Akira ransomware continues to evolve
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2020-3259 | Unauthenticated Memory-Disclosure Flaw in Cisco ASA and FTD Web Services | 7.5 | 72% | KEVRansomware | KEV |
| CVE-2023-20263 | A vulnerability in the web-based management interface of Cisco HyperFlex HX Data Platform could allow an unauthenticated, remote attacker to redirect a user to… | 6.1 | <1% | ||
| CVE-2023-20269 | Unauthenticated Brute-Force VPN Access in Cisco ASA and Firepower Threat Defense | 9.1 | 27% | KEVRansomware | KEV |
| CVE-2023-27532 | Missing Authentication in Veeam Backup & Replication Exposes Stored Credentials | 7.5 | 81% | KEVRansomware | KEV |
| CVE-2023-48788 | Unauthenticated SQL Injection in Fortinet FortiClient EMS | 9.8 | 98% | KEVRansomware | KEV |
| CVE-2024-37085 | Authentication Bypass in VMware ESXi via AD Group Recreation | 7.2 | 27% | KEVRansomware | KEV |
| CVE-2024-40711 | Unauthenticated Deserialization RCE in Veeam Backup & Replication | 9.8 | 90% | KEVRansomwarePoC | KEV |
| CVE-2024-40766 | Improper Access Control in SonicWall SonicOS Management (Gen 5/6/7 Firewalls) | 9.8 | 18% | KEVRansomware | KEV |
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| sha256 | 2c7aeac07ce7f03b74952e0e243bd52f2bfa60fadc92dd71a6a1fee2d14cdd77 | 669390e4177597faf9271ce3ad3a16a3652e145913dbfa9a5951972fcb0 2c7aeac07ce7f03b74952e0e243bd52f2bfa60fadc92dd71a6a1fee2d14cdd77 88da2b1cee373d5f11949c1ade22af0badf16591a871978a9e02f70480e |
| sha256 | 3805f299d33ef43d17a5a1040149f0e5e2d5db57ec6f03c5687ac23db1f77a30 | 906a916f1b3595a31fa44d8e04e563a32557eb42 Linux (The Return) 3805f299d33ef43d17a5a1040149f0e5e2d5db57ec6f03c5687ac23db1f77a30 abba655df92e99a15ddcde1d196ff4393a13dbff293e45f5375a2f61c84 |
| sha256 | 43c5a487329f5d6b4a6d02e2f8ef62744b850312c5cb87c0a414f3830767be72 | cbe15d60293c556f05e98ed9a46d398a82e5ca4d00c91ebec68a209ea84 43c5a487329f5d6b4a6d02e2f8ef62744b850312c5cb87c0a414f3830767be72 8e9a33809b9062c5033928f82e8adacbef6cd7b40e73da9fcf13ec2493b |
| sha256 | 566ef5484da0a93c87dd0cb0a950a7cff4ab013175289cd5fccf9dd7ea430739 | b1cee373d5f11949c1ade22af0badf16591a871978a9e02f70480e547b2 566ef5484da0a93c87dd0cb0a950a7cff4ab013175289cd5fccf9dd7ea430739 ccda8247360a85b6c076527e438a995757b6cdf5530f38e125915d31291 |
| sha256 | 6005dcbe15d60293c556f05e98ed9a46d398a82e5ca4d00c91ebec68a209ea84 | f13e8a71a8b5f0803075382eb0311d0d8dbae3f08bac0b2f4250af8add0 6005dcbe15d60293c556f05e98ed9a46d398a82e5ca4d00c91ebec68a209ea84 43c5a487329f5d6b4a6d02e2f8ef62744b850312c5cb87c0a414f383076 |
