ctipilot.ch

Akira

actor · actor:akira single-sourcesingle-source-victim

Akira — ransomware operator targeting EU healthcare and SME via edge-device CVE chains and intermittent-encryption EDR evasion

Coverage timeline
26
first 2026-05-04 → last 2026-08-17
Peak priority
high
6 high · 20 notable
Sources cited
61
40 hosts
Sections touched
9
active-threats, deep-dive, research
Co-occurring entities
8
see Related entities below
ATT&CK techniques
40
pinned v19.2 · see below
2026-05-0426 appearances2026-08-17

Hunting pivots

ATT&CK techniques
T1486 ×3T1078 ×2T1133 ×2T1567.002 ×2T1018T1021.001T1027T1059.001T1059.004T1087.002T1110.003T1112T1140T1190T1219T1490T1560.001T1587.001T1688
Affected products
Microsoft WindowsSonicWall SSL VPNVMware ESXi
Tags
ransomware ×25organized-crime ×13data-breach ×8identity ×8vulnerabilities ×6actively-exploited ×4auth-bypass ×4law-enforcement ×3infostealer ×2nation-state ×2ot-ics ×2patch-available ×2supply-chain ×2ai-abusecloudespionage

ATT&CK techniques

40 techniques observed across 15 entries — derived from entry metadata and body evidence, never asserted without a published entry behind it · pinned to MITRE ATT&CK v19.2 · compare on the matrix · Navigator layer (JSON)

Resource Development TA0042

T1587.001Develop Capabilities: Malware×1

Adversaries may develop malware and malware components that can be used during targeting. Building malicious software can include the development of payloads, droppers, post-compromise tools, backdoors (including backdoored images), packers, C2 protocols, and the creation of infected removable media. Adversaries may develop malware to support their operations, creating a means for maintaining control of remote machines, evading defenses, and executing post-compromise behaviors.

Evidence: 2026-07-19/weekly-w29-thegentlemen-storm2697-status · ATT&CK page ↗

T1608.006Stage Capabilities: SEO Poisoning×1

Adversaries may poison mechanisms that influence search engine optimization (SEO) to further lure staged capabilities towards potential victims. Search engines typically display results to users based on purchased ads as well as the site’s ranking/score/reputation calculated by their web crawlers and algorithms.

Evidence: 2026-06-30/bumblebee-adaptixc2-akira-a-full-seo-poisoning-to-ransomware · ATT&CK page ↗

Initial Access TA0001

T1078Valid Accounts×5

Adversaries may obtain and abuse credentials of existing accounts as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Compromised credentials may be used to bypass access controls placed on various resources on systems within the network and may even be used for persistent access to remote systems and externally available services, such as VPNs, Outlook Web Access, network devices, and remote desktop. Compromised credentials may also grant an adversary increased privilege to specific systems or access to restricted areas of the network. Adversaries may choose not to use malware or tools in conjunction with the legitimate access those credentials provide to make it harder to detect their presence.

Evidence: 2026-08-17/akira-safe-mode-boot-edr-blinding-sonicwall-vpn · 2026-08-16/weekly-w33-q2-ransomware-reports-dragos-checkpoint · 2026-06-23/sonicwall-cve-2024-40766-why-patched-firewalls-keep-falling · 2026-06-10/dragos-q1-2026-industrial-ransomware-analysis-1-020-industri · 2026-05-21/keycloak-26-6-2-16-cves-including-oidc-session-fixation-cve · ATT&CK page ↗

T1078.001Valid Accounts: Default Accounts×1

Adversaries may obtain and abuse credentials of a default account as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Default accounts are those that are built-into an OS, such as the Guest or Administrator accounts on Windows systems. Default accounts also include default factory/provider set accounts on other types of systems, software, or devices, including the root user account in AWS, the root user account in ESXi, and the default service account in Kubernetes.

Evidence: 2026-05-28/sans-isc-akira-ransomware-kill-chain-reconstructed-entirely · ATT&CK page ↗

T1078.002Valid Accounts: Domain Accounts×1

Adversaries may obtain and abuse credentials of a domain account as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Domain accounts are those managed by Active Directory Domain Services where access and permissions are configured across systems and services that are part of that domain. Domain accounts can cover users, administrators, and services.

Evidence: 2026-06-23/sonicwall-cve-2024-40766-why-patched-firewalls-keep-falling · ATT&CK page ↗

T1133External Remote Services×7

Adversaries may leverage external-facing remote services to initially access and/or persist within a network. Remote services such as VPNs, Citrix, and other access mechanisms allow users to connect to internal enterprise network resources from external locations. There are often remote service gateways that manage connections and credential authentication for these services. Services such as Windows Remote Management and VNC can also be used externally.

Evidence: 2026-08-17/akira-safe-mode-boot-edr-blinding-sonicwall-vpn · 2026-08-16/weekly-w33-q2-ransomware-reports-dragos-checkpoint · 2026-06-23/sonicwall-cve-2024-40766-why-patched-firewalls-keep-falling · 2026-06-10/dragos-q1-2026-industrial-ransomware-analysis-1-020-industri · 2026-05-28/sans-isc-akira-ransomware-kill-chain-reconstructed-entirely · 2026-05-10/groupe-3r-r-seau-radiologique-romand-akira-ransomware-claims +1 more · ATT&CK page ↗

T1190Exploit Public-Facing Application×3

Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network. The weakness in the system can be a software bug, a temporary glitch, or a misconfiguration.

Evidence: 2026-07-19/weekly-w29-thegentlemen-storm2697-status · 2026-05-10/groupe-3r-r-seau-radiologique-romand-akira-ransomware-claims · 2026-05-04/akira-ransomware-on-groupe-3r-20-swiss-medical-imaging-centr · ATT&CK page ↗

Execution TA0002

T1047Windows Management Instrumentation×2

Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is designed for programmers and is the infrastructure for management data and operations on Windows systems. WMI is an administration feature that provides a uniform environment to access Windows system components.

Evidence: 2026-06-30/bumblebee-adaptixc2-akira-a-full-seo-poisoning-to-ransomware · 2026-05-04/akira-playbook-quarterly-context-q1-2026-healthcare-concentr · ATT&CK page ↗

T1059.001Command and Scripting Interpreter: PowerShell×1

Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system. Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the <code>Start-Process</code> cmdlet which can be used to run an executable and the <code>Invoke-Command</code> cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).

Evidence: 2026-08-17/akira-safe-mode-boot-edr-blinding-sonicwall-vpn · ATT&CK page ↗

T1059.004Command and Scripting Interpreter: Unix Shell×1

Adversaries may abuse Unix shell commands and scripts for execution. Unix shells are the primary command prompt on Linux, macOS, and ESXi systems, though many variations of the Unix shell exist (e.g. sh, ash, bash, zsh, etc.) depending on the specific OS or distribution. Unix shells can control every aspect of a system, with certain commands requiring elevated privileges.

Evidence: 2026-08-10/esxi-busybox-ash-command-obfuscation-21-techniques · ATT&CK page ↗

T1204User Execution×1

An adversary may rely upon specific actions by a user in order to gain execution. Users may be subjected to social engineering to get them to execute malicious code by, for example, opening a malicious document file or link. These user actions will typically be observed as follow-on behavior from forms of Phishing.

Evidence: 2026-06-30/bumblebee-adaptixc2-akira-a-full-seo-poisoning-to-ransomware · ATT&CK page ↗

T1204.002User Execution: Malicious File×1

An adversary may rely upon a user opening a malicious file in order to gain execution. Users may be subjected to social engineering to get them to open a file that will lead to code execution. This user action will typically be observed as follow-on behavior from Spearphishing Attachment. Adversaries may use several types of files that require a user to execute them, including .doc, .pdf, .xls, .rtf, .scr, .exe, .lnk, .pif, .cpl, .reg, and .iso.

