Arika ransomware [1] [2] [3], also known as Akira ransomware, is a highly sophisticated malware that targets Linux servers and Windows systems. This ransomware group poses a significant threat [2], primarily targeting organizations in the UK and US across various industries [2]. They have successfully attacked 110 victims [1] [3], including high-profile organizations like Intertek [1], and demand millions of dollars in ransom [2].
Description
Arika ransomware exploits a vulnerability in Cisco ASA VPNs without multifactor authentication, specifically the CVE-2023-20269 vulnerability [3], to gain entry [1]. They utilize different malware samples [2], encryption algorithms [2], and a TOR-based communication system [2]. The ransomware encrypts victim files, deletes shadow copies [2] [3], and demands ransom payment for data recovery [3]. Additionally, they employ a double-extortion method, stealing and encrypting personal data and threatening to release it if the ransom is not paid [1].
To protect against Arika ransomware, it is recommended to implement multifactor authentication, limit permissions [1], keep software updated [1], audit privileged accounts [1], and conduct regular security awareness training [1]. Network segmentation and blocking unauthorized tunneling and remote access tools are also advised [1]. Arika ransomware specifically targets Linux enterprise environments [1].
Conclusion
Mitigating the impact of Arika ransomware requires implementing multifactor authentication and maintaining basic cyber hygiene. Logpoint’s security operations platform offers tools and capabilities to identify [2], evaluate [2], and mitigate the impact of this sophisticated malware. It is crucial to defend against this threat and stay vigilant as Arika ransomware represents a new wave of ransomware actors targeting Linux enterprise environments.
References
[1] https://www.darkreading.com/attacks-breaches/akira-ransomware-mutates-to-target-linux-systems-adds-ttps
[2] https://insurance-edge.net/2023/09/22/logpoints-flags-up-akira-ransomware-threat/
[3] https://linuxsecurity.com/news/hackscracks/akira-ransomware-mutates-to-target-linux-systems-adds-ttps
