Akira Attacks a Jeans Manufacturer
Akira has hit yet another target, this time a jeans manufacturer: DENHAM. The attack supposedly allowed Akira to clone, extract, and encrypt around 100GB of confidential data. This makes the breach a costly one for DENHAM.
- DENHAM didn’t comment on the attack, but it is presumed that they have managed to regain control over their operations
- Akira’s public post following the attack is also indicative of the fact that DENHAM chose to not pay the ransom
- In this case, Akira announced that they will release the data they’ve collected publicly
- The information that leaked includes part of the client database, financial records, confidential files, and more
Akira is known for its multi-extortion tactics, high activity frequency, and the non-discriminate approach. The organization targets small, medium, and large companies belonging to different fields.
These include healthcare, education, manufacturing, financial, real estate, and so on. The organization always adjusts the value of the ransom based on the victim’s capabilities to increase the likelihood of payment. Even so, many refuse to pay.
Akira is among the most dangerous and active ransomware actors, constantly looking for vulnerable targets. Despite the ransomware actor becoming public less than a year ago, it has already racked several hundred victims by now.
The organization appears to operate mainly on US soil, as over 70% of the victims are located here.
Our Mission
We believe security online security matters and its our mission to make it a safer place.
Who Is Akira?
Akira first appeared in March of 2023 and quickly grew as one of the most feared ransomware actors in the field. Not only because of its aggression and competence, but because of its outrageous demands too.
While Akira usually adjusts its ransom demands to its victim’s capabilities, this isn’t always the case. In many cases, the organization has been known to make unrealistic demands, sometimes asking for hundreds of millions of $ in ransom.
Akira usually aims for at least several dozen victims per month, with the slowest month still accounting for 10 victims. The group is known to collaborate with other ransomware groups and affiliates to cover their tracks and improve their success rate.
The group always leaves behind a ransom note, which the victim is supposed to use to contact one of its representatives on their TOR network. The victim will use a unique identified to connect to the host, after which the negotiations will begin.
If the negotiations fail, Akira will publish the collected data on their TOR website or sell it to the highest bidder.