MITRE ATT&CK / Software / S1129

Akira

ID
S1129
Type
Malware
Platforms
Windows
Source
attack.mitre.org
MITRE last modified
11 Mar 2025

Akira ransomware, written in C++, is most prominently (but not exclusively) associated with the ransomware-as-a-service entity Akira. Akira ransomware has been used in attacks across North America, Europe, and Australia, with a focus on critical infrastructure sectors including manufacturing, education, and IT services. Akira ransomware employs hybrid encryption and threading to increase the speed and efficiency of encryption and runtime arguments for tailored attacks. Notable variants include Rust-based Megazord for targeting Windows and Akira _v2 for targeting VMware ESXi servers.[1][2][3]

Techniques used (10)

Groups using it (1)

References

  1. Kersten Akira 2023
  2. CISA Akira Ransomware APR 2024
  3. Cisco Akira Ransomware OCT 2024