Evidence: 2026-06-30/bumblebee-adaptixc2-akira-a-full-seo-poisoning-to-ransomware · ATT&CK page ↗

T1574Hijack Execution Flow×1

Adversaries may execute their own malicious payloads by hijacking the way operating systems run programs. Hijacking execution flow can be for the purposes of persistence, since this hijacked execution may reoccur over time. Adversaries may also use these mechanisms to elevate privileges or evade defenses, such as application control or other restrictions on execution.

Evidence: 2026-06-30/bumblebee-adaptixc2-akira-a-full-seo-poisoning-to-ransomware · ATT&CK page ↗

T1574.001Hijack Execution Flow: DLL×2

Adversaries may abuse dynamic-link library files (DLLs) in order to achieve persistence, escalate privileges, and evade defenses. DLLs are libraries that contain code and data that can be simultaneously utilized by multiple programs. While DLLs are not malicious by nature, they can be abused through mechanisms such as side-loading, hijacking search order, and phantom DLL hijacking.

Evidence: 2026-06-30/bumblebee-adaptixc2-akira-a-full-seo-poisoning-to-ransomware · 2026-06-25/mistic-backdoor-signed-defender-dll-sideloading-and-in-memor · ATT&CK page ↗

Persistence TA0003

T1078Valid Accounts×5

Adversaries may obtain and abuse credentials of existing accounts as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Compromised credentials may be used to bypass access controls placed on various resources on systems within the network and may even be used for persistent access to remote systems and externally available services, such as VPNs, Outlook Web Access, network devices, and remote desktop. Compromised credentials may also grant an adversary increased privilege to specific systems or access to restricted areas of the network. Adversaries may choose not to use malware or tools in conjunction with the legitimate access those credentials provide to make it harder to detect their presence.

Evidence: 2026-08-17/akira-safe-mode-boot-edr-blinding-sonicwall-vpn · 2026-08-16/weekly-w33-q2-ransomware-reports-dragos-checkpoint · 2026-06-23/sonicwall-cve-2024-40766-why-patched-firewalls-keep-falling · 2026-06-10/dragos-q1-2026-industrial-ransomware-analysis-1-020-industri · 2026-05-21/keycloak-26-6-2-16-cves-including-oidc-session-fixation-cve · ATT&CK page ↗

T1078.001Valid Accounts: Default Accounts×1

Adversaries may obtain and abuse credentials of a default account as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Default accounts are those that are built-into an OS, such as the Guest or Administrator accounts on Windows systems. Default accounts also include default factory/provider set accounts on other types of systems, software, or devices, including the root user account in AWS, the root user account in ESXi, and the default service account in Kubernetes.

Evidence: 2026-05-28/sans-isc-akira-ransomware-kill-chain-reconstructed-entirely · ATT&CK page ↗

T1078.002Valid Accounts: Domain Accounts×1

Adversaries may obtain and abuse credentials of a domain account as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Domain accounts are those managed by Active Directory Domain Services where access and permissions are configured across systems and services that are part of that domain. Domain accounts can cover users, administrators, and services.

Evidence: 2026-06-23/sonicwall-cve-2024-40766-why-patched-firewalls-keep-falling · ATT&CK page ↗

T1098.005Account Manipulation: Device Registration×1

Adversaries may register a device to an adversary-controlled account. Devices may be registered in a multifactor authentication (MFA) system, which handles authentication to the network, or in a device management system, which handles device access and compliance.

Evidence: 2026-05-21/keycloak-26-6-2-16-cves-including-oidc-session-fixation-cve · ATT&CK page ↗

T1112Modify Registry×1

Adversaries may interact with the Windows Registry as part of a variety of other techniques to aid in defense evasion, persistence, and execution.

Evidence: 2026-08-17/akira-safe-mode-boot-edr-blinding-sonicwall-vpn · ATT&CK page ↗

T1133External Remote Services×7

Adversaries may leverage external-facing remote services to initially access and/or persist within a network. Remote services such as VPNs, Citrix, and other access mechanisms allow users to connect to internal enterprise network resources from external locations. There are often remote service gateways that manage connections and credential authentication for these services. Services such as Windows Remote Management and VNC can also be used externally.

Evidence: 2026-08-17/akira-safe-mode-boot-edr-blinding-sonicwall-vpn · 2026-08-16/weekly-w33-q2-ransomware-reports-dragos-checkpoint · 2026-06-23/sonicwall-cve-2024-40766-why-patched-firewalls-keep-falling · 2026-06-10/dragos-q1-2026-industrial-ransomware-analysis-1-020-industri · 2026-05-28/sans-isc-akira-ransomware-kill-chain-reconstructed-entirely · 2026-05-10/groupe-3r-r-seau-radiologique-romand-akira-ransomware-claims +1 more · ATT&CK page ↗

T1136Create Account×1

Adversaries may create an account to maintain access to victim systems. With a sufficient level of access, creating such accounts may be used to establish secondary credentialed access that do not require persistent remote access tools to be deployed on the system.

Evidence: 2026-06-30/bumblebee-adaptixc2-akira-a-full-seo-poisoning-to-ransomware · ATT&CK page ↗

T1136.002Create Account: Domain Account×1

Adversaries may create a domain account to maintain access to victim systems. Domain accounts are those managed by Active Directory Domain Services where access and permissions are configured across systems and services that are part of that domain. Domain accounts can cover user, administrator, and service accounts. With a sufficient level of access, the <code>net user /add /domain</code> command can be used to create a domain account.

Evidence: 2026-06-30/bumblebee-adaptixc2-akira-a-full-seo-poisoning-to-ransomware · ATT&CK page ↗

T1556Modify Authentication Process×1

Adversaries may modify authentication mechanisms and processes to access user credentials or enable otherwise unwarranted access to accounts. The authentication process is handled by mechanisms, such as the Local Security Authentication Server (LSASS) process and the Security Accounts Manager (SAM) on Windows, pluggable authentication modules (PAM) on Unix-based systems, and authorization plugins on MacOS systems, responsible for gathering, storing, and validating credentials. By modifying an authentication process, an adversary may be able to authenticate to a service or system without using Valid Accounts.

Evidence: 2026-05-21/keycloak-26-6-2-16-cves-including-oidc-session-fixation-cve · ATT&CK page ↗

Privilege Escalation TA0004

T1078Valid Accounts×5

Adversaries may obtain and abuse credentials of existing accounts as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Compromised credentials may be used to bypass access controls placed on various resources on systems within the network and may even be used for persistent access to remote systems and externally available services, such as VPNs, Outlook Web Access, network devices, and remote desktop. Compromised credentials may also grant an adversary increased privilege to specific systems or access to restricted areas of the network. Adversaries may choose not to use malware or tools in conjunction with the legitimate access those credentials provide to make it harder to detect their presence.

Evidence: 2026-08-17/akira-safe-mode-boot-edr-blinding-sonicwall-vpn · 2026-08-16/weekly-w33-q2-ransomware-reports-dragos-checkpoint · 2026-06-23/sonicwall-cve-2024-40766-why-patched-firewalls-keep-falling · 2026-06-10/dragos-q1-2026-industrial-ransomware-analysis-1-020-industri · 2026-05-21/keycloak-26-6-2-16-cves-including-oidc-session-fixation-cve · ATT&CK page ↗

T1078.001Valid Accounts: Default Accounts×1

Adversaries may obtain and abuse credentials of a default account as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Default accounts are those that are built-into an OS, such as the Guest or Administrator accounts on Windows systems. Default accounts also include default factory/provider set accounts on other types of systems, software, or devices, including the root user account in AWS, the root user account in ESXi, and the default service account in Kubernetes.

