Akira Ransomware Group Targeting the Healthcare and Public Health Sector
The HHS’ Health Sector Cybersecurity Coordination Center (HC3) has issued a health and public health (HPH) sector alert about a new ransomware group called Akira, which has been in operation since March 2023. Akira is a ransomware-as-a-service (RaaS) group that recruits affiliates to conduct attacks in exchange for a percentage of the profits they generate. The group mostly attacks small- to medium-sized businesses, although sets substantial ransom payments, which are typically between $200,000 and $4 million. The group has claimed at least 60 victims in a little over 5 months of operation, including organizations in the HPH sector.
The group engages in double extortion tactics, where valuable data are identified and exfiltrated before files are encrypted. The group issues a ransom demand, payment of which is required for the keys to decrypt files and to prevent the release of stolen data. Victims are required to contact the group via their TOR site to negotiate the ransom payment. Victims who pay the ransom are offered a security report that explains the vulnerabilities the group exploited to access their network.
The group uses a variety of methods for initial access including compromised credentials and the exploitation of vulnerabilities in virtual private networks (VPNs), especially where multi-factor authentication has not been implemented. The group has a Windows and Linux ransomware variant and targets both Windows and VMware ESXi servers and incident response data show the group uses a variety of tools in its attacks, including the PCHunter toolkit, the MASSCAN port scanner, Mimikatz for credential harvesting, WinSCP, and PsExec.
The group is thought to have links to the disbanded Conti ransomware group due to Akira and Conti ransomware using similar code, cryptocurrency wallets, and the directory exclusions. HC3 has shared Indicators of Compromise (IoCs) in the Akira ransomware sector alert and provides several recommended mitigations to help network defenders improve resilience to attacks and detect attacks in progress.
Get The FREE
HIPAA Compliance Checklist
Immediate Delivery of Checklist Link To Your Email Address
Please Enter Correct Email Address
Your Privacy Respected
HIPAA Journal Privacy Policy
