerShell Script Block Logging (Event ID 4104)"
$Summary += "- Enable WMI Activity logging (Event ID 5857-5861)"
$Summary += "- Deploy Sysmon with SwiftOnSecurity or Olaf Hartong config"
$Summary += "- Enable file integrity monitoring on critical shares"
$Summary += "- Implement network segmentation to limit lateral movement"
$Summary += ""
$Summary += "AKIRA-SPECIFIC IOCs TO MONITOR:"
$Summary += ""
$Summary += "- Process names: psexec.exe, 7z.exe, rar.exe, vssadmin.exe"
$Summary += "- Command lines: 'delete shadows', 'resize shadowstorage', '-accepteula'"
$Summary += "- File extensions: .akira, .akira_readme.txt (ransom note)"
$Summary += "- Registry: HKLM\SOFTWARE\AKIRA (persistence marker)"

$Summary | ForEach-Object { $Report += $_ }

# Output report
$Report | Out-File -FilePath $OutputPath -Encoding UTF8
Write-Host "Report generated: $OutputPath" -ForegroundColor Green
Write-Host "Review findings and escalate to incident response if suspicious activity detected" -ForegroundColor Yellow

# Optional: Also display critical findings to console
$CriticalFindings = $Report | Select-String -Pattern '\[ALERT\]|\[CRITICAL\]' 
if ($CriticalFindings) {
    Write-Host "`nCRITICAL FINDINGS DETECTED:" -ForegroundColor Red
    $CriticalFindings | ForEach-Object { Write-Host $_.Line -ForegroundColor Red }
}