Bitcoin ransomware Akira drains $42M from more than 250 companies

The U.S. FBI found that the Akira ransomware group has been targeting businesses and critical infrastructure entities in North America, Europe and Australia since March 2023.

Click below to get free Bitcoin 

Akira, a year-old ransomware group, breached more than 250 organizations and extracted approximately $42 million in ransomware proceeds, top global cybersecurity agencies alerted.

Investigations conducted by the United States Federal Bureau of Investigation (FBI) found that Akira ransomware has been targeting businesses and critical infrastructure entities in North America, Europe and Australia since March 2023. While the ransomware initially targeted Windows systems, the FBI recently found Akira’s Linux variant as well.

The FBI, along with Cybersecurity and Infrastructure Security Agency (CISA), Europol’s European Cybercrime Centre (EC3) and the Netherlands’ National Cyber Security Centre (NCSC-NL), released a joint cybersecurity advisory (CSA) to “disseminate” the threat to masses.

According to the advisory, Akira gains initial access through pre-installed virtual private networks (VPNs) that lack multifactor authentication (MFA). The ransomware then proceeds to extract credentials and other sensitive information before locking up the system and displaying a ransom note.

Akira threat actors do not leave an initial ransom demand or payment instructions on compromised networks, and do not relay this information until contacted by the victim.”

The ransomware group demands payments in Bitcoin 

BTC

tickers down

$65,209

 from the victim organizations to restore access. Such malware often disables security software after initial access to avoid detection.

“The FBI, CISA, EC3, and NCSC-NL recommend continually testing your security program, at scale, in a production environment to ensure optimal performance against the MITRE ATT&CK techniques identified in this advisory,” the agencies concluded.

Click below to get free Bitcoin