Actor Profile

Akira (also tracked as GOLD SAHARA, PUNK SPIDER, and Howling Scorpius) is a ransomware operation that emerged as a significant threat actor conducting double extortion attacks. The group operates an affiliate model, recruiting partners to conduct intrusions and deploy the Akira ransomware payload. Akira affiliates are financially motivated, targeting organizations across multiple sectors to steal sensitive data and encrypt systems for ransom payments. The group is known for leveraging valid credentials and exploiting exposed remote access infrastructure to gain initial access to victim networks.

TTPs (Tactics, Techniques, Procedures)

Akira affiliates employ a range of TTPs mapped to MITRE ATT&CK. Initial access was achieved via an exposed SonicWall VPN without MFA (T1133 External Remote Services). Post-compromise activities included RDP lateral movement (T1021.001 Remote Desktop Protocol), Active Directory enumeration (T1482 Domain Trust Discovery, T1018 Remote System Discovery), and PowerShell execution (T1059.001). The affiliate used WinRAR and s5cmd to exfiltrate data to an S3 bucket (T1567.002 Exfiltration to Cloud Storage). A novel Safe Mode technique was employed to disable EDR and AV protections before deploying the Akira ransomware (T1486 Data Encrypted for Impact). Additional techniques include valid account abuse (T1078), masquerading (T1036.005), and obfuscation (T1027.001). The group also uses tools like AnyDesk for persistent remote access and has been observed collecting SharePoint data (T1213.002).

Targets & Patterns

While specific targeted sectors were not identified in this incident, Akira historically targets organizations with valuable data assets suitable for double extortion. The attack pattern demonstrates opportunistic targeting of organizations with weak perimeter security—specifically those with exposed VPN infrastructure lacking multi-factor authentication. The rapid progression from initial access to data exfiltration (under five hours) indicates the group prioritizes high-value targets where they can quickly monetize access through data theft, even when encryption fails. The focus on domain controllers and application servers suggests targeting of environments with centralized data repositories and administrative access points that enable broad network compromise.

Historical Context

This August 2026 incident represents the first documented case of Akira affiliates using Safe Mode boot manipulation to disable EDR solutions, a technique previously associated with other ransomware families including Snatch and AvosLocker. This tactical evolution demonstrates Akira's adoption of proven evasion techniques from the broader ransomware ecosystem. The group continues to rely on exploiting inadequately secured remote access infrastructure, consistent with their historical operational patterns. The use of cloud storage (S3 buckets) for exfiltration and tools like s5cmd reflects ongoing adaptation to modern cloud-based data theft methods. Despite the encryption failure in this case, the successful data theft within five hours aligns with Akira's established double-extortion model.

Defensive Recommendations

  • Enforce multi-factor authentication (MFA) on all VPN and remote access solutions, particularly SonicWall and similar perimeter devices (mitigates T1133)
  • Monitor for Safe Mode boot configuration changes via registry modifications to HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot and alert on unauthorized remote access tools added to Safe Mode startup (detects T1562.001 evasion)
  • Implement credential spraying detection and monitor for rapid RDP connections to domain controllers following VPN authentication (detects T1021.001 lateral movement)
  • Deploy behavioral monitoring for data staging and exfiltration tools like WinRAR archiving of network shares and s5cmd or AWS CLI usage to external S3 buckets (detects T1567.002)
  • Enable tamper protection features in EDR/AV solutions to prevent disabling of real-time protection and schedule regular scans that run even when real-time protection is disabled