ctipilot.ch

Akira

actor · actor:akira single-sourcesingle-source-victim

Akira — ransomware operator targeting EU healthcare and SME via edge-device CVE chains and intermittent-encryption EDR evasion

Coverage timeline
21
first 2026-05-04 → last 2026-07-12
Peak priority
high
5 high · 16 notable
Sources cited
50
33 hosts
Sections touched
9
active-threats, deep-dive, research
Co-occurring entities
8
see Related entities below
ATT&CK techniques
28
pinned v19.1 · see below
2026-05-0421 appearances2026-07-12

Hunting pivots

Tags
ransomware ×20organized-crime ×12identity ×7data-breach ×6vulnerabilities ×5auth-bypass ×4actively-exploited ×3infostealer ×2law-enforcement ×2nation-state ×2patch-available ×2supply-chain ×2ai-abuseespionageeu-nexusinsider-threat

ATT&CK techniques

28 techniques observed across 11 entries — derived from entry metadata and body evidence, never asserted without a published entry behind it · pinned to MITRE ATT&CK v19.1 · compare on the matrix · Navigator layer (JSON)

Resource Development TA0042

T1608.006Stage Capabilities: SEO Poisoning×1

Adversaries may poison mechanisms that influence search engine optimization (SEO) to further lure staged capabilities towards potential victims. Search engines typically display results to users based on purchased ads as well as the site’s ranking/score/reputation calculated by their web crawlers and algorithms.

Evidence: 2026-06-30/bumblebee-adaptixc2-akira-a-full-seo-poisoning-to-ransomware · ATT&CK page ↗

Initial Access TA0001

T1078Valid Accounts×3

Adversaries may obtain and abuse credentials of existing accounts as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Compromised credentials may be used to bypass access controls placed on various resources on systems within the network and may even be used for persistent access to remote systems and externally available services, such as VPNs, Outlook Web Access, network devices, and remote desktop. Compromised credentials may also grant an adversary increased privilege to specific systems or access to restricted areas of the network. Adversaries may choose not to use malware or tools in conjunction with the legitimate access those credentials provide to make it harder to detect their presence.

Evidence: 2026-06-23/sonicwall-cve-2024-40766-why-patched-firewalls-keep-falling · 2026-06-10/dragos-q1-2026-industrial-ransomware-analysis-1-020-industri · 2026-05-21/keycloak-26-6-2-16-cves-including-oidc-session-fixation-cve · ATT&CK page ↗

T1078.001Valid Accounts: Default Accounts×1

Adversaries may obtain and abuse credentials of a default account as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Default accounts are those that are built-into an OS, such as the Guest or Administrator accounts on Windows systems. Default accounts also include default factory/provider set accounts on other types of systems, software, or devices, including the root user account in AWS, the root user account in ESXi, and the default service account in Kubernetes.

Evidence: 2026-05-28/sans-isc-akira-ransomware-kill-chain-reconstructed-entirely · ATT&CK page ↗

T1078.002Valid Accounts: Domain Accounts×1

Adversaries may obtain and abuse credentials of a domain account as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Domain accounts are those managed by Active Directory Domain Services where access and permissions are configured across systems and services that are part of that domain. Domain accounts can cover users, administrators, and services.

Evidence: 2026-06-23/sonicwall-cve-2024-40766-why-patched-firewalls-keep-falling · ATT&CK page ↗

T1133External Remote Services×5

Adversaries may leverage external-facing remote services to initially access and/or persist within a network. Remote services such as VPNs, Citrix, and other access mechanisms allow users to connect to internal enterprise network resources from external locations. There are often remote service gateways that manage connections and credential authentication for these services. Services such as Windows Remote Management and VNC can also be used externally.

Evidence: 2026-06-23/sonicwall-cve-2024-40766-why-patched-firewalls-keep-falling · 2026-06-10/dragos-q1-2026-industrial-ransomware-analysis-1-020-industri · 2026-05-28/sans-isc-akira-ransomware-kill-chain-reconstructed-entirely · 2026-05-10/groupe-3r-r-seau-radiologique-romand-akira-ransomware-claims · 2026-05-04/akira-ransomware-on-groupe-3r-20-swiss-medical-imaging-centr · ATT&CK page ↗

T1190Exploit Public-Facing Application×2

Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network. The weakness in the system can be a software bug, a temporary glitch, or a misconfiguration.

Evidence: 2026-05-10/groupe-3r-r-seau-radiologique-romand-akira-ransomware-claims · 2026-05-04/akira-ransomware-on-groupe-3r-20-swiss-medical-imaging-centr · ATT&CK page ↗

Execution TA0002

T1047Windows Management Instrumentation×2

Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is designed for programmers and is the infrastructure for management data and operations on Windows systems. WMI is an administration feature that provides a uniform environment to access Windows system components.

Evidence: 2026-06-30/bumblebee-adaptixc2-akira-a-full-seo-poisoning-to-ransomware · 2026-05-04/akira-playbook-quarterly-context-q1-2026-healthcare-concentr · ATT&CK page ↗

T1204User Execution×1

An adversary may rely upon specific actions by a user in order to gain execution. Users may be subjected to social engineering to get them to execute malicious code by, for example, opening a malicious document file or link. These user actions will typically be observed as follow-on behavior from forms of Phishing.

Evidence: 2026-06-30/bumblebee-adaptixc2-akira-a-full-seo-poisoning-to-ransomware · ATT&CK page ↗

T1204.002User Execution: Malicious File×1

An adversary may rely upon a user opening a malicious file in order to gain execution. Users may be subjected to social engineering to get them to open a file that will lead to code execution. This user action will typically be observed as follow-on behavior from Spearphishing Attachment. Adversaries may use several types of files that require a user to execute them, including .doc, .pdf, .xls, .rtf, .scr, .exe, .lnk, .pif, .cpl, .reg, and .iso.

