The Akira ransomware group has emerged as a significant threat, draining approximately $42 million from over 250 organizations, according to findings by top global cybersecurity agencies including the United States Federal Bureau of Investigation (FBI).

Investigations conducted by the FBI reveal that the Akira ransomware has been actively targeting businesses and critical infrastructure entities across North America, Europe, and Australia since March 2023. Initially focusing on Windows systems, the group has recently expanded its reach to include Linux variants, posing an even greater risk to organizations.

In response to this escalating threat, the FBI, in collaboration with the Cybersecurity and Infrastructure Security Agency (CISA), Europol’s European Cybercrime Centre (EC3), and the Netherlands’ National Cyber Security Centre (NCSC-NL), has issued a joint cybersecurity advisory (CSA) to raise awareness and disseminate information about the Akira ransomware.

According to the advisory, Akira gains initial access through vulnerable virtual private networks (VPNs) lacking multifactor authentication (MFA). Once inside the network, the ransomware exfiltrates sensitive information and credentials before encrypting the system and presenting the victim with a ransom note. Notably, the ransomware group refrains from leaving initial ransom demands or payment instructions on compromised networks, only providing this information upon contact from the victim.

Akira typically demands payments in Bitcoin as ransom, leveraging the anonymity and decentralization of cryptocurrency transactions to evade detection. The malware often disables security software after gaining access to further conceal its activities.

To mitigate the threat posed by Akira and similar ransomware attacks, the advisory recommends implementing robust security measures such as a comprehensive recovery plan, multifactor authentication, network traffic filtering, and system-wide encryption. Additionally, organizations are urged to continually test their security programs to ensure optimal performance against identified attack techniques.

The report also highlights the alarming scope of data extraction by the malware, including sensitive information from directories associated with prominent cryptocurrency exchanges such as Binance and Coinbase, as well as the Trust Wallet application. Regardless of file type, all data within these directories is being exfiltrated by the ransomware, underscoring the severity of the threat posed by Akira.