Evidence: 2026-05-28/sans-isc-akira-ransomware-kill-chain-reconstructed-entirely · ATT&CK page ↗

T1078.002Valid Accounts: Domain Accounts×1

Adversaries may obtain and abuse credentials of a domain account as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Domain accounts are those managed by Active Directory Domain Services where access and permissions are configured across systems and services that are part of that domain. Domain accounts can cover users, administrators, and services.

Evidence: 2026-06-23/sonicwall-cve-2024-40766-why-patched-firewalls-keep-falling · ATT&CK page ↗

T1098.005Account Manipulation: Device Registration×1

Adversaries may register a device to an adversary-controlled account. Devices may be registered in a multifactor authentication (MFA) system, which handles authentication to the network, or in a device management system, which handles device access and compliance.

Evidence: 2026-05-21/keycloak-26-6-2-16-cves-including-oidc-session-fixation-cve · ATT&CK page ↗

Stealth TA0005

T1027Obfuscated Files or Information×1

Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.

Evidence: 2026-08-10/esxi-busybox-ash-command-obfuscation-21-techniques · ATT&CK page ↗

T1036.005Masquerading: Match Legitimate Resource Name or Location×1

Adversaries may match or approximate the name or location of legitimate files, Registry keys, or other resources when naming/placing them. This is done for the sake of evading defenses and observation.

Evidence: 2026-06-25/mistic-backdoor-signed-defender-dll-sideloading-and-in-memor · ATT&CK page ↗

T1078Valid Accounts×5

Adversaries may obtain and abuse credentials of existing accounts as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Compromised credentials may be used to bypass access controls placed on various resources on systems within the network and may even be used for persistent access to remote systems and externally available services, such as VPNs, Outlook Web Access, network devices, and remote desktop. Compromised credentials may also grant an adversary increased privilege to specific systems or access to restricted areas of the network. Adversaries may choose not to use malware or tools in conjunction with the legitimate access those credentials provide to make it harder to detect their presence.

Evidence: 2026-08-17/akira-safe-mode-boot-edr-blinding-sonicwall-vpn · 2026-08-16/weekly-w33-q2-ransomware-reports-dragos-checkpoint · 2026-06-23/sonicwall-cve-2024-40766-why-patched-firewalls-keep-falling · 2026-06-10/dragos-q1-2026-industrial-ransomware-analysis-1-020-industri · 2026-05-21/keycloak-26-6-2-16-cves-including-oidc-session-fixation-cve · ATT&CK page ↗

T1078.001Valid Accounts: Default Accounts×1

Adversaries may obtain and abuse credentials of a default account as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Default accounts are those that are built-into an OS, such as the Guest or Administrator accounts on Windows systems. Default accounts also include default factory/provider set accounts on other types of systems, software, or devices, including the root user account in AWS, the root user account in ESXi, and the default service account in Kubernetes.

Evidence: 2026-05-28/sans-isc-akira-ransomware-kill-chain-reconstructed-entirely · ATT&CK page ↗

T1078.002Valid Accounts: Domain Accounts×1

Adversaries may obtain and abuse credentials of a domain account as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Domain accounts are those managed by Active Directory Domain Services where access and permissions are configured across systems and services that are part of that domain. Domain accounts can cover users, administrators, and services.

Evidence: 2026-06-23/sonicwall-cve-2024-40766-why-patched-firewalls-keep-falling · ATT&CK page ↗

T1140Deobfuscate/Decode Files or Information×1

Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.

Evidence: 2026-08-10/esxi-busybox-ash-command-obfuscation-21-techniques · ATT&CK page ↗

T1574Hijack Execution Flow×1

Adversaries may execute their own malicious payloads by hijacking the way operating systems run programs. Hijacking execution flow can be for the purposes of persistence, since this hijacked execution may reoccur over time. Adversaries may also use these mechanisms to elevate privileges or evade defenses, such as application control or other restrictions on execution.

Evidence: 2026-06-30/bumblebee-adaptixc2-akira-a-full-seo-poisoning-to-ransomware · ATT&CK page ↗

T1574.001Hijack Execution Flow: DLL×2

Adversaries may abuse dynamic-link library files (DLLs) in order to achieve persistence, escalate privileges, and evade defenses. DLLs are libraries that contain code and data that can be simultaneously utilized by multiple programs. While DLLs are not malicious by nature, they can be abused through mechanisms such as side-loading, hijacking search order, and phantom DLL hijacking.

Evidence: 2026-06-30/bumblebee-adaptixc2-akira-a-full-seo-poisoning-to-ransomware · 2026-06-25/mistic-backdoor-signed-defender-dll-sideloading-and-in-memor · ATT&CK page ↗

Defense Impairment TA0112

T1112Modify Registry×1

Adversaries may interact with the Windows Registry as part of a variety of other techniques to aid in defense evasion, persistence, and execution.

Evidence: 2026-08-17/akira-safe-mode-boot-edr-blinding-sonicwall-vpn · ATT&CK page ↗

T1556Modify Authentication Process×1

Adversaries may modify authentication mechanisms and processes to access user credentials or enable otherwise unwarranted access to accounts. The authentication process is handled by mechanisms, such as the Local Security Authentication Server (LSASS) process and the Security Accounts Manager (SAM) on Windows, pluggable authentication modules (PAM) on Unix-based systems, and authorization plugins on MacOS systems, responsible for gathering, storing, and validating credentials. By modifying an authentication process, an adversary may be able to authenticate to a service or system without using Valid Accounts.

Evidence: 2026-05-21/keycloak-26-6-2-16-cves-including-oidc-session-fixation-cve · ATT&CK page ↗

T1688Safe Mode Boot×1

Adversaries may abuse Windows safe mode to disable endpoint defenses. Safe mode starts up the Windows operating system with a limited set of drivers and services. Third-party security software such as endpoint detection and response (EDR) tools may not start after booting Windows in safe mode. There are two versions of safe mode: Safe Mode and Safe Mode with Networking. It is possible to start additional services after a safe mode boot.

Evidence: 2026-08-17/akira-safe-mode-boot-edr-blinding-sonicwall-vpn · ATT&CK page ↗

Credential Access TA0006

T1003OS Credential Dumping×1

Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password. Credentials can be obtained from OS caches, memory, or structures. Credentials can then be used to perform Lateral Movement and access restricted information.

Evidence: 2026-06-30/bumblebee-adaptixc2-akira-a-full-seo-poisoning-to-ransomware · ATT&CK page ↗

T1003.003OS Credential Dumping: NTDS×1

Adversaries may attempt to access or create a copy of the Active Directory domain database in order to steal credential information, as well as obtain other information about domain members such as devices, users, and access rights. By default, the NTDS file (NTDS.dit) is located in <code>%SystemRoot%\NTDS\Ntds.dit</code> of a domain controller.

Evidence: 2026-06-30/bumblebee-adaptixc2-akira-a-full-seo-poisoning-to-ransomware · ATT&CK page ↗

T1110.003Brute Force: Password Spraying×1

Adversaries may use a single or small list of commonly used passwords against many different accounts to attempt to acquire valid account credentials. Password spraying uses one password (e.g. 'Password01'), or a small list of commonly used passwords, that may match the complexity policy of the domain. Logins are attempted with that password against many different accounts on a network to avoid account lockouts that would normally occur when brute forcing a single account with many passwords.