Evidence: 2026-06-30/bumblebee-adaptixc2-akira-a-full-seo-poisoning-to-ransomware · ATT&CK page ↗

T1574Hijack Execution Flow×1

Adversaries may execute their own malicious payloads by hijacking the way operating systems run programs. Hijacking execution flow can be for the purposes of persistence, since this hijacked execution may reoccur over time. Adversaries may also use these mechanisms to elevate privileges or evade defenses, such as application control or other restrictions on execution.

Evidence: 2026-06-30/bumblebee-adaptixc2-akira-a-full-seo-poisoning-to-ransomware · ATT&CK page ↗

T1574.001Hijack Execution Flow: DLL×2

Adversaries may abuse dynamic-link library files (DLLs) in order to achieve persistence, escalate privileges, and evade defenses. DLLs are libraries that contain code and data that can be simultaneously utilized by multiple programs. While DLLs are not malicious by nature, they can be abused through mechanisms such as side-loading, hijacking search order, and phantom DLL hijacking.

Evidence: 2026-06-30/bumblebee-adaptixc2-akira-a-full-seo-poisoning-to-ransomware · 2026-06-25/mistic-backdoor-signed-defender-dll-sideloading-and-in-memor · ATT&CK page ↗

Persistence TA0003

T1078Valid Accounts×3

Adversaries may obtain and abuse credentials of existing accounts as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Compromised credentials may be used to bypass access controls placed on various resources on systems within the network and may even be used for persistent access to remote systems and externally available services, such as VPNs, Outlook Web Access, network devices, and remote desktop. Compromised credentials may also grant an adversary increased privilege to specific systems or access to restricted areas of the network. Adversaries may choose not to use malware or tools in conjunction with the legitimate access those credentials provide to make it harder to detect their presence.

Evidence: 2026-06-23/sonicwall-cve-2024-40766-why-patched-firewalls-keep-falling · 2026-06-10/dragos-q1-2026-industrial-ransomware-analysis-1-020-industri · 2026-05-21/keycloak-26-6-2-16-cves-including-oidc-session-fixation-cve · ATT&CK page ↗

T1078.001Valid Accounts: Default Accounts×1

Adversaries may obtain and abuse credentials of a default account as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Default accounts are those that are built-into an OS, such as the Guest or Administrator accounts on Windows systems. Default accounts also include default factory/provider set accounts on other types of systems, software, or devices, including the root user account in AWS, the root user account in ESXi, and the default service account in Kubernetes.

Evidence: 2026-05-28/sans-isc-akira-ransomware-kill-chain-reconstructed-entirely · ATT&CK page ↗

T1078.002Valid Accounts: Domain Accounts×1

Adversaries may obtain and abuse credentials of a domain account as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Domain accounts are those managed by Active Directory Domain Services where access and permissions are configured across systems and services that are part of that domain. Domain accounts can cover users, administrators, and services.

Evidence: 2026-06-23/sonicwall-cve-2024-40766-why-patched-firewalls-keep-falling · ATT&CK page ↗

T1098.005Account Manipulation: Device Registration×1

Adversaries may register a device to an adversary-controlled account. Devices may be registered in a multifactor authentication (MFA) system, which handles authentication to the network, or in a device management system, which handles device access and compliance.

Evidence: 2026-05-21/keycloak-26-6-2-16-cves-including-oidc-session-fixation-cve · ATT&CK page ↗

T1133External Remote Services×5

Adversaries may leverage external-facing remote services to initially access and/or persist within a network. Remote services such as VPNs, Citrix, and other access mechanisms allow users to connect to internal enterprise network resources from external locations. There are often remote service gateways that manage connections and credential authentication for these services. Services such as Windows Remote Management and VNC can also be used externally.

Evidence: 2026-06-23/sonicwall-cve-2024-40766-why-patched-firewalls-keep-falling · 2026-06-10/dragos-q1-2026-industrial-ransomware-analysis-1-020-industri · 2026-05-28/sans-isc-akira-ransomware-kill-chain-reconstructed-entirely · 2026-05-10/groupe-3r-r-seau-radiologique-romand-akira-ransomware-claims · 2026-05-04/akira-ransomware-on-groupe-3r-20-swiss-medical-imaging-centr · ATT&CK page ↗

T1136Create Account×1

Adversaries may create an account to maintain access to victim systems. With a sufficient level of access, creating such accounts may be used to establish secondary credentialed access that do not require persistent remote access tools to be deployed on the system.

Evidence: 2026-06-30/bumblebee-adaptixc2-akira-a-full-seo-poisoning-to-ransomware · ATT&CK page ↗

T1136.002Create Account: Domain Account×1

Adversaries may create a domain account to maintain access to victim systems. Domain accounts are those managed by Active Directory Domain Services where access and permissions are configured across systems and services that are part of that domain. Domain accounts can cover user, administrator, and service accounts. With a sufficient level of access, the <code>net user /add /domain</code> command can be used to create a domain account.

Evidence: 2026-06-30/bumblebee-adaptixc2-akira-a-full-seo-poisoning-to-ransomware · ATT&CK page ↗

T1556Modify Authentication Process×1

Adversaries may modify authentication mechanisms and processes to access user credentials or enable otherwise unwarranted access to accounts. The authentication process is handled by mechanisms, such as the Local Security Authentication Server (LSASS) process and the Security Accounts Manager (SAM) on Windows, pluggable authentication modules (PAM) on Unix-based systems, and authorization plugins on MacOS systems, responsible for gathering, storing, and validating credentials. By modifying an authentication process, an adversary may be able to authenticate to a service or system without using Valid Accounts.

