Since March 2023, Akira ransomware has impacted a wide range of businesses and critical infrastructure entities in North America, Europe, and Australia. In April 2023, following an initial focus on Windows systems, Akira threat actors deployed a Linux variant targeting VMware ESXi virtual machines.
As of January 1, 2024, the ransomware group has impacted over 250 organizations and claimed approximately $42 million USD in ransomware proceeds. Early versions of the Akira ransomware variant were written in C++ and encrypted files with a .akira extension; however, beginning in August 2023, some Akira attacks began deploying Megazord, using Rust-based code which encrypts files with a .powerranges extension.
Read more…
Source: U.S. Federal Bureau of Investigation Cyber Division
Related:
- Freedom for MegaCortex ransomware victims – the fix is out
January 6, 2023
An international law enforcement effort has released a decryptor for victims of MegaCortex ransomware, widely used by cybercriminals to infect large corporations across 71 countries to the tune of more than $100 million in damages. The decryptor, built by Europol, cybersecurity firm Bitdefender, the NoMoreRansom Project, the Zürich Public Prosecutor’s Office and the Zürich Cantonal Police, ...
- Ransomware gang apologizes, gives SickKids hospital free decryptor
January 1, 2023
The LockBit ransomware gang has released a free decryptor for the Hospital for Sick Children (SickKids), saying one of its members violated rules by attacking the healthcare organization. SickKids is a teaching and research hospital in Toronto that focuses on providing healthcare to sick children. On December 18th, the hospital suffered a ransomware attack that impacted internal ...
- LockBit ransomware claims attack on Port of Lisbon in Portugal
December 30, 2022
A cyberattack hitting the Port of Lisbon Administration (APL), the third-largest port in Portugal, on Christmas day, has been claimed by the LockBit ransomware gang. The Port of Lisbon is part of the critical infrastructure in Portugal’s capital city, being one of the most accessed ports in Europe, due to its strategic location, and serving container ...
- Canadian mining firm shuts down mill after ransomware attack
December 30, 2022
The Canadian Copper Mountain Mining Corporation (CMMC) in British Columbia has announced that it was the target of a ransomware attack that impacted its operations. CMMC, partly owned by Mitsubishi Materials Corporation, is an 18,000-acre claim that produces an average of 100 million pounds of copper per year and has an estimated mineral reserve capacity for ...
- The mounting death toll of hospital cyberattacks
December 28, 2022
Cyberattacks are getting deadlier — and hospitals on the frontline are straining under increasing attacks. As the Covid-19 pandemic swept the world over the past three years, cybercriminals took advantage of the chaotic situation and repeatedly shut down hospitals’ networks at a time when they were least able to respond. That has meant curtailed emergency services, ...
- Ontario: Children’s Hospital Expects Weekslong Ransomware Recovery
December 28, 2022
Nearly a week after a ransomware attack forced a network shutdown at Toronto’s Hospital for Sick Children, patients are still experiencing delays in treatment and diagnostic procedures. The hospital says it has restored some systems, phones and websites, but the recovery process could take weeks. Hackers targeted the hospital’s network on Dec. 19, forcing it to ...