Just Another Blue TeamerHappy #MalwareMonday, this time brought to you by the researchers Imano Shunichi and James Slaughter at Fortinet!
The Akira #ransomware which affects both #Microsoft and #Linux systems. According to the team, the adversary likes to target "VPN services that don't have multi-factor authentication (MFA) configured". It has an extension and directory exclusion list built in and provides the adversary some command-line options which includes the option to choose the path, file, and folder for encryption, which path to share the file on, and how fast they want the encryption process to take. There are also some "minor variants" of the ransomware that they observed as well!
Ransomware Roundup - Akira
https://www.fortinet.com/blog/threat-research/ransomware-roundup-akira
Some MITRE ATT&CK TTPs:
TA0002 - Execution
T1059.001 - Command and Scripting Interpreter: PowerShell
TA0040 - Impact
T1486 - Data Encrypted for Impact
T1490 - Inhibit System Recovery