Evidence: 2026-05-21/keycloak-26-6-2-16-cves-including-oidc-session-fixation-cve · ATT&CK page ↗

Privilege Escalation TA0004

T1078Valid Accounts×3

Adversaries may obtain and abuse credentials of existing accounts as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Compromised credentials may be used to bypass access controls placed on various resources on systems within the network and may even be used for persistent access to remote systems and externally available services, such as VPNs, Outlook Web Access, network devices, and remote desktop. Compromised credentials may also grant an adversary increased privilege to specific systems or access to restricted areas of the network. Adversaries may choose not to use malware or tools in conjunction with the legitimate access those credentials provide to make it harder to detect their presence.

Evidence: 2026-06-23/sonicwall-cve-2024-40766-why-patched-firewalls-keep-falling · 2026-06-10/dragos-q1-2026-industrial-ransomware-analysis-1-020-industri · 2026-05-21/keycloak-26-6-2-16-cves-including-oidc-session-fixation-cve · ATT&CK page ↗

T1078.001Valid Accounts: Default Accounts×1

Adversaries may obtain and abuse credentials of a default account as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Default accounts are those that are built-into an OS, such as the Guest or Administrator accounts on Windows systems. Default accounts also include default factory/provider set accounts on other types of systems, software, or devices, including the root user account in AWS, the root user account in ESXi, and the default service account in Kubernetes.

Evidence: 2026-05-28/sans-isc-akira-ransomware-kill-chain-reconstructed-entirely · ATT&CK page ↗

T1078.002Valid Accounts: Domain Accounts×1

Adversaries may obtain and abuse credentials of a domain account as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Domain accounts are those managed by Active Directory Domain Services where access and permissions are configured across systems and services that are part of that domain. Domain accounts can cover users, administrators, and services.

Evidence: 2026-06-23/sonicwall-cve-2024-40766-why-patched-firewalls-keep-falling · ATT&CK page ↗

T1098.005Account Manipulation: Device Registration×1

Adversaries may register a device to an adversary-controlled account. Devices may be registered in a multifactor authentication (MFA) system, which handles authentication to the network, or in a device management system, which handles device access and compliance.

Evidence: 2026-05-21/keycloak-26-6-2-16-cves-including-oidc-session-fixation-cve · ATT&CK page ↗

Stealth TA0005

T1036.005Masquerading: Match Legitimate Resource Name or Location×1

Adversaries may match or approximate the name or location of legitimate files, Registry keys, or other resources when naming/placing them. This is done for the sake of evading defenses and observation.

Evidence: 2026-06-25/mistic-backdoor-signed-defender-dll-sideloading-and-in-memor · ATT&CK page ↗

T1078Valid Accounts×3

Adversaries may obtain and abuse credentials of existing accounts as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Compromised credentials may be used to bypass access controls placed on various resources on systems within the network and may even be used for persistent access to remote systems and externally available services, such as VPNs, Outlook Web Access, network devices, and remote desktop. Compromised credentials may also grant an adversary increased privilege to specific systems or access to restricted areas of the network. Adversaries may choose not to use malware or tools in conjunction with the legitimate access those credentials provide to make it harder to detect their presence.

Evidence: 2026-06-23/sonicwall-cve-2024-40766-why-patched-firewalls-keep-falling · 2026-06-10/dragos-q1-2026-industrial-ransomware-analysis-1-020-industri · 2026-05-21/keycloak-26-6-2-16-cves-including-oidc-session-fixation-cve · ATT&CK page ↗

T1078.001Valid Accounts: Default Accounts×1

Adversaries may obtain and abuse credentials of a default account as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Default accounts are those that are built-into an OS, such as the Guest or Administrator accounts on Windows systems. Default accounts also include default factory/provider set accounts on other types of systems, software, or devices, including the root user account in AWS, the root user account in ESXi, and the default service account in Kubernetes.

Evidence: 2026-05-28/sans-isc-akira-ransomware-kill-chain-reconstructed-entirely · ATT&CK page ↗

T1078.002Valid Accounts: Domain Accounts×1

Adversaries may obtain and abuse credentials of a domain account as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Domain accounts are those managed by Active Directory Domain Services where access and permissions are configured across systems and services that are part of that domain. Domain accounts can cover users, administrators, and services.

Evidence: 2026-06-23/sonicwall-cve-2024-40766-why-patched-firewalls-keep-falling · ATT&CK page ↗

T1574Hijack Execution Flow×1

Adversaries may execute their own malicious payloads by hijacking the way operating systems run programs. Hijacking execution flow can be for the purposes of persistence, since this hijacked execution may reoccur over time. Adversaries may also use these mechanisms to elevate privileges or evade defenses, such as application control or other restrictions on execution.

Evidence: 2026-06-30/bumblebee-adaptixc2-akira-a-full-seo-poisoning-to-ransomware · ATT&CK page ↗

T1574.001Hijack Execution Flow: DLL×2

Adversaries may abuse dynamic-link library files (DLLs) in order to achieve persistence, escalate privileges, and evade defenses. DLLs are libraries that contain code and data that can be simultaneously utilized by multiple programs. While DLLs are not malicious by nature, they can be abused through mechanisms such as side-loading, hijacking search order, and phantom DLL hijacking.

Evidence: 2026-06-30/bumblebee-adaptixc2-akira-a-full-seo-poisoning-to-ransomware · 2026-06-25/mistic-backdoor-signed-defender-dll-sideloading-and-in-memor · ATT&CK page ↗

Defense Impairment TA0112

T1556Modify Authentication Process×1

Adversaries may modify authentication mechanisms and processes to access user credentials or enable otherwise unwarranted access to accounts. The authentication process is handled by mechanisms, such as the Local Security Authentication Server (LSASS) process and the Security Accounts Manager (SAM) on Windows, pluggable authentication modules (PAM) on Unix-based systems, and authorization plugins on MacOS systems, responsible for gathering, storing, and validating credentials. By modifying an authentication process, an adversary may be able to authenticate to a service or system without using Valid Accounts.

