AKIRA Ransomware Gang: 9 New Victims in 4 Days — Manufacturing Surge, VPN Exploitation & Detection Engineering

Classification: TLP:CLEAR | Briefing Date: 2026-08-29 | Source: Live .onion leak site telemetry via ransomware.live + CISA KEV

Executive Summary

AKIRA's dark web leak site lit up again this week: 9 new victim postings between 2026-08-26 and 2026-08-28 — a sustained drip of roughly 2-3 posts per day. The victim list skews hard toward US-based manufacturing and industrial services (Alumax, JRT Mechanical, Cetylite, Gill Rock Drill, BEPeterson), with secondary hits in hospitality (Seabrook Island) and healthcare (Oral and Maxillofacial Surgery). This is consistent with AKIRA's long-standing preference for mid-market organizations with weak edge security, legacy VPN concentrators, and flat networks.

If you run manufacturing, healthcare, or hospitality infrastructure in the US — especially anything with an internet-facing VPN or remote access tooling — treat this as an active threat window.

1. Threat Actor Profile — AKIRA

Key behavioral note: AKIRA affiliates are opportunistic but disciplined. They love VPN concentrators with legacy auth, will burn zero-days on edge devices, and routinely abuse legitimate RMM tooling (ScreenConnect, AnyDesk) to blend into admin traffic. They also aggressively target Veeam backup servers for credential theft and backup destruction.

2. Current Campaign Analysis

Victim Breakdown (leak site postings, last 100-post sample)

Sector Concentration

• Manufacturing: ~44% of confirmed postings (4 of 9) — sheet metal, mechanical contracting, drill tooling. Classic AKIRA profile: operational technology adjacent, downtime-intolerant, often running legacy Windows domains.
• Healthcare (1) and Hospitality (1) — both hold high-value PII and have documented pressure tolerance (patient care continuity, guest operations).
• "Not Found" / "Other" entries are typical of small private firms AKIRA lists before full doxxing — expect details to publish if ransom talks stall.

Geographic Concentration

All confirmed-country victims are United States. AKIRA remains overwhelmingly US-centric (>60% historical victimology), consistent with both affiliate targeting preferences and the economics of US ransom payments.

Victim Profile

Based on the named organizations: small-to-mid-market (50–500 employees), estimated $10M–$250M annual revenue. This is the RaaS sweet spot — large enough to pay six-to-seven figures, small enough to lack 24/7 SOC coverage, EDR parity, and segmented backups.

Posting Frequency / Escalation

9 posts / 4 days ≈ 2.25 victims per day. The clustering (three posts on 08-28, three on 08-27) suggests a batch publication pattern — affiliates typically hold victims through a negotiation window then publish in waves when deadlines expire. Watch for a second wave of full data dumps 5-10 days out.

CVE Correlation — Probable Initial Access

Three KEV entries align tightly with AKIRA's known playbook:

1. CVE-2026-50751 (Check Point Security Gateway, IKEv1 improper auth) — Edge VPN auth bypass is AKIRA's bread and butter (Cisco ASA, SonicWall, now Check Point). Organizations running Check Point gateways with IKEv1 VPNs are priority-one patch targets.
2. CVE-2024-1708 (ConnectWise ScreenConnect path traversal) — Confirmed ransomware-use CVE. AKIRA affiliates weaponize ScreenConnect both as initial access and as persistence/RMM masquerading.
3. CVE-2026-48027 (Nx Console embedded malicious code) — Supply-chain vector; developer workstations are a path into build systems and domain credentials.
4. CVE-2025-60710 (Windows link following privesc) and CVE-2023-21529 (Exchange deserialization) map to the privilege escalation / internal expansion phase rather than initial access — both fit the observed hands-on-keyboard tradecraft.

3. Detection Engineering

The following detections target AKIRA's documented TTPs across initial access, lateral movement, and pre-encryption staging. Deploy to your SIEM; tune thresholds to environment baseline.