Evidence: 2026-08-17/akira-safe-mode-boot-edr-blinding-sonicwall-vpn · ATT&CK page ↗

T1556Modify Authentication Process×1

Adversaries may modify authentication mechanisms and processes to access user credentials or enable otherwise unwarranted access to accounts. The authentication process is handled by mechanisms, such as the Local Security Authentication Server (LSASS) process and the Security Accounts Manager (SAM) on Windows, pluggable authentication modules (PAM) on Unix-based systems, and authorization plugins on MacOS systems, responsible for gathering, storing, and validating credentials. By modifying an authentication process, an adversary may be able to authenticate to a service or system without using Valid Accounts.

Evidence: 2026-05-21/keycloak-26-6-2-16-cves-including-oidc-session-fixation-cve · ATT&CK page ↗

T1558.003Steal or Forge Kerberos Tickets: Kerberoasting×1

Adversaries may abuse a valid Kerberos ticket-granting ticket (TGT) or sniff network traffic to obtain a ticket-granting service (TGS) ticket that may be vulnerable to Brute Force.

Evidence: 2026-05-28/sans-isc-akira-ransomware-kill-chain-reconstructed-entirely · ATT&CK page ↗

Discovery TA0007

T1018Remote System Discovery×1

Adversaries may attempt to get a listing of other systems by IP address, hostname, or other logical identifier on a network that may be used for Lateral Movement from the current system. Functionality could exist within remote access tools to enable this, but utilities available on the operating system could also be used such as Ping, <code>net view</code> using Net, or, on ESXi servers, `esxcli network diag ping`.

Evidence: 2026-08-17/akira-safe-mode-boot-edr-blinding-sonicwall-vpn · ATT&CK page ↗

T1046Network Service Discovery×1

Adversaries may attempt to get a listing of services running on remote hosts and local network infrastructure devices, including those that may be vulnerable to remote software exploitation. Common methods to acquire this information include port, vulnerability, and/or wordlist scans using tools that are brought onto a system.

Evidence: 2026-06-30/bumblebee-adaptixc2-akira-a-full-seo-poisoning-to-ransomware · ATT&CK page ↗

T1087.002Account Discovery: Domain Account×1

Adversaries may attempt to get a listing of domain accounts. This information can help adversaries determine which domain accounts exist to aid in follow-on behavior such as targeting specific accounts which possess particular privileges.

Evidence: 2026-08-17/akira-safe-mode-boot-edr-blinding-sonicwall-vpn · ATT&CK page ↗

Lateral Movement TA0008

T1021Remote Services×2

Adversaries may use Valid Accounts to log into a service that accepts remote connections, such as telnet, SSH, and VNC. The adversary may then perform actions as the logged-on user.

Evidence: 2026-06-30/bumblebee-adaptixc2-akira-a-full-seo-poisoning-to-ransomware · 2026-05-04/akira-playbook-quarterly-context-q1-2026-healthcare-concentr · ATT&CK page ↗

T1021.001Remote Services: Remote Desktop Protocol×4

Adversaries may use Valid Accounts to log into a computer using the Remote Desktop Protocol (RDP). The adversary may then perform actions as the logged-on user.

Evidence: 2026-08-17/akira-safe-mode-boot-edr-blinding-sonicwall-vpn · 2026-06-30/bumblebee-adaptixc2-akira-a-full-seo-poisoning-to-ransomware · 2026-05-28/sans-isc-akira-ransomware-kill-chain-reconstructed-entirely · 2026-05-04/akira-playbook-quarterly-context-q1-2026-healthcare-concentr · ATT&CK page ↗

T1210Exploitation of Remote Services×1

Adversaries may exploit remote services to gain unauthorized access to internal systems once inside of a network. Exploitation of a software vulnerability occurs when an adversary takes advantage of a programming error in a program, service, or within the operating system software or kernel itself to execute adversary-controlled code. A common goal for post-compromise exploitation of remote services is for lateral movement to enable access to a remote system.

Evidence: 2026-06-10/cve-2026-44963-veeam-backup-replication-authenticated-domain · ATT&CK page ↗

Collection TA0009

T1560.001Archive Collected Data: Archive via Utility×1

Adversaries may use utilities to compress and/or encrypt collected data prior to exfiltration. Many utilities include functionalities to compress, encrypt, or otherwise package data into a format that is easier/more secure to transport.

Evidence: 2026-08-17/akira-safe-mode-boot-edr-blinding-sonicwall-vpn · ATT&CK page ↗

Command and Control TA0011

T1219Remote Access Tools×3

An adversary may use legitimate remote access tools to establish an interactive command and control channel within a network. Remote access tools create a session between two trusted hosts through a graphical interface, a command line interaction, a protocol tunnel via development or management software, or hardware-level access such as KVM (Keyboard, Video, Mouse) over IP solutions. Desktop support software (usually graphical interface) and remote management software (typically command line interface) allow a user to control a computer remotely as if they are a local user inheriting the user or software permissions. This software is commonly used for troubleshooting, software installation, and system management. Adversaries may similarly abuse response features included in EDR and other defensive tools that enable remote access.

Evidence: 2026-08-17/akira-safe-mode-boot-edr-blinding-sonicwall-vpn · 2026-06-30/bumblebee-adaptixc2-akira-a-full-seo-poisoning-to-ransomware · 2026-06-10/dragos-q1-2026-industrial-ransomware-analysis-1-020-industri · ATT&CK page ↗

Exfiltration TA0010

T1048Exfiltration Over Alternative Protocol×1

Adversaries may steal data by exfiltrating it over a different protocol than that of the existing command and control channel. The data may also be sent to an alternate network location from the main command and control server.

Evidence: 2026-06-30/bumblebee-adaptixc2-akira-a-full-seo-poisoning-to-ransomware · ATT&CK page ↗

T1567Exfiltration Over Web Service×4

Adversaries may use an existing, legitimate external Web service to exfiltrate data rather than their primary command and control channel. Popular Web services acting as an exfiltration mechanism may give a significant amount of cover due to the likelihood that hosts within a network are already communicating with them prior to compromise. Firewall rules may also already exist to permit traffic to these services.

Evidence: 2026-07-09/groupe-3r-akira-forensic-confirmation-darknet-publication · 2026-06-30/bumblebee-adaptixc2-akira-a-full-seo-poisoning-to-ransomware · 2026-05-10/groupe-3r-r-seau-radiologique-romand-akira-ransomware-claims · 2026-05-04/akira-ransomware-on-groupe-3r-20-swiss-medical-imaging-centr · ATT&CK page ↗

T1567.002Exfiltration Over Web Service: Exfiltration to Cloud Storage×2

Adversaries may exfiltrate data to a cloud storage service rather than over their primary command and control channel. Cloud storage services allow for the storage, edit, and retrieval of data from a remote cloud storage server over the Internet.

Evidence: 2026-08-17/akira-safe-mode-boot-edr-blinding-sonicwall-vpn · 2026-08-16/weekly-w33-q2-ransomware-reports-dragos-checkpoint · ATT&CK page ↗

Impact TA0040

T1486Data Encrypted for Impact×10

Adversaries may encrypt data on target systems or on large numbers of systems in a network to interrupt availability to system and network resources. They can attempt to render stored data inaccessible by encrypting files or data on local and remote drives and withholding access to a decryption key. This may be done in order to extract monetary compensation from a victim in exchange for decryption or a decryption key (ransomware) or to render data permanently inaccessible in cases where the key is not saved or transmitted.