Evidence: 2026-05-21/keycloak-26-6-2-16-cves-including-oidc-session-fixation-cve · ATT&CK page ↗

Credential Access TA0006

T1003OS Credential Dumping×1

Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password. Credentials can be obtained from OS caches, memory, or structures. Credentials can then be used to perform Lateral Movement and access restricted information.

Evidence: 2026-06-30/bumblebee-adaptixc2-akira-a-full-seo-poisoning-to-ransomware · ATT&CK page ↗

T1003.003OS Credential Dumping: NTDS×1

Adversaries may attempt to access or create a copy of the Active Directory domain database in order to steal credential information, as well as obtain other information about domain members such as devices, users, and access rights. By default, the NTDS file (NTDS.dit) is located in <code>%SystemRoot%\NTDS\Ntds.dit</code> of a domain controller.

Evidence: 2026-06-30/bumblebee-adaptixc2-akira-a-full-seo-poisoning-to-ransomware · ATT&CK page ↗

T1556Modify Authentication Process×1

Adversaries may modify authentication mechanisms and processes to access user credentials or enable otherwise unwarranted access to accounts. The authentication process is handled by mechanisms, such as the Local Security Authentication Server (LSASS) process and the Security Accounts Manager (SAM) on Windows, pluggable authentication modules (PAM) on Unix-based systems, and authorization plugins on MacOS systems, responsible for gathering, storing, and validating credentials. By modifying an authentication process, an adversary may be able to authenticate to a service or system without using Valid Accounts.

Evidence: 2026-05-21/keycloak-26-6-2-16-cves-including-oidc-session-fixation-cve · ATT&CK page ↗

T1558.003Steal or Forge Kerberos Tickets: Kerberoasting×1

Adversaries may abuse a valid Kerberos ticket-granting ticket (TGT) or sniff network traffic to obtain a ticket-granting service (TGS) ticket that may be vulnerable to Brute Force.

Evidence: 2026-05-28/sans-isc-akira-ransomware-kill-chain-reconstructed-entirely · ATT&CK page ↗

Discovery TA0007

T1046Network Service Discovery×1

Adversaries may attempt to get a listing of services running on remote hosts and local network infrastructure devices, including those that may be vulnerable to remote software exploitation. Common methods to acquire this information include port, vulnerability, and/or wordlist scans using tools that are brought onto a system.

Evidence: 2026-06-30/bumblebee-adaptixc2-akira-a-full-seo-poisoning-to-ransomware · ATT&CK page ↗

Lateral Movement TA0008

T1021Remote Services×2

Adversaries may use Valid Accounts to log into a service that accepts remote connections, such as telnet, SSH, and VNC. The adversary may then perform actions as the logged-on user.

Evidence: 2026-06-30/bumblebee-adaptixc2-akira-a-full-seo-poisoning-to-ransomware · 2026-05-04/akira-playbook-quarterly-context-q1-2026-healthcare-concentr · ATT&CK page ↗

T1021.001Remote Services: Remote Desktop Protocol×3

Adversaries may use Valid Accounts to log into a computer using the Remote Desktop Protocol (RDP). The adversary may then perform actions as the logged-on user.

Evidence: 2026-06-30/bumblebee-adaptixc2-akira-a-full-seo-poisoning-to-ransomware · 2026-05-28/sans-isc-akira-ransomware-kill-chain-reconstructed-entirely · 2026-05-04/akira-playbook-quarterly-context-q1-2026-healthcare-concentr · ATT&CK page ↗

T1210Exploitation of Remote Services×1

Adversaries may exploit remote services to gain unauthorized access to internal systems once inside of a network. Exploitation of a software vulnerability occurs when an adversary takes advantage of a programming error in a program, service, or within the operating system software or kernel itself to execute adversary-controlled code. A common goal for post-compromise exploitation of remote services is for lateral movement to enable access to a remote system.

Evidence: 2026-06-10/cve-2026-44963-veeam-backup-replication-authenticated-domain · ATT&CK page ↗

Command and Control TA0011

T1219Remote Access Tools×2

An adversary may use legitimate remote access tools to establish an interactive command and control channel within a network. Remote access tools create a session between two trusted hosts through a graphical interface, a command line interaction, a protocol tunnel via development or management software, or hardware-level access such as KVM (Keyboard, Video, Mouse) over IP solutions. Desktop support software (usually graphical interface) and remote management software (typically command line interface) allow a user to control a computer remotely as if they are a local user inheriting the user or software permissions. This software is commonly used for troubleshooting, software installation, and system management. Adversaries may similarly abuse response features included in EDR and other defensive tools that enable remote access.

Evidence: 2026-06-30/bumblebee-adaptixc2-akira-a-full-seo-poisoning-to-ransomware · 2026-06-10/dragos-q1-2026-industrial-ransomware-analysis-1-020-industri · ATT&CK page ↗

Exfiltration TA0010

T1048Exfiltration Over Alternative Protocol×1

Adversaries may steal data by exfiltrating it over a different protocol than that of the existing command and control channel. The data may also be sent to an alternate network location from the main command and control server.

Evidence: 2026-06-30/bumblebee-adaptixc2-akira-a-full-seo-poisoning-to-ransomware · ATT&CK page ↗

T1567Exfiltration Over Web Service×4

Adversaries may use an existing, legitimate external Web service to exfiltrate data rather than their primary command and control channel. Popular Web services acting as an exfiltration mechanism may give a significant amount of cover due to the likelihood that hosts within a network are already communicating with them prior to compromise. Firewall rules may also already exist to permit traffic to these services.

