Malware: Akira _v2

Description

[Akira _v2](https://attack.mitre.org/software/S1194) is a Rust-based variant of [Akira](https://attack.mitre.org/software/S1129) ransomware that has been in use since at least 2024. [Akira _v2](https://attack.mitre.org/software/S1194) is designed to target VMware ESXi servers and includes a new command-line argument set and other expanded capabilities.(Citation: CISA Akira Ransomware APR 2024)(Citation: Cisco Akira Ransomware OCT 2024)(Citation: Palo Alto Howling Scorpius DEC 2024)

External References

• mitre-attack
• CISA Akira Ransomware APR 2024
• Cisco Akira Ransomware OCT 2024
• Palo Alto Howling Scorpius DEC 2024

Techniques Used by This Malware

• T1083 — File and Directory Discovery
• T1480 — Execution Guardrails
• T1486 — Data Encrypted for Impact
• T1489 — Service Stop
• T1543 — Create or Modify System Process
• T1654 — Log Enumeration

APT Groups Using This Malware

• Akira