group

Akira G1024

Created: 20 February 2024
Last modified: 31 July 2026
Aliases: Akira · GOLD SAHARA · PUNK SPIDER · Howling Scorpius

Akira is a ransomware variant and ransomware deployment entity active since at least March 2023.[1] Akira uses compromised credentials to access single-factor external access mechanisms such as VPNs for initial access, then various publicly-available tools and techniques for lateral movement.[1][2] Akira operations are associated with "double extortion" ransomware activity, where data is exfiltrated from victim environments prior to encryption, with threats to publish files if a ransom is not paid. Technical analysis of Akira ransomware indicates variants capable of targeting Windows or VMWare ESXi hypervisors and multiple overlaps with Conti ransomware.[3][4][5]

Techniques49th pct

TacticsTop 15%

Tools & malwareTop 24%

CampaignsNone recorded

Enterprise ATT&CK only. Any Mobile or ICS rows on the same ATT&CK page are not carried.

MITRE reference G1024

Remote System Discovery T1018↗

Akira uses software such as Advanced IP Scanner and MASSCAN to identify remote hosts within victim networks.7

Discovery39 detection rules

Remote Desktop Protocol T1021.001↗

Akira has used RDP for lateral movement.8

Lateral Movement33 detection rules

Binary Padding T1027.001↗

Akira has used binary padding to obfuscate payloads.9

Stealth3 detection rules

Match Legitimate Resource Name or Location T1036.005↗

Akira has used legitimate names and locations for files to evade defenses.10

Stealth27 detection rules

PowerShell T1059.001↗

Akira has used PowerShell scripts for credential harvesting and privilege escalation.11

Execution297 detection rules

Valid Accounts T1078↗

Akira uses valid account information to remotely access victim networks, such as VPN credentials.12 13 14

Initial Access · Persistence · Privilege Escalation · Stealth97 detection rules

Standing G1024

Reach is how much of ATT&CK this group touches. Coverage is how well defended each thing it does is, as a median per technique rather than a total — a total would just restate the reach. Each figure is ranked against all 176 ATT&CK groups only where that population actually spreads. Where most of the population shares one value, a percentile would rank the tie instead of the entity, so the raw value is shown and no rank is claimed.

Reach

Techniques1749th pct

49th percentile · 51% of 176 ATT&CK groups have more Enterprise techniques.

Tactics13Top 15%

85th percentile · 85% of 176 ATT&CK groups have this many tactics spanned or fewer.

Tools & malware8Top 24%

76th percentile · 76% of 176 ATT&CK groups have this many tools and malware or fewer.

Campaigns089% tie · 4 values

89% of the population shares a single value across only 4 distinct values, so a percentile here would rank the tie, not the entity.

Coverage

Rules / technique27med73rd pct

73rd percentile · 73% of 176 ATT&CK groups have this many detection rules per technique or fewer.

Tests / technique4med

Detection coverage G1024

960 distinct rules cover the 17 techniques recorded for this group. The 996 technique-to-rule mappings resolve to 960 distinct rules, because one rule can cover several techniques. 595 Sigma · 365 Splunk.

16 covered by at least one rule1 with no coverage960 distinct rules in total

Drag headers to reorder | Drag edges to resize

Loading detections...

Select	Title	Description	Category	Status	Event	Product	MITRE ATT&CK	CVEs	Severity	Author	Created	Updated	ID	Refs

© 2026 The MITRE Corporation. ATT&CK® and D3FEND™ data reproduced with permission. SigmaHQ detection rules licensed under DRL 1.1. attack.mitre.org · d3fend.mitre.org · CAR analytics licensed under Apache 2.0 · car.mitre.org

MITRE reference G1024

Reach

Coverage

How it got here