Evidence: 2026-07-09/groupe-3r-akira-forensic-confirmation-darknet-publication · 2026-06-30/bumblebee-adaptixc2-akira-a-full-seo-poisoning-to-ransomware · 2026-05-10/groupe-3r-r-seau-radiologique-romand-akira-ransomware-claims · 2026-05-04/akira-ransomware-on-groupe-3r-20-swiss-medical-imaging-centr · ATT&CK page ↗

Impact TA0040

T1486Data Encrypted for Impact×7

Adversaries may encrypt data on target systems or on large numbers of systems in a network to interrupt availability to system and network resources. They can attempt to render stored data inaccessible by encrypting files or data on local and remote drives and withholding access to a decryption key. This may be done in order to extract monetary compensation from a victim in exchange for decryption or a decryption key (ransomware) or to render data permanently inaccessible in cases where the key is not saved or transmitted.

Evidence: 2026-07-09/groupe-3r-akira-forensic-confirmation-darknet-publication · 2026-06-30/bumblebee-adaptixc2-akira-a-full-seo-poisoning-to-ransomware · 2026-06-23/sonicwall-cve-2024-40766-why-patched-firewalls-keep-falling · 2026-06-10/dragos-q1-2026-industrial-ransomware-analysis-1-020-industri · 2026-06-10/cve-2026-44963-veeam-backup-replication-authenticated-domain · 2026-05-10/groupe-3r-r-seau-radiologique-romand-akira-ransomware-claims +1 more · ATT&CK page ↗

T1490Inhibit System Recovery×1

Adversaries may delete or remove built-in data and turn off services designed to aid in the recovery of a corrupted system to prevent recovery. This may deny access to available backups and recovery options.

Evidence: 2026-06-30/bumblebee-adaptixc2-akira-a-full-seo-poisoning-to-ransomware · ATT&CK page ↗

Story timeline

  1. 2026-07-12Healthcare across Switzerland and the UK saw ransomware confirmation, mailbox compromise and an insider-access clampdown this week
    weekly-sector-patternsHealthcare this week — Swiss radiology network confirms Akira attribution, Aargau psychiatric authority mailboxes phished, NHS England tightens insider access
  2. 2026-07-09Groupe 3R confirms Akira attribution and darknet publication of stolen data in its own forensic update
    updatesSwiss radiology network Groupe 3R confirms via its own forensics that Akira was behind its April attack and has published stolen data
  3. 2026-06-30Bumblebee → AdaptixC2 → Akira: a full SEO-poisoning-to-ransomware kill chain with a parallel Swiss intrusion
    deep-dive
  4. 2026-06-25"Mistic" backdoor: signed-Defender DLL sideloading and in-memory tradecraft by access broker Woodgnat/KongTuke
    active-threats
  5. 2026-06-23SonicWall CVE-2024-40766: why patched firewalls keep falling to Akira and Fog
    deep-dive
  6. 2026-06-22Check Point State of Ransomware Q1 2026 — ecosystem consolidation, with Switzerland and Germany named
    weekly-annual-reports
  7. 2026-06-10Dragos Q1 2026 Industrial Ransomware Analysis: 1,020 industrial incidents, The Gentleman's 4× surge against Romanian energy, and the IT-adjacent intrusion pattern
    deep-diveDragos Q1 2026 Industrial Ransomware Analysis: 1,020 industrial incidents, The Gentleman's 4× surge against Romanian energy, and the IT-adjacent intrusion
  8. 2026-06-10CVE-2026-44963 — Veeam Backup & Replication: authenticated domain-user deserialization RCE on the backup server (CVSS 9.4)
    trending-vulnerabilities
  9. 2026-05-28SANS ISC — Akira ransomware kill chain reconstructed entirely from SSLVPN syslog and Windows EVTX, no EDR
    research
  10. 2026-05-23Rapid7 Q1 2026 Threat Landscape Report: vulnerability exploitation now top initial-access vector at 38 %; KEV median time to listing collapses to 5 days
    research
  11. 2026-05-21SonicWall Gen6 SSL-VPN incomplete-patching (CVE-2024-12802) — Akira-linked actors brute-force MFA via UPN/SAM account-name split, February–March 2026 intrusions
    active-threats
  12. 2026-05-21Keycloak 26.6.2 — 16 CVEs including OIDC session fixation (CVE-2026-7507), WebAuthn execute-actions token replay (CVE-2026-37982), introspection audience bypass (CVE-2026-37979) and cross-realm IDOR in Authorization Services (CVE-2026-4630)
    trending-vulnerabilitiesKeycloak 26.6.2 — 16 CVEs including OIDC session fixation (CVE-2026-7507), WebAuthn execute-actions token replay (CVE-2026-37982), introspection audience
  13. 2026-05-20Microsoft DCU disrupts Fox Tempest malware-signing-as-a-service feeding Rhysida, INC, Qilin and Akira ransomware operations
    active-threats
  14. 2026-05-18SonicWall Gen6 SSL-VPN CVE-2024-12802 — Akira-linked actors bypassing MFA on *officially-patched* firmware
    weekly-top-stories
  15. 2026-05-18Fox Tempest — Microsoft DCU disrupts the malware-signing service feeding Rhysida, INC, Qilin and Akira
    weekly-long-running
  16. 2026-05-10Groupe 3R (Réseau Radiologique Romand) — Akira ransomware claims 48 GB; 20 imaging centres across seven Swiss cantons, second attack in twelve months
    active-threats
  17. 2026-05-04Mandiant M-Trends 2026
    weekly-annual-reports
  18. 2026-05-04Healthcare (CH, NL)
    weekly-sector-patterns
  19. 2026-05-04Akira ransomware — Swiss healthcare case confirmed; broader European playbook unchanged
    weekly-long-running
  20. 2026-05-04Akira ransomware on Groupe 3R — 20 Swiss medical-imaging centres across seven cantons; second cyberattack on the same operator within twelve months
    weekly-top-stories
  21. 2026-05-04Akira playbook quarterly context — Q1 2026 healthcare concentration; Qilin remains the dominant operator on German healthcare victims
    weekly-long-running

