In a recent cybercrime spree, the Akira ransomware syndicate, only a year old, infiltrated more than 250 entities, siphoning off around $42 million in illicit gains, as per warnings from leading international cybersecurity authorities.

The United States Federal Bureau of Investigation (FBI) revealed from their inquiries that the Akira ransomware has been actively targeting businesses and critical infrastructure establishments across North America, Europe, and Australia since March 2023. Initially focusing on Windows systems, the FBI has now uncovered a Linux version of the Akira ransomware.

Collaborating with the Cybersecurity and Infrastructure Security Agency (CISA), Europol’s European Cybercrime Centre (EC3), and the Netherlands’ National Cyber Security Centre (NCSC-NL), the FBI issued a joint cybersecurity advisory (CSA) to raise awareness about the Akira threat. The advisory highlighted that Akira gains entry through vulnerable virtual private networks (VPNs) lacking multifactor authentication (MFA), pilfering credentials and sensitive data before encrypting systems and demanding ransom.

Unlike typical ransomware groups, Akira does not immediately present ransom demands or payment instructions on compromised networks, only revealing them upon victim contact. The group insists on Bitcoin (BTC) payments for data restoration, often disabling security measures post-infiltration to evade detection.

To combat such ransomware attacks, the advisory recommends implementing recovery strategies, MFA, network traffic filtering, deactivating unused ports and links, and system-wide encryption. The FBI, CISA, EC3, and NCSC-NL stress the importance of regularly testing security protocols in real-world scenarios to effectively counter the identified threats.

Furthermore, recent alerts from the FBI, CISA, NCSC, and the U.S. National Security Agency (NSA) have highlighted the dangers posed by malware targeting cryptocurrency wallets and exchanges, emphasizing the need for heightened vigilance in the digital realm. Malware activities have been observed infiltrating directories of prominent exchange platforms like Binance, Coinbase, and Trust Wallet, indiscriminately extracting all files regardless of content.