Evidence: 2026-08-17/akira-safe-mode-boot-edr-blinding-sonicwall-vpn · 2026-08-16/weekly-w33-q2-ransomware-reports-dragos-checkpoint · 2026-07-19/weekly-w29-thegentlemen-storm2697-status · 2026-07-09/groupe-3r-akira-forensic-confirmation-darknet-publication · 2026-06-30/bumblebee-adaptixc2-akira-a-full-seo-poisoning-to-ransomware · 2026-06-23/sonicwall-cve-2024-40766-why-patched-firewalls-keep-falling +4 more · ATT&CK page ↗

T1490Inhibit System Recovery×2

Adversaries may delete or remove built-in data and turn off services designed to aid in the recovery of a corrupted system to prevent recovery. This may deny access to available backups and recovery options.

Evidence: 2026-08-16/weekly-w33-q2-ransomware-reports-dragos-checkpoint · 2026-06-30/bumblebee-adaptixc2-akira-a-full-seo-poisoning-to-ransomware · ATT&CK page ↗

Story timeline

  1. 2026-08-17Akira blinds EDR by rebooting a victim host into Safe Mode with Networking — the operator's first observed use of the technique, and the stripped-down boot starved its own encryptor
    active-threatsAkira reboots a SonicWall-VPN victim into Safe Mode to strip EDR — and starves its own encryptor
  2. 2026-08-16Two independent Q2 2026 ransomware reports published three days apart agree the ecosystem is fragmenting without de-concentrating — and the industrial one carries a negative finding OT operators should plan against: no Q2 case reached control-system manipulation
    weekly-annual-reportsDragos and Check Point both counted Q2: 93 active groups against a 57.6% top-ten share, and zero incidents reaching ICS Stage 2
  3. 2026-08-10CrowdStrike catalogues 21 working command-obfuscation techniques inside VMware ESXi's BusyBox ash shell — and shell logs record the command before expansion, so the logged string is not what ran
    researchESXi's minimal shell is expressive enough to hide commands, and its logging captures the parsing stage rather than the result
  4. 2026-08-05Swiss Defence Department closes its RUAG review: the Akira ransom payment broke no law, but the risk weighing and the owner notification were deficient — and the federal no-payment recommendation stands
    Bern rules a federally-owned firm's ransom payment lawful, faults the governance, and reaffirms not to pay
  5. 2026-07-19The Gentlemen (Storm-2697) status: ReliaQuest's Q2 2026 numbers put it ahead of Qilin on the ransomware leaderboard, and a European public-transport victim (Metro Mondego) landed this week
    weekly-long-runningThe Gentlemen status — ReliaQuest ranks it Q2's most-active operator (300 vs Qilin's 289) on an AI-accelerated affiliate kit; it hit Metro Mondego (Portugal)
  6. 2026-07-12Healthcare across Switzerland and the UK saw ransomware confirmation, mailbox compromise and an insider-access clampdown this week
    weekly-sector-patternsHealthcare this week — Swiss radiology network confirms Akira attribution, Aargau psychiatric authority mailboxes phished, NHS England tightens insider access
  7. 2026-07-09Groupe 3R confirms Akira attribution and darknet publication of stolen data in its own forensic update
    updatesSwiss radiology network Groupe 3R confirms via its own forensics that Akira was behind its April attack and has published stolen data
  8. 2026-06-30Bumblebee → AdaptixC2 → Akira: a full SEO-poisoning-to-ransomware kill chain with a parallel Swiss intrusion
    deep-dive
  9. 2026-06-25"Mistic" backdoor: signed-Defender DLL sideloading and in-memory tradecraft by access broker Woodgnat/KongTuke
    active-threats
  10. 2026-06-23SonicWall CVE-2024-40766: why patched firewalls keep falling to Akira and Fog
    deep-dive
  11. 2026-06-22Check Point State of Ransomware Q1 2026 — ecosystem consolidation, with Switzerland and Germany named
    weekly-annual-reports
  12. 2026-06-10Dragos Q1 2026 Industrial Ransomware Analysis: 1,020 industrial incidents, The Gentleman's 4× surge against Romanian energy, and the IT-adjacent intrusion pattern
    deep-diveDragos Q1 2026 Industrial Ransomware Analysis: 1,020 industrial incidents, The Gentleman's 4× surge against Romanian energy, and the IT-adjacent intrusion
  13. 2026-06-10CVE-2026-44963 — Veeam Backup & Replication: authenticated domain-user deserialization RCE on the backup server (CVSS 9.4)
    trending-vulnerabilities
  14. 2026-05-28SANS ISC — Akira ransomware kill chain reconstructed entirely from SSLVPN syslog and Windows EVTX, no EDR
    research
  15. 2026-05-23Rapid7 Q1 2026 Threat Landscape Report: vulnerability exploitation now top initial-access vector at 38 %; KEV median time to listing collapses to 5 days
    research
  16. 2026-05-21SonicWall Gen6 SSL-VPN incomplete-patching (CVE-2024-12802) — Akira-linked actors brute-force MFA via UPN/SAM account-name split, February–March 2026 intrusions
    active-threats
  17. 2026-05-21Keycloak 26.6.2 — 16 CVEs including OIDC session fixation (CVE-2026-7507), WebAuthn execute-actions token replay (CVE-2026-37982), introspection audience bypass (CVE-2026-37979) and cross-realm IDOR in Authorization Services (CVE-2026-4630)
    trending-vulnerabilitiesKeycloak 26.6.2 — 16 CVEs including OIDC session fixation (CVE-2026-7507), WebAuthn execute-actions token replay (CVE-2026-37982), introspection audience
  18. 2026-05-20Microsoft DCU disrupts Fox Tempest malware-signing-as-a-service feeding Rhysida, INC, Qilin and Akira ransomware operations
    active-threats
  19. 2026-05-18SonicWall Gen6 SSL-VPN CVE-2024-12802 — Akira-linked actors bypassing MFA on *officially-patched* firmware
    weekly-top-stories
  20. 2026-05-18Fox Tempest — Microsoft DCU disrupts the malware-signing service feeding Rhysida, INC, Qilin and Akira
    weekly-long-running
  21. 2026-05-10Groupe 3R (Réseau Radiologique Romand) — Akira ransomware claims 48 GB; 20 imaging centres across seven Swiss cantons, second attack in twelve months
    active-threats
  22. 2026-05-04Mandiant M-Trends 2026
    weekly-annual-reports
  23. 2026-05-04Healthcare (CH, NL)
    weekly-sector-patterns
  24. 2026-05-04Akira ransomware — Swiss healthcare case confirmed; broader European playbook unchanged
    weekly-long-running
  25. 2026-05-04Akira ransomware on Groupe 3R — 20 Swiss medical-imaging centres across seven cantons; second cyberattack on the same operator within twelve months
    weekly-top-stories
  26. 2026-05-04Akira playbook quarterly context — Q1 2026 healthcare concentration; Qilin remains the dominant operator on German healthcare victims
    weekly-long-running

Relationships explore in graph

Typed, source-stated connections from the entity registry — each edge cites the entry whose reporting establishes it.

related to

attributed activity

Where this entity is cited

  • active-threats5
  • weekly-long-running4
  • weekly-annual-reports3
  • research3
  • deep-dive3
  • weekly-top-stories2
  • weekly-sector-patterns2
  • trending-vulnerabilities2
  • updates1

Source distribution

  • attack.mitre.org14 (23%)
  • bleepingcomputer.com2 (3%)
  • cybersecuritydive.com2 (3%)
  • dragos.com2 (3%)
  • ictjournal.ch2 (3%)
  • isc.sans.edu2 (3%)
  • research.checkpoint.com2 (3%)
  • swisscybersecurity.net2 (3%)
  • other33 (54%)

Co-occurring entities

Derived — referenced by the same focused operational entries (weekly summaries and report roundups don't count); ×N counts the shared entries.