Relationships explore in graph

Typed, source-stated connections from the entity registry — each edge cites the entry whose reporting establishes it.

related to

attributed activity

Where this entity is cited

  • active-threats4
  • weekly-long-running3
  • deep-dive3
  • weekly-top-stories2
  • weekly-sector-patterns2
  • weekly-annual-reports2
  • trending-vulnerabilities2
  • research2
  • updates1

Source distribution

  • attack.mitre.org14 (28%)
  • ictjournal.ch2 (4%)
  • isc.sans.edu2 (4%)
  • swisscybersecurity.net2 (4%)
  • therecord.media2 (4%)
  • arcticwolf.com1 (2%)
  • bleepingcomputer.com1 (2%)
  • blick.ch1 (2%)
  • other25 (50%)

Co-occurring entities

Derived — referenced by the same focused operational entries (weekly summaries and report roundups don't count); ×N counts the shared entries.

All cited sources (50)

Entries about Akira (21)

2026-07-12 · view entry permalink →

NOTABLENATOB1

Healthcare across Switzerland and the UK saw ransomware confirmation, mailbox compromise and an insider-access clampdown this week

Healthcare surfaced three ways this week, and the value of reading them together is that they cover the sector's external, identity and internal threat surfaces in a single window.

Externally, Groupe 3R — the Réseau Radiologique Romand, a Western-Swiss radiology network — confirmed in its own forensic report that the Akira ransomware operation was responsible for the intrusion that had twice disrupted it, and that stolen data had been published on Akira's darknet leak site (SwissCybersecurity.net, 2026-05-07). On the identity surface, Psychiatrische Dienste Aargau (PDAG), a cantonal psychiatric authority, had email accounts phished and abused as a spam relay (SwissCybersecurity.net, 2026-07-09). Internally, NHS England issued new controls after staff were found inappropriately accessing high-profile patients' records, tying repeat "snooping" to dismissal and potential prosecution (NHS England, 2026-07-11).

Why this belongs to the constituency's healthcare lens: two of the three are Swiss (a Romand radiology provider and an Aargau cantonal authority), and the third is a transferable governance lesson for any large healthcare data controller. Healthcare's threat model is not just ransomware on clinical systems — it is equally the mailbox identity that attackers abuse and the legitimate-but-excessive internal access that no perimeter control addresses.

Builds on: 2026-07-09/groupe-3r-akira-forensic-confirmation-darknet-publication · 2026-07-11/nhs-england-insider-patient-record-access-controls · 2026-07-09/pdag-aargau-email-account-compromise-spam-relay

synthesis12 Jul 23:32Zmulti-sourceOpen finding ↗
Sources: SwissCybersecurity.net · NHS England

2026-07-09 · view entry permalink →

NOTABLEupdateNATOC2

Groupe 3R confirms Akira attribution and darknet publication of stolen data in its own forensic update

UPDATE · originally covered Groupe 3R (Réseau Radiologique Romand) — Akira ransomware claims 48 GB; 20 imaging centres across seven Swiss cantons, second attack in twelve months (2026-05-10)

Groupe 3R (Réseau Radiologique Romand), the network of 20 medical-imaging centres across seven Romandie cantons (Geneva, Vaud, Valais, Fribourg, Neuchâtel, Berne), has now confirmed through its own forensic investigation — not merely the attacker's leak-site claim — that the 30 April 2026 ransomware attack was carried out by Akira, and that stolen corporate and administrative documents have since been published on the darknet (SwissCybersecurity.net, 2026-07-07; ICTjournal.ch, 2026-07-06). This closes the attribution gap left open when Akira first listed the victim on 2026-05-08. The operator states medical data was encrypted (disrupting availability) but that no publication of medical data has been observed to date, while candidly acknowledging that whether medical data was also exfiltrated "may never be clarified with absolute certainty" — an unusually frank admission of incomplete forensic visibility that is itself the transferable lesson here.

Groupe 3R refused to pay the ransom, filed a criminal complaint with cantonal police on the attack date (forwarded to the Federal Public Prosecutor on 2026-05-12) and notified the Federal Office for Cybersecurity (BACS). As of this update all 20 centres are running on rebuilt, ISO-27001-partner infrastructure (RIS, PACS, telephony and teleradiology restored) but the referring-physician portal remained in security testing before redeployment — over two months post-incident. The activity is consistent with Akira's documented playbook: T1486 Data Encrypted for Impact (medical-data encryption), T1567 Exfiltration Over Web Service (darknet publication), typically preceded by edge-device / external-remote-service initial access.

incident09 Jul 12:25Zsingle-source · victim disclosureOpen finding ↗
Sources: SwissCybersecurity.net · ICTjournal.ch

2026-06-30 · view entry permalink →

NOTABLE

Bumblebee → AdaptixC2 → Akira: a full SEO-poisoning-to-ransomware kill chain with a parallel Swiss intrusion

The DFIR Report published (2026-06-29) the full reconstruction of an intrusion that began with SEO poisoning and ended in Akira ransomware in under three days. The report notes the case was first shared in a 2025 threat brief and flash alert produced with Swisscom B2B CSIRT, which observed a parallel intrusion tied to the same campaign — a Swiss-nexus thread (from that 2025 collaboration) that makes the now-public full reconstruction worth the day's deep dive (The DFIR Report, 2026-06-29). It also features the open-source AdaptixC2 post-exploitation framework as the Cobalt-Strike-equivalent in an Akira chain. Akira itself was deep-dived on 2026-06-23 via the SonicWall vector; this is a distinct initial-access path against the same end-stage operator.

