Loading IOCs…

{'aliases': [],
 'description': 'Akirais a ransomware variant and ransomware deployment entity '
                'active since at least March 2023.[1]Akirauses compromised '
                'credentials to access single-factor external access '
                'mechanisms such as VPNs for initial access, then various '
                'publicly-available tools and techniques for lateral '
                'movement.[1][2]Akiraoperations are associated with "double '
                'extortion" ransomware activity, where data is exfiltrated '
                'from victim environments prior to encryption, with threats to '
                'publish files if a ransom is not paid. Technical analysis '
                'ofAkiraransomware indicates variants capable of targeting '
                'Windows or VMWare ESXi hypervisors and multiple overlaps '
                'withContiransomware.[3][4][5]',
 'external_references': [{'external_id': 'G1024',
                          'source_name': 'mitre-attack',
                          'url': 'https://attack.mitre.org/groups/G1024/'}],
 'id': 'threat-actor--G1024',
 'metadata': {'crawled_at': '2026-04-29T14:32:21.976355+00:00',
              'mitre_group_id': 'G1024',
              'page_title': 'Akira, GOLD SAHARA, PUNK SPIDER, Howling '
                            'Scorpius, Group G1024 | MITRE ATT&CK®'},
 'name': 'Akira',
 'type': 'threat-actor'}