Full Report
Tracking various indicators associated with different attacks, Huntress analysts have been able to identify specific indicators (threat actor workstation names, passwords associated with new user account creation or current account modification, CloudFlare tunnel tokens) that are associated with Akira ransomware infections. By detecting these indicators much earlier in the attack chain, organizations can inhibit or even obviate file encryption malware deployment.
Analysis Summary
# Tool/Technique: Akira Ransomware Precursor Indicators
## Overview
Akira is a sophisticated ransomware-as-a-service (RaaS) operation. This summary focuses on the specific precursors and environmental artifacts identified by Huntress analysts that signal an impending Akira deployment, allowing for detection earlier in the attack chain.
## Technical Details
- **Type:** Malware Family (Ransomware)
- **Platform:** Windows
- **Capabilities:** Credential validation, lateral movement, persistence via hidden accounts, defense evasion (hiding users, Safe Mode reboots), and file encryption.
- **First Seen:** Indicators associated with this specific campaign tracked back to at least December 2023, with specific workstation names appearing April 2024.
## MITRE ATT&CK Mapping
- **TA0001 - Initial Access**
- T1190 - Exploit Public-Facing Application (MSSQL/Veeam)
- T1078 - Valid Accounts
- **TA0003 - Persistence**
- T1136.001 - Create Account: Local Account
- **TA0005 - Defense Evasion**
- T1564.002 - Hide Artifacts: Hidden Users
- T1562.001 - Impair Defenses: Disable or Modify Tools (Safe Mode reboots)
- T1070 - Indicator Removal on Host
- **TA0008 - Lateral Movement**
- T1021.001 - Remote Services: Remote Desktop Protocol
- **TA0011 - Command and Control**
- T1572 - Protocol Tunneling (Cloudflare Tunnels)
- **TA0040 - Impact**
- T1486 - Data Encrypted for Impact
## Functionality
### Core Capabilities
- **Account Creation & Manipulation:** Threat actors create new user accounts via compromised MSSQL/Veeam services or lateral movement.
- **RDP Enablement:** Modifies the registry to enable Remote Desktop Protocol for persistent access.
- **Hidden Persistence:** Utilizes registry keys to hide specific user accounts from the Windows Welcome screen.
- **Encryption Engine:** Uses a specific binary (`w.exe`) to perform multi-threaded encryption of local files.
### Advanced Features
- **Tunneling:** Deployment of Cloudflare (`cloudflared.exe`) tunnels to bypass firewalls and maintain C2.
- **EDR Evasion:** Known to reboot systems into Safe Mode to bypass/disable EDR and Windows Defender before executing encryption.
## Indicators of Compromise
- **File Names:**
- `cloudflared.exe` (Typically in `C:\ProgramData\`)
- `w.exe` (The ransomware encryptor, often in `C:\ProgramData\`)
- **Registry Keys:**
- `HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server\fDenyTSConnections` (Set to 0)
- `HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList` (Used to hide accounts)
- **Network Indicators:**
- Remote access originating from workstation name: `WIN-JGRMF8L11HO`
- **Behavioral Indicators:**
- `sqlservr.exe` spawning account creation commands.
- Command line: `w.exe -p=[redacted] -n=2`
- Command line: `cloudflared.exe tunnel run --token [token]`
## Associated Threat Actors
- **Akira Ransomware Group/Affiliates**
- **Note:** Registry techniques for RDP enablement overlap with **INC** and **ReadText34** ransomware actors.
## Detection Methods
- **Log Analysis:** Monitor Windows Security Logs (Event IDs 4624, 4625, and 4776) for the source workstation name `WIN-JGRMF8L11HO`.
- **Registry Monitoring:** Alert on modifications to `SpecialAccounts\UserList` or changes to `fDenyTSConnections`.
- **Process Monitoring:** Watch for `cloudflared.exe` executing with the `tunnel` flag in unusual directories like `C:\ProgramData\`.
- **Behavioral:** Identify unusual reboots into Safe Mode followed by the execution of unknown binaries from temporary or program data folders.
## Mitigation Strategies
- **Attack Surface Reduction:** Secure or firewal MSSQL and Veeam instances to prevent unauthorized external access.
- **Credential Hygiene:** Implement Multi-Factor Authentication (MFA) on all RDP instances and administrative accounts.
- **Inventory Management:** Maintain a strict asset inventory to identify rogue Cloudflare tunnels or unauthorized user accounts.
- **Registry Protections:** Restrict permissions on registry keys related to Terminal Services and Winlogon.
## Related Tools/Techniques
- **Cloudflared:** Legitimate tool repurposed for C2.
- **TeamViewer:** Frequently exploited for initial access by the same group.
- **Rclone:** Often used by Akira for data exfiltration prior to encryption.