Akira Ransomware Devastates Airlines Using Legit Tools

In June 2024 the Akira ransomware operator (Storm-1567) compromised a Latin American airline by gaining SSH access, exploiting CVE-2023-27532 on a Veeam backup server to escalate access, exfiltrating sensitive data (WinSCP to 77.247.126.158) and deploying ransomware across the network; adversaries used legitimate tools (Remmina, AnyDesk, Impacket, NetScan) and LOLBAS for reconnaissance and persistence in a double‑extortion campaign.