Back
CERT-In cautions internet users against Ransomware 'Akira' attack
- By Elite CIO
Jul 24, 2023
17
Akira: All You Need To Know About The Data-Stealing Ransomware CERT-In Has Been Warning About
A recently emerged Ransomware operation dubbed Akira is reportedly active in cyberspace. This ransomware is targeting both Windows and Linux-based systems. This group first steals the information from the victims, then encrypt data on their systems and conducts double extortion to force the victim into paying the ransom. In case the victim does not pay, they release their victim's data on their dark web blog. The group is known to access victim environments via VPN services, particularly where users have not enabled multi-factor authentication. The group has also utilized tools such as AnyDesk, WinRAR, and PCHunter during intrusions. These tools are often found in the victim's environment, and their misuse typically goes unnoticed.
Infection Mechanism: The attack process begins when a sample of the Akira ransomware is executed. Upon execution, Akira deletes the Windows Shadow Volume Copies on the targeted device. The ransomware then encrypts files with a predefined set of extensions. A '.akira' extension is appended to each encrypted file's name during this encryption process.
In the encryption phase, the ransomware terminates active Windows services using the Windows Restart Manager API. This step prevents any interference with the encryption process. It encrypts files found in various hard drive folders, excluding the Program Data, Recycle Bin, Boot, System Volume Information, and Windows folders. To maintain system stability, it refrains from modifying Windows system files, which include files with extensions like .sys, .msi, .dll, .lnk, and .exe
Best Practices:
1. Ransomware infections primarily keep data as hostage. Therefore, it is recommended to maintain offline backups of critical data and ensure that these backups stay up to date to prevent data loss in the event of ransomware infection.
2. All operating systems and applications should be kept updated regularly. Virtual patching can be considered for protecting legacy systems and networks. This measure hinders cybercriminals from gaining easy access to any system through vulnerabilities in outdated applications and software.
3. Periodic Backups and restoration tests to check the restoration integrity.
4. Establish Domain-based Message Authentication, Reporting, and Conformance (DMARC), Domain Keys Identified Mail (DKIM) and Sender Policy Framework (SPF) for your domain, which is an email validation system designed to prevent spam by detecting email spoofing by which most of the ransomware samples successfully reaches the corporate email boxes.
5. Enforce strong password policies and multi-factor authentication (MFA).
6. Avoid applying updates/patches available in any unofficial channel.
7. Implement a strict External Device (USB drive) usage policy.
8. Employ data-at-rest and data-in-transit encryption.
9. Consider installing the Enhanced Mitigation Experience Toolkit or similar host-level anti-exploitation tools.
10. Block the attachments of file types, exe|pif|tmp|url|vb|vbe|scr|reg|cer|pst|cmd|com|bat|dll|dat|hlp|hta|js|wsf
11. Conduct vulnerability Assessment and Penetration Testing (VAPT) and information security audits of critical networks/systems, especially database servers, from CERT-IN empaneled auditors. Repeat audits at regular intervals.