---
title: AKIRA - Volume Shadow Copy Deletion via VSSAdmin or WMIC
id: 8f2a1c44-akira-vss-001
status: production
description: Detects shadow copy deletion commands characteristic of AKIRA pre-encryption staging. AKIRA routinely executes vssadmin delete shadows and wmic shadowcopy delete prior to detonation.
author: Security Arsenal Threat Intelligence
references:
  - https://www.cisa.gov/news-events/cybersecurity-advisories/aa24-109a
date: 2026/08/29
tags:
  - attack.impact
  - attack.t1490
logsource:
  category: process_creation
  product: windows
level: high
detection:
  selection_tool:
    Image|endswith:
      - '\vssadmin.exe'
      - '\wmic.exe'
      - '\bcdedit.exe'
      - '\diskshadow.exe'
  selection_args:
    CommandLine|contains:
      - 'delete shadows'
      - 'shadowcopy delete'
      - 'delete catalog'
      - 'recoveryenabled no'
      - 'bootstatuspolicy ignoreallfailures'
      - 'delete shadows /all /quiet'
  condition: selection_tool and selection_args
falsepositives:
  - Backup software maintenance (Veeam, Commvault) - whitelist known backup service accounts
---
title: AKIRA - PsExec or WMI Remote Service Execution for Lateral Movement
id: 8f2a1c44-akira-lat-002
status: production
description: Detects PsExec-style remote service creation and WMI process spawning consistent with AKIRA hands-on-keyboard lateral movement and mass ransomware push via domain controllers.
author: Security Arsenal Threat Intelligence
date: 2026/08/29
tags:
  - attack.lateral-movement
  - attack.t1021.002
  - attack.t1569.002
  - attack.t1047
logsource:
  product: windows
  service: system
level: high
detection:
  selection_psexec:
    EventID: 7045
    ServiceName|contains:
      - 'PSEXESVC'
      - 'PAExec'
      - 'csexecsvc'
  selection_susp_service:
    EventID: 7045
    ImagePath|contains:
      - '\ADMIN$'
      - '\\127.0.0.1\'
      - 'rundll32.exe \\'
  condition: 1 of selection_*
falsepositives:
  - Legitimate software deployment (SCCM, PDQ) - correlate with known deployment windows
---
title: AKIRA - RClone or WinSCP Data Exfiltration Staging
id: 8f2a1c44-akira-exfil-003
status: production
description: Detects execution of RClone, WinSCP, or 7-Zip archiving to temp/staging paths - AKIRA's standard pre-leak data theft toolchain.
author: Security Arsenal Threat Intelligence
date: 2026/08/29
tags:
  - attack.exfiltration
  - attack.t1567.002
  - attack.t1560.001
logsource:
  category: process_creation
  product: windows
level: medium
detection:
  selection_tool:
    Image|endswith:
      - '\rclone.exe'
      - '\winscp.exe'
      - '\filezilla.exe'
  selection_args:
    CommandLine|contains:
      - 'mega.nz'
      - 'mega.io'
      - 'sync '
      - ' copy '
      - ' move '
      - '--config'
      - '/script='
  selection_archive:
    Image|endswith: '\7z.exe'
    CommandLine|contains:
      - ' a '
      - '-mx'
  condition: (selection_tool and selection_args) or selection_archive
falsepositives:
  - Legitimate cloud sync by IT - maintain allowlist of approved sync tools and destinations

Sentinel Hunt Query — Pre-Ransomware Staging Chain

This KQL hunts the AKIRA kill chain as a correlated sequence: suspicious logon → new service/RMM install → archive/staging activity, within a 6-hour window on the same host.

// AKIRA pre-ransomware staging hunt: logon + service install + staging within 6h
let lookback = 14d;
let window = 6h;
let SuspiciousLogons =
    SecurityEvent
    | where TimeGenerated > ago(lookback)
    | where EventID == 4624 and LogonType in (3, 10)
    | where IpAddress !startswith "10." and IpAddress !startswith "192.168." and IpAddress !startswith "172."
    | summarize FirstLogon = min(TimeGenerated) by Computer, Account, IpAddress;
let NewServices =
    Event
    | where TimeGenerated > ago(lookback)
    | where EventLog == "System" and EventID == 7045
    | where ServiceFileName has_any ("PSEXESVC", "ADMIN$", "ScreenConnect", "AnyDesk", "rclone", "7z.exe")
    | extend ServiceInstallTime = TimeGenerated
    | project Computer, ServiceInstallTime, ServiceName, ServiceFileName;
let StagingActivity =
    DeviceProcessEvents
    | where TimeGenerated > ago(lookback)
    | where FileName has_any ("rclone.exe", "7z.exe", "winscp.exe", "vssadmin.exe", "wmic.exe")
       or ProcessCommandLine has_any ("delete shadows", "shadowcopy delete", "mega.nz", "--transfers")
    | project DeviceName, TimeGenerated, FileName, ProcessCommandLine, InitiatingProcessAccountName;
SuspiciousLogons
| join kind=inner (NewServices) on Computer
| where ServiceInstallTime between (FirstLogon .. FirstLogon + window)
| join kind=inner (StagingActivity | extend Computer = DeviceName) on Computer
| where TimeGenerated between (ServiceInstallTime .. ServiceInstallTime + window)
| project Computer, Account, IpAddress, FirstLogon, ServiceName, ServiceFileName, FileName, ProcessCommandLine, StagingTime = TimeGenerated
| order by FirstLogon asc;