Initial access and loader. A poisoned Bing result for "ManageEngine OpManager" led to a trojanized MSI installer (T1608.006 SEO poisoning → T1204.002 Malicious File). The Bumblebee loader established first C2 via DLL search-order hijacking (T1574.001) — a legitimate signed binary loading a same-directory msimg32.dll through consent.exe. Within ~5 hours, AdaptixC2 shellcode was injected into a renamed legitimate Windows Address Book utility, giving persistent interactive C2.

Escalation, discovery, lateral movement. The actor created domain accounts with Enterprise Admin privileges using RSAT (T1136.002 Create Account: Domain Account), enumerated the network with SoftPerfect Network Scanner, Zenmap, and RVTools (T1046), and moved laterally over RDP (T1021.001). A legitimate RustDesk remote-access tool was installed as a redundant access channel (T1219 Remote Access Software).

Credential access and collection. Credentials were harvested by extracting NTDS.dit via wbadmin.exe (T1003.003) and by dumping the Veeam backup database — the latter a recurring Akira-affiliate move that doubles as recovery sabotage. Roughly 77 GB was staged and exfiltrated over ~44 hours via FileZilla/SFTP to an external server (T1048/T1567).

Impact. Akira ransomware (T1486) was deployed across root and child domains over WMI (T1047), with shadow copies deleted via vssadmin (T1490 Inhibit System Recovery).

Detection concepts (no IOCs). Per stage: Sysmon EID 1 for a signed binary / consent.exe side-loading msimg32.dll from a user-writable path; EID 11 for new executables written into AppData; EID 4104 for PowerShell carrying credential-access tradecraft; EID 4663 on NTDS.dit handle access; WMI-driven remote process creation (EID 4648 plus network logon type 3) from non-admin hosts; EID 4698 scheduled-task creation from unusual parents; and DLP/file-server alerts on large outbound SFTP staging. Treat any RustDesk install you did not deploy as a finding.

Hardening. Category-block software-download SEO traps at the SWG and require signed, hash-verified installers for IT-admin tooling; constrain who can create domain accounts and alert on new Enterprise Admin members; protect NTDS.dit / enable Credential Guard; restrict remote WMI to tiered admin hosts; harden Veeam service-account credentials and isolate the backup plane; and alert on unsanctioned remote-access tools (RustDesk/AnyDesk) at the proxy and EDR.

threat30 Jun 05:10Zsingle-sourceOpen finding ↗
Sources: The DFIR Report

Earlier coverage (18)

