Tracking Adversaries: Akira, another descendent of Conti

This report analyzes the Akira ransomware campaign (emerging March 2023), documenting at least 63 known victims across sectors (SMBs, healthcare, education, finance, manufacturing) and describing technical capabilities (Windows domain and VMware/ESXi targeting, multiple ransomware builds including C++ and Rust variants, file extensions ".akira" and ".powerranges", and ransom note names). It details common TTPs and tooling (brute-forced VPNs, Fortinet exploits, credential theft tools like Mimikatz/LaZagne, lateral movement via PsExec/Impacket, SystemBC RAT, exfiltration via Rclone/FTP, Cloudflared/ngrok C2), Akira’s Tor negotiation and DLS sites (including use of magnet links), and presents multi-level evidence linking Akira to Conti, including code similarities, shared tooling and playbook behavior, and blockchain transactions moving ransom funds to Conti-affiliated wallets.