All cited sources (61)

Entries about Akira (26)

2026-08-17 · view entry permalink →

HIGHNATOB2

Akira blinds EDR by rebooting a victim host into Safe Mode with Networking — the operator's first observed use of the technique, and the stripped-down boot starved its own encryptor

An Akira affiliate took a compromised Windows host into Safe Mode with Networking to strip its endpoint defences, which Huntress reports is the first time it has observed this operator using the technique — Snatch and AvosLocker have abused Safe Mode for years, but not Akira (Huntress, 2026-08-12). Everything around that step is the operator's familiar chain. From roughly 03:45 UTC on 4 August the SonicWall logged a burst of failed logins against multiple usernames from several external addresses, and about seven minutes later one succeeded against an SSL VPN with no multi-factor authentication in front of it; nearly two hours passed before any hands-on-keyboard activity (Huntress, 2026-08-12). The operator then reached the domain controller over RDP, spawned an elevated command shell, and ran full-property Get-ADUser and Get-ADComputer exports to files under C:\ProgramData — prefixed with $formatenumerationlimit = -1 so PowerShell's default four-item truncation would not clip multi-valued attributes such as group membership. Collection followed on an application server: WinRAR was installed mid-intrusion and used to recursively archive mapped file shares with the same flag string Huntress has documented in earlier SonicWall-entry Akira cases, and the archives went out to cloud object storage.

The evasion itself is three cheap steps. AnyDesk was installed as a service to carry both hands-on control and payload delivery; because third-party services do not start in Safe Mode — including the attacker's own — the operator first wrote that service into the Safe Mode allow-list with a single reg.exe add against HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network, then ran msconfig.exe at 06:29:21 UTC and forced the reboot. The host came back with Kernel-Boot event 27 recording a SAFEBOOT:NETWORK load option and Kernel-General event 12 recording BootMode = 2. Windows Defender logged event 3002 seconds into the boot, and Huntress states plainly that "For the entire Safe Mode window, the host had no working EDR, and AV was blinded" (Huntress, 2026-08-12).

What the operator did not anticipate is that the same stripped-down environment starved the ransomware. The encryptor launched at 06:34:29 UTC, and within about two minutes the host logged System event 26 for virtual-memory exhaustion and a cascade of PowerShell stack failures; it never encrypted. A scheduled Defender scan identified the binary at 07:43:50 UTC but its cleanup routine failed repeatedly because real-time protection was down, and quarantine only succeeded at 08:12:28 UTC — after the attacker rebooted back to normal operation at 08:10:38 UTC and thereby restored the very protection they had removed (Huntress, 2026-08-12). Huntress calls that "a lucky side effect of the attacker's own mistake in these circumstances, not a defence you can plan around", and notes that a host with more memory or a larger page file, or a retooled encryptor with a lighter footprint, could carry the same play to completion (Huntress, 2026-08-12).

Triage: Safe Mode with Networking is a legitimate diagnostic boot mode, so a lone Safe Mode boot is not the signal and IT-driven troubleshooting will generate them. The discriminators are what surrounds it: a SafeBoot Minimal or Network registry write naming a remote-access tool rather than a core Windows driver, a boot-configuration change made from an interactive session that traces back to an external VPN logon minutes earlier, and third-party security services stopping without a corresponding maintenance window. A genuine support-driven Safe Mode boot carries none of those, and the registry write in particular has no benign reason to name a remote-support binary.

Ransomware families like Snatch and AvosLocker have abused Safe Mode for years, but this is the first reported tie to Akira that Huntress has observed.

For the entire Safe Mode window, the host had no working EDR, and AV was blinded.

Alert on boot-configuration changes and Safe Mode boots: msconfig.exe / bcdedit activity, Kernel-Boot EID 27 with a SAFEBOOT load option, Kernel-General EID 12 BootMode=2, and third-party security services stopping (System EID 7036).

That's a lucky side effect of the attacker's own mistake in these circumstances, not a defence you can plan around.

Huntress 2026-08-12
threat17 Aug 04:28Zsingle-sourceOpen finding ↗
Sources: Huntress · BleepingComputer · The Register

2026-08-16 · view entry permalink →

NOTABLENATOB1

Two independent Q2 2026 ransomware reports published three days apart agree the ecosystem is fragmenting without de-concentrating — and the industrial one carries a negative finding OT operators should plan against: no Q2 case reached control-system manipulation

Two quarterly ransomware reports landed three days apart this week, counting different populations from different vantage points, and arriving at compatible descriptions of the same structural shift. Taken together they are the closest thing to an outside check on what the operational entries of the last quarter have shown one incident at a time.

Dragos's Industrial Ransomware Analysis for Q2 2026 counts incidents affecting industrial organisations: "Dragos identified 1,140 ransomware incidents affecting industrial organizations in Q2 2026, an 12% increase over the 1,020 recorded in Q1," with manufacturing the most affected sector at 747 incidents or 65%, and engineering firms, system integrators and equipment manufacturers second at 117 — a distribution that puts the industrial supply chain, not the plant, at the centre. The regional detail is where it becomes a European planning input rather than a US one: the United States remains the most impacted country by a wide margin at 431 incidents or 38% of the total, but "the country with the greatest increase from Q1 (37 incidents) to Q2 (68 incidents) was Germany" (Dragos, 2026-08-10) — an eighty-four per cent rise in a neighbouring jurisdiction whose industrial base overlaps heavily with the Swiss one.

Check Point Research's State of Ransomware Q2 2026 counts leak-site victims across all sectors and describes the ecosystem's shape: "The top 10 groups accounted for 57.6% of all victims, down from 71% in Q1, while the number of active groups climbed from 71 to 93, a new high for the period tracked in this report," against a total of 2,139 victims that was essentially flat quarter over quarter and up 33% year over year. Qilin remained the most prolific operator for a fourth straight quarter with 279 victims despite its own count falling 17%, while The Gentlemen surged 62% to 269 and briefly outpaced it; the US share of victims fell from 50% to 42%, which Check Point attributes to the fastest-growing groups — The Gentlemen and the newly active Krybit — targeting the US less often than the ecosystem average (Check Point Research, 2026-08-13). That last point is the one European defenders should read twice: a falling US share in a flat total is not a reduction in activity, it is a redistribution toward everyone else. Check Point also records, independently of this pipeline's own observations this week, that "The exploitation window kept narrowing, with AI increasingly cited as the accelerant."

The single most consequential finding in either report is a negative one, and it belongs to Dragos: "Dragos observed no case in Q2 2026 in which a ransomware operator reached Stage 2 of the ICS Cyber Kill Chain or directly manipulated a control system; where operational disruption occurred, it followed encryption or precautionary shutdown of the enterprise and virtualization systems on which OT depends."

Dragos identified 1,140 ransomware incidents affecting industrial organizations in Q2 2026, an 12% increase over the 1,020 recorded in Q1.

Dragos observed no case in Q2 2026 in which a ransomware operator reached Stage 2 of the ICS Cyber Kill Chain or directly manipulated a control system; where operational disruption occurred, it followed encryption or precautionary shutdown of the enterprise and virtualization systems on which OT depends.

However, the country with the greatest increase from Q1 (37 incidents) to Q2 (68 incidents) was Germany.

Dragos 2026-08-10

The top 10 groups accounted for 57.6% of all victims, down from 71% in Q1, while the number of active groups climbed from 71 to 93, a new high for the period tracked in this report.

The exploitation window kept narrowing, with AI increasingly cited as the accelerant.