2026-06-25HIGH"Mistic" backdoor: signed-Defender DLL sideloading and in-memory tradecraft by access broker Woodgnat/KongTukeTwo new initial-access-broker toolsets surface — Mistic and Edgecution — Symantec details Mistic, sideloaded via a signed Microsoft Defender binary so its activity reads as legitimate Defender behaviour (Symantec, 2026-06-24); Zscaler details Edgecution, a malicious Edge extension that bridges the browser sandbox to a host Python backdoor via the Native Messaging API (today's deep dive) (Zscaler, 2026-06-23).2026-06-23HIGHexploitedSonicWall CVE-2024-40766: why patched firewalls keep falling to Akira and FogSonicWall firewalls that were patched against CVE-2024-40766 are still being breached by Akira and Fog ransomware within hours — because the patch leaves behind the stale local accounts, implicit-VPN LDAP default groups, and un-enforced SSLVPN MFA that the intrusions actually ride. A fresh SANS ISC write-up names the exact residual misconfigurations to remediate post-patch (SANS ISC, 2026-06-23). Today's deep dive — § 5.2026-06-22NOTABLECheck Point State of Ransomware Q1 2026 — ecosystem consolidation, with Switzerland and Germany namedSurfaced this week for its CH/EU-specific findings, Check Point's Q1 2026 ransomware report (published 11 May, not covered in the dailies) documents a structural consolidation: the top 10 groups now hold 71.1% of all leak-site victims, the highest concentration since early 2024 and a reversal of two years of …2026-06-10NOTABLEDragos Q1 2026 Industrial Ransomware Analysis: 1,020 industrial incidents, The Gentleman's 4× surge against Romanian energy, and the IT-adjacent intrusion patternDragos' quarterly industrial-ransomware report (published 3 June) is the single periodic landscape report treated in this brief; the focus below is only on what changes a Swiss/EU public-sector and critical-infrastructure SOC's posture, not the full survey (Dragos, 2026-06-03).2026-06-10NOTABLECVE-2026-44963 — Veeam Backup & Replication: authenticated domain-user deserialization RCE on the backup server (CVSS 9.4)Veeam patched CVE-2026-44963 (CVSS v4 9.4, CWE-502) on 9 June: any authenticated domain user — no elevated Veeam privilege required — can execute code on the Backup Server when it is domain-joined; workgroup servers are unaffected (Veeam, 2026-06-09).2026-05-28NOTABLESANS ISC — Akira ransomware kill chain reconstructed entirely from SSLVPN syslog and Windows EVTX, no EDRSANS ISC handler Manuel Humberto Santander Pelaez published a forensic walkthrough on 2026-05-27 reconstructing an Akira ransomware intrusion using only two log sources — SSLVPN syslog and Windows EVTX exports — joined by source IP and normalised time (SANS Internet Storm Center, 2026-05-27). [SINGLE-SOURCE] …2026-05-23NOTABLERapid7 Q1 2026 Threat Landscape Report: vulnerability exploitation now top initial-access vector at 38 %; KEV median time to listing collapses to 5 daysRapid7 Labs published its Q1 2026 Threat Landscape Report on 2026-05-21 covering January–March 2026 IR data; the GlobeNewswire release accompanied the post the same day. The findings that change what a Swiss/EU public-sector SOC should prioritise:2026-05-21NOTABLEKeycloak 26.6.2 — 16 CVEs including OIDC session fixation (CVE-2026-7507), WebAuthn execute-actions token replay (CVE-2026-37982), introspection audience bypass (CVE-2026-37979) and cross-realm IDOR in Authorization Services (CVE-2026-4630)The Keycloak project shipped 26.6.2 on 2026-05-19, fixing 16 CVEs across identity, authentication and authorisation subsystems; BSI's CERT-Bund issued advisory WID-SEC-2026-1612 on 2026-05-20 classifying the batch as HIGH risk (Keycloak Project, 2026-05-19; BSI CERT-Bund, 2026-05-20).2026-05-21NOTABLEexploitedSonicWall Gen6 SSL-VPN incomplete-patching (CVE-2024-12802) — Akira-linked actors brute-force MFA via UPN/SAM account-name split, February–March 2026 intrusionsThreat actors whose TTPs are consistent with Akira ransomware activity successfully bypassed MFA on SonicWall Gen6 SSL-VPN appliances running officially-patched firmware between February and March 2026; SonicWall and incident-response vendors confirm the root cause is that the firmware update for CVE-2024-12802 (CVSS …2026-05-20HIGHMicrosoft DCU disrupts Fox Tempest malware-signing-as-a-service feeding Rhysida, INC, Qilin and Akira ransomware operationsMicrosoft Digital Crimes Unit disrupts Fox Tempest malware-signing-as-a-service. 1,000+ fraudulent short-lived Microsoft Artifact Signing certificates revoked; signspace[.]cloud seized via SDNY court order. Downstream customers include Vanilla Tempest (Rhysida), Storm-0501, Storm-2561, Storm-0249; ransomware families served include Rhysida, INC, Qilin, Akira (Microsoft Threat Intelligence, 2026-05-19). Detection: hunt for Microsoft-signed PE binaries with cert validity ≤72h from Trusted Signing issuers.2026-05-18NOTABLEFox Tempest — Microsoft DCU disrupts the malware-signing service feeding Rhysida, INC, Qilin and AkiraMicrosoft Threat Intelligence and the Digital Crimes Unit disrupted Fox Tempest, a malware-signing-as-a-service operation that supplied code-signing to multiple ransomware operations (daily 2026-05-20). Status: disrupted via combined intelligence exposure and a sealed US legal action.2026-05-18NOTABLEexploitedSonicWall Gen6 SSL-VPN CVE-2024-12802 — Akira-linked actors bypassing MFA on *officially-patched* firmwareIf you did nothing this week: patching alone did not close this.2026-05-10HIGHGroupe 3R (Réseau Radiologique Romand) — Akira ransomware claims 48 GB; 20 imaging centres across seven Swiss cantons, second attack in twelve monthsGroupe 3R (Réseau Radiologique Romand) listed by Akira on its leak site as a 48 GB victim — 20 medical-imaging centres across seven Romandie cantons (Geneva, Vaud, Valais, Fribourg, Neuchâtel, Berne and a seventh), patient records and employee identity documents in scope. Victim disclosed the attack on 2026-04-30 via its own site, notified BACS/OFCS, filed criminal complaint, and stated it will not pay ransom. Second cyberattack on the same Swiss imaging operator within twelve months.2026-05-04NOTABLEAkira playbook quarterly context — Q1 2026 healthcare concentration; Qilin remains the dominant operator on German healthcare victimsW1 horizon research added Q1 2026 healthcare quarterly context to the Groupe 3R item in § 1.2026-05-04NOTABLEAkira ransomware — Swiss healthcare case confirmed; broader European playbook unchangedCurrent state: Akira's leak-site listing on Groupe 3R (§ 1) is the operationally specific Swiss-healthcare development this week.2026-05-04NOTABLEMandiant M-Trends 2026M-Trends 2026 (published 2026-03-23, first covered 2026-05-07) reinforces three cross-cutting trends visible in this week's incidents: voice phishing surged to the second most prevalent initial-access vector at 11% (overtaking email phishing at 6%) driven by IT help-desk impersonation and SaaS OAuth token theft …2026-05-04NOTABLEHealthcare (CH, NL)Two healthcare incidents define the sector picture this week, both with European public-sector concentration. Groupe 3R (Switzerland) — Akira leak-site listing on a Romandie medical-imaging operator running 20 centres across seven cantons; the operator confirmed publicly on 2026-04-30, will not pay ransom, and is …2026-05-04HIGHAkira ransomware on Groupe 3R — 20 Swiss medical-imaging centres across seven cantons; second cyberattack on the same operator within twelve monthsGroupe 3R (Réseau Radiologique Romand) — Akira leak-site listing claims 48 GB; ~20 imaging centres across seven Swiss cantons (Vaud, Valais, Fribourg, Genève, Neuchâtel, Berne, and Zürich) — six in Romandie plus Zürich; second cyberattack on the same Swiss operator within twelve months. Victim disclosed publicly 2026-04-30, notified BACS/OFCS, filed criminal complaint, will not pay ransom; legacy examination data still inaccessible. (Groupe 3R victim statement · ICTjournal.ch · daily 2026-05-10)