Rapid Response — Edge & Staging Audit Script

Run on domain controllers and candidate staging hosts during triage. Checks for exposed RDP, recently created services/scheduled tasks, shadow copy tampering, and known AKIRA tooling artifacts.

# AKIRA Rapid Triage — run elevated on DCs and file servers
$days = 7
$since = (Get-Date).AddDays(-$days)
Write-Host "=== [1] RDP Exposure Check ===" -ForegroundColor Cyan
Get-ItemProperty 'HKLM:\SYSTEM\CurrentControlSet\Control\Terminal Server' |
  Select-Object @{N='fDenyTSConnections(0=RDP_ON)';E={$_.fDenyTSConnections}}, @{N='NLA(1=on)';E={ (Get-ItemProperty 'HKLM:\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp').UserAuthentication }}
Get-NetFirewallRule -DisplayGroup "Remote Desktop" | Where-Object Enabled -eq 'True' | Select-Object DisplayName, Profile, Direction

Write-Host "`n=== [2] Scheduled Tasks Created in Last $days Days ===" -ForegroundColor Cyan
Get-ScheduledTask | Where-Object { $_.Date -and ([datetime]$_.Date) -gt $since } |
  Select-Object TaskName, TaskPath, Date, @{N='Action';E={$_.Actions.Execute}} | Format-List

Write-Host "`n=== [3] Services Installed in Last $days Days (PsExec/RMM artifacts) ===" -ForegroundColor Cyan
Get-WinEvent -FilterHashtable @{LogName='System'; Id=7045; StartTime=$since} -ErrorAction SilentlyContinue |
  Select-Object TimeCreated, @{N='Service';E={$_.Properties[0].Value}}, @{N='ImagePath';E={$_.Properties[1].Value}} |
  Where-Object { $_.ImagePath -match 'PSEXESVC|ADMIN\$|AnyDesk|ScreenConnect|rclone|AppData|Temp' } | Format-List

Write-Host "`n=== [4] Volume Shadow Copy Status ===" -ForegroundColor Cyan
vssadmin list shadows
Get-WinEvent -FilterHashtable @{LogName='System'; Id=524, 12289} -ErrorAction SilentlyContinue |
  Select-Object -First 10 TimeCreated, Id, Message

Write-Host "`n=== [5] Suspicious Binaries in Writable Paths (7d) ===" -ForegroundColor Cyan
Get-ChildItem 'C:\Users','C:\ProgramData','C:\Windows\Temp' -Recurse -Include rclone.exe,winscp.exe,7z.exe,*.akira -ErrorAction SilentlyContinue |
  Where-Object { $_.LastWriteTime -gt $since } | Select-Object FullName, LastWriteTime

Write-Host "`n=== [6] Recent External RDP Logons (EventID 4624 Type 10) ===" -ForegroundColor Cyan
Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4624; StartTime=$since} -MaxEvents 2000 -ErrorAction SilentlyContinue |
  Where-Object { $_.Message -match 'Logon Type:\s+10' -and $_.Message -notmatch 'Source Network Address:\s+(10\.|192\.168\.|172\.(1[6-9]|2[0-9]|3[01])\.)' } |
  Select-Object TimeCreated, @{N='Account';E={($_.Message -split "\n") -match 'Account Name' | Select-Object -First 1}} | Format-Table -AutoSize

4. Incident Response Priorities — AKIRA Playbook

T-Minus Detection Checklist (Before Encryption Fires)

AKIRA's hands-on-keyboard phase generates a detectable signature trail, typically 24-72 hours pre-detonation:

• VPN anomalies: Check Point/Cisco/SonicWall auth logs — logins from unusual geographies/ASNs, especially IKEv1 sessions, or logins with valid creds outside business hours
• New RMM installs: AnyDesk, ScreenConnect, TeamViewer appearing on servers where IT never deployed them
• Cobalt Strike beacons: Periodic HTTPS callbacks to low-reputation domains; named pipes (\\.\pipe\msagent_*, postex_*) on endpoints
• Credential dumping: lsass.exe handle access by non-system processes; LaZagne/Mimikatz artifacts
• Backup recon: Interactive logons to Veeam servers, Veeam.Backup.Service restarts, unexpected Get-VBR* PowerShell
• Staging directories: Large .7z/.rar archives in C:\ProgramData, user profile roots, or \\SERVER\ADMIN$
• RClone configs: %APPDATA%\rclone\rclone.conf with mega remotes
• VSS deletion: The final precursor — if you see vssadmin delete shadows, you have minutes, not hours

Critical Assets AKIRA Prioritizes for Exfiltration

1. File servers & NAS — engineering drawings, CAD files, contracts (especially acute for the manufacturing victims above)
2. HR/payroll data — SSNs, W-2s, benefits records
3. Email archives — executive mailboxes, legal correspondence (leverage material)
4. Healthcare records — PHI from practice management systems (see: Oral and Maxillofacial Surgery posting)
5. Backup infrastructure — Veeam databases dumped for domain credentials; backup deletion before encryption

Containment Actions — Ordered by Urgency

1. (Minutes) Isolate affected hosts at the switch/EDR level — NOT a domain-wide shutdown that destroys forensic state on healthy machines
2. (Minutes) Disable compromised accounts; force enterprise-wide credential reset starting with Domain Admins and VPN users
3. (Minutes) Block egress to known exfil destinations (Mega, anonymous file hosts) at the proxy; RClone needs outbound 443
4. (Hour 1) Pull and preserve VPN concentrator logs before rotation — edge device logs are your initial access ground truth
5. (Hour 1) Verify backup integrity and take backup infrastructure OFF the network (offline/air-gap validation)
6. (Hour 2) Hunt laterally: PsExec service artifacts, WMI subscriptions, new local admins across the fleet
7. (Hour 2+) Engage IR retainer; do NOT negotiate directly — AKIRA negotiators have been known to re-victimize payers

5. Hardening Recommendations

Immediate (24 Hours) — Would Have Blocked Recent Campaigns

• Patch Check Point Security Gateway (CVE-2026-50751) — if IKEv1 VPNs are in use, this is your front door right now. Also verify ScreenConnect (CVE-2024-1708) patch status
• Enforce MFA on ALL remote access — VPN, RDP gateway, RMM consoles. AKIRA's primary entry is valid credentials with no MFA. No exceptions for service accounts
• Disable or ACL RDP from the internet — require VPN + MFA or move to a ZTNA broker; audit externally exposed 3389 today
• Block RClone/7-Zip/WinSCP execution via AppLocker/WDAC for non-admin users; alert on admin use
• Enable tamper protection on EDR and restrict vssadmin/bcdedit to a dedicated break-glass account
• Audit Veeam/backup consoles — separate credentials, no domain admin reuse, console access via jump host only

Short-Term (2 Weeks) — Architecture Level

• Segment manufacturing/OT-adjacent networks — the current victim cluster shows AKIRA walking flat corporate networks into production-adjacent systems. VLAN segmentation + deny-by-default east-west firewall rules
• Deploy decoy canary files on file servers and backup shares wired to high-severity SIEM alerts
• Implement egress filtering with TLS inspection on server subnets — servers should not have unrestricted outbound 443
• Immutable backups (object lock / WORM) with a minimum 30-day retention, tested restores quarterly
• Decommission or modernize legacy VPN concentrators — Check Point IKEv1, EOL Cisco ASA, unpatched SonicWall. These are AKIRA's hunting ground
• Developer workstation controls — given CVE-2026-48027 (Nx Console supply chain), enforce package provenance verification (Sigstore/in-toto) and isolate build credentials

This briefing is based on live leak site telemetry as of 2026-08-29. Victim postings do not independently confirm compromise details; treat "Not Found" sector entries as unvalidated. Monitor ransomware.live and CISA KEV for campaign updates.

Related Resources

Security Arsenal Incident Response Managed SOC & MDR Services AlertMonitor Threat Detection From The Dark Side Intel Hub