Check Point Research 2026-08-13
annual-report16 Aug 23:59Zmulti-sourceOpen finding ↗
Sources: Dragos · Check Point Research

2026-08-10 · view entry permalink →

NOTABLENATOB2

CrowdStrike catalogues 21 working command-obfuscation techniques inside VMware ESXi's BusyBox ash shell — and shell logs record the command before expansion, so the logged string is not what ran

CrowdStrike has published a systematic test of command obfuscation inside VMware ESXi's shell, catalogued as 21 distinct working techniques across six classes and validated against a named build — "ESX 7.0.3 build-20036589 running the VMware-provided BusyBox at /usr/lib/vmware/busybox/bin/busybox, which enables the awk GNU math extensions" (CrowdStrike, 2026-08-07). The motivation is that the hypervisor layer is where ransomware operations end: CrowdStrike names Scattered Spider and Akira among the groups that have demonstrated that reaching it allows an adversary to encrypt virtual machines, disable logging and cripple a data centre at once.

Two findings carry the operational weight. The first is that the assumption behind ignoring this shell is wrong — BusyBox's minimal footprint does not mean minimal capability, because it keeps POSIX compliance for command substitution, variable expansion, escape-sequence interpretation and quoting, and the bundled awk brings string manipulation, arithmetic, bitwise operations and its own command-execution facility. The obfuscation engine, in other words, is a coreutils applet rather than the shell, which is precisely why hardening and monitoring approaches designed for a full Linux server shell do not transfer.

The second finding is the one that changes detection engineering, and it is a property of the platform's own telemetry: "ESX shell logs capture commands during the parsing stage, before expansions occur." The logged string is therefore the obfuscated form, not the command that executed. CrowdStrike states the consequence plainly for the concrete case — "Any detection strategy that searches for the keyword 'esxcli' would miss this command entirely." Any rule, hunt query or SIEM correlation built on literal administrative command names against ESXi shell telemetry inherits this gap, regardless of vendor.

Detection, telemetry class first. The usable signal is the ESXi shell command log itself, but keyed on structure rather than on command names: substitution and expansion syntax, escape-sequence density, arithmetic or bitwise construction of strings, and invocations of the shell's text-processing applet in positions where an administrator would type a command name. CrowdStrike calibrated false-positive risk against real production activity and lists what normal looks like — service restarts, vendor hardware tools, backup scripts, certificate renewal, NTP restarts, configuration greps — none of which resemble any of the six classes. Triage: administrators legitimately use quoting and variables in ESXi shell one-liners, so their presence alone is not the signal; the discriminator is obfuscation that serves no readability or scripting purpose — a command name assembled from fragments or computed arithmetically, when typing it directly would have been shorter.

The critical insight is that ESX shell logs capture commands during the parsing stage, before expansions occur.

All techniques were validated on ESX 7.0.3 build-20036589 running the VMware-provided BusyBox at /usr/lib/vmware/busybox/bin/busybox, which enables the awk GNU math extensions (xor, and, or).

Any detection strategy that searches for the keyword "esxcli" would miss this command entirely.

CrowdStrike 2026-08-07
research10 Aug 04:45Zsingle-sourceOpen finding ↗
Sources: CrowdStrike

Earlier coverage (23)