| sha256 | 78d75669390e4177597faf9271ce3ad3a16a3652e145913dbfa9a5951972fcb0 | found in our GitHub repository here . Windows (The Return) 78d75669390e4177597faf9271ce3ad3a16a3652e145913dbfa9a5951972fcb0 2c7aeac07ce7f03b74952e0e243bd52f2bfa60fadc92dd71a6a1fee2d14 |
| sha256 | 87b4020bcd3fad1f5711e6801ca269ef5852256eeaf350f4dde2dc46c576262d | 247360a85b6c076527e438a995757b6cdf5530f38e125915d31291c00d5 87b4020bcd3fad1f5711e6801ca269ef5852256eeaf350f4dde2dc46c576262d 988776358d0e45a4907dc1f4906a916f1b3595a31fa44d8e04e563a3255 |
| sha256 | 88da2b1cee373d5f11949c1ade22af0badf16591a871978a9e02f70480e547b2 | ac07ce7f03b74952e0e243bd52f2bfa60fadc92dd71a6a1fee2d14cdd77 88da2b1cee373d5f11949c1ade22af0badf16591a871978a9e02f70480e547b2 566ef5484da0a93c87dd0cb0a950a7cff4ab013175289cd5fccf9dd7ea4 |
| sha256 | 8e9a33809b9062c5033928f82e8adacbef6cd7b40e73da9fcf13ec2493b4544c | 487329f5d6b4a6d02e2f8ef62744b850312c5cb87c0a414f3830767be72 8e9a33809b9062c5033928f82e8adacbef6cd7b40e73da9fcf13ec2493b4544c bcae978c17bcddc0bf6419ae978e3471197801c36f73cff2fc88cecbe3d |
| sha256 | 988776358d0e45a4907dc1f4906a916f1b3595a31fa44d8e04e563a32557eb42 | 20bcd3fad1f5711e6801ca269ef5852256eeaf350f4dde2dc46c576262d 988776358d0e45a4907dc1f4906a916f1b3595a31fa44d8e04e563a32557eb42 Linux (The Return) 3805f299d33ef43d17a5a1040149f0e5e2d5db57 |
| sha256 | a546ef13e8a71a8b5f0803075382eb0311d0d8dbae3f08bac0b2f4250af8add0 | 55df92e99a15ddcde1d196ff4393a13dbff293e45f5375a2f61c84a2c7b a546ef13e8a71a8b5f0803075382eb0311d0d8dbae3f08bac0b2f4250af8add0 6005dcbe15d60293c556f05e98ed9a46d398a82e5ca4d00c91ebec68a20 |
| sha256 | abba655df92e99a15ddcde1d196ff4393a13dbff293e45f5375a2f61c84a2c7b | 299d33ef43d17a5a1040149f0e5e2d5db57ec6f03c5687ac23db1f77a30 abba655df92e99a15ddcde1d196ff4393a13dbff293e45f5375a2f61c84a2c7b a546ef13e8a71a8b5f0803075382eb0311d0d8dbae3f08bac0b2f4250af |
| sha256 | bcae978c17bcddc0bf6419ae978e3471197801c36f73cff2fc88cecbe3d88d1a | 3809b9062c5033928f82e8adacbef6cd7b40e73da9fcf13ec2493b4544c bcae978c17bcddc0bf6419ae978e3471197801c36f73cff2fc88cecbe3d88d1a 3805f299d33ef43d17a5a1040149f0e5e2d5db57ec6f03c5687ac23db1f |
| sha256 | ccda8247360a85b6c076527e438a995757b6cdf5530f38e125915d31291c00d5 | 5484da0a93c87dd0cb0a950a7cff4ab013175289cd5fccf9dd7ea430739 ccda8247360a85b6c076527e438a995757b6cdf5530f38e125915d31291c00d5 87b4020bcd3fad1f5711e6801ca269ef5852256eeaf350f4dde2dc46c57 |
From the original article
11 min read at blog.talosintelligence.com
Akira continues to cement its position as one of the most prevalent ransomware operations in the threat landscape, according to Cisco Talos’ findings and analysis. Their success is partly due to the fact that they are constantly evolving.
blog.talosintelligence.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.