Akira

Names and who uses them

• AkiraOur name
• PUNK SPIDERCrowdStrike
• Howling ScorpiusPalo Alto Networks
• GOLD SAHARASecureworks

Known techniques

• T1018Remote System Discovery
• T1021.001Remote Desktop Protocol
• T1027.001Binary Padding
• T1036.005Match Legitimate Resource Name or Location
• T1059.001PowerShell
• T1078Valid Accounts
• T1133External Remote Services
• T1213.002Sharepoint
• T1219Remote Access Tools
• T1482Domain Trust Discovery
• T1486Data Encrypted for Impact
• T1531Account Access Removal
• T1558Steal or Forge Kerberos Tickets
• T1560.001Archive via Utility
• T1567.002Exfiltration to Cloud Storage
• T1657Financial Theft
• T1685Disable or Modify Tools

Malware and tools used