2026-08-05NOTABLENATOA1Swiss Defence Department closes its RUAG review: the Akira ransom payment broke no law, but the risk weighing and the owner notification were deficient — and the federal no-payment recommendation standsOn 2026-08-04 the Swiss Defence Department (VBS) published the outcome of its ownership review into how RUAG MRO handled the Akira ransomware attack on its US subsidiary RUAG LLC, detected 9-10 October 2025, in which data was stolen and a ransom was paid. VBS finds no indication of a legal violation — the decision sat with the company's own corporate bodies and required no prior consent from the Confederation as owner — but faults RUAG MRO for weighing the decision mainly on legal and economic grounds without sufficient regard for political and reputational consequences, and for not informing the owner before communicating publicly. The federal recommendation not to pay is explicitly unchanged.2026-07-19NOTABLEexploitedupdateNATOB2The Gentlemen (Storm-2697) status: ReliaQuest's Q2 2026 numbers put it ahead of Qilin on the ransomware leaderboard, and a European public-transport victim (Metro Mondego) landed this weekUpdate to the prior weekly's The Gentlemen (Storm-2697) profile. ReliaQuest's Q2 2026 threat-spotlight (2026-07-16) reports The Gentlemen posted 300 victims in the quarter versus Qilin's 289, ending Qilin's leaderboard dominance, and attributes the pace to aggressive affiliate recruitment plus a well-packaged intrusion kit (pre-compromised victim lists, custom EDR killers, GPO-based deployment tooling) and a "likely AI-accelerated iteration layer" for tool refresh — with Infosecurity Magazine independently corroborating the 300-vs-289 figures. A GuidePoint GRIT review (pre-window) frames the same concentration as a "four-headed monster" (Qilin, The Gentlemen, Akira, DragonForce), with the five most prolific Q2 groups collectively claiming over 40% of recorded attacks. Operationally, the group's reach touched the constituency this week: Portugal's Metro Mondego confirmed a 6 July ransomware attack claimed by The Gentlemen, contained to internal systems. No new initial-access CVE or vector is disclosed — the delta is the quantitative leaderboard reversal, the AI-tooling-cadence explanation, and the fresh European public-transport victim.2026-07-12NOTABLENATOB1Healthcare across Switzerland and the UK saw ransomware confirmation, mailbox compromise and an insider-access clampdown this weekThree healthcare-sector developments in 2026-W28 span the external and internal threat surface: Groupe 3R, a Western-Swiss radiology network, confirmed Akira attribution and darknet publication of stolen data in its own forensic report; Psychiatrische Dienste Aargau (a Swiss cantonal psychiatric authority) had email accounts phished and abused as a spam relay; and NHS England issued new controls after staff were caught inappropriately accessing high-profile patients' records. Two of the three carry a direct Swiss nexus, and the set illustrates that healthcare exposure runs through ransomware attribution, mailbox identity and insider governance alike.2026-07-09NOTABLEupdateNATOC2Groupe 3R confirms Akira attribution and darknet publication of stolen data in its own forensic updateGroupe 3R (Réseau Radiologique Romand), a 20-site medical-imaging network across seven Romandie cantons, has now confirmed through its own forensic investigation that the 2026-04-30 ransomware attack was carried out by Akira and that stolen corporate/administrative documents have since been published on the darknet — closing the attribution gap left when Akira first listed the victim on 2026-05-08. The operator refused to pay, rebuilt all 20 sites, and acknowledged it may never establish with certainty whether medical data was exfiltrated.2026-06-30NOTABLEBumblebee → AdaptixC2 → Akira: a full SEO-poisoning-to-ransomware kill chain with a parallel Swiss intrusionThe DFIR Report published (2026-06-29) the full reconstruction of an intrusion that began with SEO poisoning and ended in Akira ransomware in under three days.2026-06-25HIGH"Mistic" backdoor: signed-Defender DLL sideloading and in-memory tradecraft by access broker Woodgnat/KongTukeTwo new initial-access-broker toolsets surface — Mistic and Edgecution — Symantec details Mistic, sideloaded via a signed Microsoft Defender binary so its activity reads as legitimate Defender behaviour (Symantec, 2026-06-24); Zscaler details Edgecution, a malicious Edge extension that bridges the browser sandbox to a host Python backdoor via the Native Messaging API (today's deep dive) (Zscaler, 2026-06-23).2026-06-23HIGHexploitedSonicWall CVE-2024-40766: why patched firewalls keep falling to Akira and FogSonicWall firewalls that were patched against CVE-2024-40766 are still being breached by Akira and Fog ransomware within hours — because the patch leaves behind the stale local accounts, implicit-VPN LDAP default groups, and un-enforced SSLVPN MFA that the intrusions actually ride. A fresh SANS ISC write-up names the exact residual misconfigurations to remediate post-patch (SANS ISC, 2026-06-23). Today's deep dive — § 5.2026-06-22NOTABLECheck Point State of Ransomware Q1 2026 — ecosystem consolidation, with Switzerland and Germany namedSurfaced this week for its CH/EU-specific findings, Check Point's Q1 2026 ransomware report (published 11 May, not covered in the dailies) documents a structural consolidation: the top 10 groups now hold 71.1% of all leak-site victims, the highest concentration since early 2024 and a reversal of two years of …2026-06-10NOTABLEDragos Q1 2026 Industrial Ransomware Analysis: 1,020 industrial incidents, The Gentleman's 4× surge against Romanian energy, and the IT-adjacent intrusion patternDragos' quarterly industrial-ransomware report (published 3 June) is the single periodic landscape report treated in this brief; the focus below is only on what changes a Swiss/EU public-sector and critical-infrastructure SOC's posture, not the full survey (Dragos, 2026-06-03).2026-06-10NOTABLECVE-2026-44963 — Veeam Backup & Replication: authenticated domain-user deserialization RCE on the backup server (CVSS 9.4)Veeam patched CVE-2026-44963 (CVSS v4 9.4, CWE-502) on 9 June: any authenticated domain user — no elevated Veeam privilege required — can execute code on the Backup Server when it is domain-joined; workgroup servers are unaffected (Veeam, 2026-06-09).2026-05-28NOTABLESANS ISC — Akira ransomware kill chain reconstructed entirely from SSLVPN syslog and Windows EVTX, no EDRSANS ISC handler Manuel Humberto Santander Pelaez published a forensic walkthrough on 2026-05-27 reconstructing an Akira ransomware intrusion using only two log sources — SSLVPN syslog and Windows EVTX exports — joined by source IP and normalised time (SANS Internet Storm Center, 2026-05-27). [SINGLE-SOURCE] …2026-05-23NOTABLERapid7 Q1 2026 Threat Landscape Report: vulnerability exploitation now top initial-access vector at 38 %; KEV median time to listing collapses to 5 daysRapid7 Labs published its Q1 2026 Threat Landscape Report on 2026-05-21 covering January–March 2026 IR data; the GlobeNewswire release accompanied the post the same day. The findings that change what a Swiss/EU public-sector SOC should prioritise:2026-05-21NOTABLEKeycloak 26.6.2 — 16 CVEs including OIDC session fixation (CVE-2026-7507), WebAuthn execute-actions token replay (CVE-2026-37982), introspection audience bypass (CVE-2026-37979) and cross-realm IDOR in Authorization Services (CVE-2026-4630)The Keycloak project shipped 26.6.2 on 2026-05-19, fixing 16 CVEs across identity, authentication and authorisation subsystems; BSI's CERT-Bund issued advisory WID-SEC-2026-1612 on 2026-05-20 classifying the batch as HIGH risk (Keycloak Project, 2026-05-19; BSI CERT-Bund, 2026-05-20).2026-05-21NOTABLEexploitedSonicWall Gen6 SSL-VPN incomplete-patching (CVE-2024-12802) — Akira-linked actors brute-force MFA via UPN/SAM account-name split, February–March 2026 intrusionsThreat actors whose TTPs are consistent with Akira ransomware activity successfully bypassed MFA on SonicWall Gen6 SSL-VPN appliances running officially-patched firmware between February and March 2026; SonicWall and incident-response vendors confirm the root cause is that the firmware update for CVE-2024-12802 (CVSS …2026-05-20HIGHMicrosoft DCU disrupts Fox Tempest malware-signing-as-a-service feeding Rhysida, INC, Qilin and Akira ransomware operationsMicrosoft Digital Crimes Unit disrupts Fox Tempest malware-signing-as-a-service. 1,000+ fraudulent short-lived Microsoft Artifact Signing certificates revoked; signspace[.]cloud seized via SDNY court order. Downstream customers include Vanilla Tempest (Rhysida), Storm-0501, Storm-2561, Storm-0249; ransomware families served include Rhysida, INC, Qilin, Akira (Microsoft Threat Intelligence, 2026-05-19). Detection: hunt for Microsoft-signed PE binaries with cert validity ≤72h from Trusted Signing issuers.2026-05-18NOTABLEFox Tempest — Microsoft DCU disrupts the malware-signing service feeding Rhysida, INC, Qilin and AkiraMicrosoft Threat Intelligence and the Digital Crimes Unit disrupted Fox Tempest, a malware-signing-as-a-service operation that supplied code-signing to multiple ransomware operations (daily 2026-05-20). Status: disrupted via combined intelligence exposure and a sealed US legal action.2026-05-18NOTABLEexploitedSonicWall Gen6 SSL-VPN CVE-2024-12802 — Akira-linked actors bypassing MFA on *officially-patched* firmwareIf you did nothing this week: patching alone did not close this.2026-05-10HIGHGroupe 3R (Réseau Radiologique Romand) — Akira ransomware claims 48 GB; 20 imaging centres across seven Swiss cantons, second attack in twelve monthsGroupe 3R (Réseau Radiologique Romand) listed by Akira on its leak site as a 48 GB victim — 20 medical-imaging centres across seven Romandie cantons (Geneva, Vaud, Valais, Fribourg, Neuchâtel, Berne and a seventh), patient records and employee identity documents in scope. Victim disclosed the attack on 2026-04-30 via its own site, notified BACS/OFCS, filed criminal complaint, and stated it will not pay ransom. Second cyberattack on the same Swiss imaging operator within twelve months.2026-05-04NOTABLEAkira playbook quarterly context — Q1 2026 healthcare concentration; Qilin remains the dominant operator on German healthcare victimsW1 horizon research added Q1 2026 healthcare quarterly context to the Groupe 3R item in § 1.2026-05-04NOTABLEAkira ransomware — Swiss healthcare case confirmed; broader European playbook unchangedCurrent state: Akira's leak-site listing on Groupe 3R (§ 1) is the operationally specific Swiss-healthcare development this week.2026-05-04NOTABLEMandiant M-Trends 2026M-Trends 2026 (published 2026-03-23, first covered 2026-05-07) reinforces three cross-cutting trends visible in this week's incidents: voice phishing surged to the second most prevalent initial-access vector at 11% (overtaking email phishing at 6%) driven by IT help-desk impersonation and SaaS OAuth token theft …2026-05-04NOTABLEHealthcare (CH, NL)Two healthcare incidents define the sector picture this week, both with European public-sector concentration. Groupe 3R (Switzerland) — Akira leak-site listing on a Romandie medical-imaging operator running 20 centres across seven cantons; the operator confirmed publicly on 2026-04-30, will not pay ransom, and is …2026-05-04HIGHAkira ransomware on Groupe 3R — 20 Swiss medical-imaging centres across seven cantons; second cyberattack on the same operator within twelve monthsGroupe 3R (Réseau Radiologique Romand) — Akira leak-site listing claims 48 GB; ~20 imaging centres across seven Swiss cantons (Vaud, Valais, Fribourg, Genève, Neuchâtel, Berne, and Zürich) — six in Romandie plus Zürich; second cyberattack on the same Swiss operator within twelve months. Victim disclosed publicly 2026-04-30, notified BACS/OFCS, filed criminal complaint, will not pay ransom; legacy examination data still inaccessible. (Groupe 3R victim statement · ICTjournal.ch · daily 2026-05-10)