Threat Actor Unknown origin
Storm-1567
Also known as: Akira · PUNK SPIDER · GOLD SAHARA
Storm-1567 is the threat actor behind the Ransomware-as-a-Service Akira. They attacked Swedish organizations in March 2023. This ransomware utilizes the ChaCha encryption algorithm, PowerShell, and Windows Management Instrumentation (WMI). Microsoft's Defender for Endpoint successfully blocked a large-scale hacking campaign carried out by Storm-1567, highlighting the effectiveness of their security solution.
Indicators of Compromise 17
Domain authorized-logins[.]net Domain b6w9m2z5x8q1v3k[.]top Domain carrolc[.]com Filename akira.exe SHA-256 1e41c7bfaa6aa3b93b6cc024274a10e33f3e12fe7c98c1db387ef8927f9d1984 SHA-256 34d798a6c55e57ed0932b6499f4fbcb5454bdfca903307be101a0594b0ac07bc SHA-256 3f797a639bc855bc6d5471f327924b62d10900ddec49b970eca6604142bbb4be SHA-256 59e3c4cb06331b4f2d78a9a0592f3747e573bd01c5a7650c26361d1e25520712 SHA-256 8c935feec4bd05d5d918df308be417532fb42608fb989a08eab183e0ae699235 SHA-256 afd5f1ed45a9867daf3bc64152cef460a06b164c8183e490db39146d4749a82c SHA-256 db972979d508e75fe730d3b72c2701470fbdaeaf8ebdd674744754fa44438ca5 SHA-256 f591275a8f014b29e567529d67c54eb7bb4473db1c38737d6bfd5b3d52c9344e SHA-256 fb3630822b70bacb56aa4cec29b5a0e3e9acb3920809e70310a4003385a6d34a IP 142[.]93[.]242[.]144 IP 144[.]31[.]53[.]78 IP 198[.]13[.]159[.]44 IP 199[.]91[.]221[.]42
MITRE ATT&CK TTPs 27
T1018 T1021.001 T1059 T1059.001 T1060 T1071.001 T1071.003 T1078 T1082 T1083 T1087.002 T1090 T1105 T1133 T1203 T1212 T1484.001 T1485 T1490 T1542.001 T1543.003 T1548.002 T1550 T1552.001 T1566 T1574.002 T1588.001
Remote System Discovery
Discovery
Remote Desktop Protocol
Lateral Movement
Command and Scripting Interpreter
Execution
PowerShell
Execution
T1060
Web Protocols
Command And Control
Mail Protocols
Command And Control
Valid Accounts
Defense Evasion
System Information Discovery
Discovery
File and Directory Discovery
Discovery
Domain Account
Discovery
Proxy
Command And Control
Ingress Tool Transfer
Command And Control
External Remote Services
Persistence
Exploitation for Client Execution
Execution
Exploitation for Credential Access
Credential Access
Group Policy Modification
Defense Evasion
Data Destruction
Impact
Inhibit System Recovery
Impact
System Firmware
Persistence
Windows Service
Persistence
Bypass User Account Control
Privilege Escalation
Use Alternate Authentication Material
Defense Evasion
Credentials In Files
Credential Access
Phishing
Initial Access
DLL Side-Loading
Persistence
Malware
Resource Development
Source Articles
Akira hackers disable EDR with Safe Mode, steal data but fail to encrypt
An Akira ransomware affiliate gained initial access via an exposed SonicWall VPN without MFA, then used RDP to move laterally and exfiltrate data. The attacker rebooted the compromised host into Safe Mode with Networking to disable EDR and AV solutions, including the Huntress agent and Microsoft Defender. Data was stolen using s5cmd and uploaded to an attacker-controlled S3 bucket, while AnyDesk was installed and configured to persist in Safe Mode. The ransomware payload (akira.exe) failed to execute due to low virtual memory, preventing encryption. Despite the failure, the actor exfiltrated sensitive data within five hours.
bleeping-computer ·2w ago
IT threat evolution in Q2 2026. Non-mobile statistics
In Q2 2026, multiple ransomware groups remained active, with Qilin emerging as the most prolific based on victims listed on data leak sites. Microsoft disrupted a malware-signing-as-a-service operation run by the threat actor Fox Tempest, which was used by several ransomware groups including Rhysida, Akira, and Qilin. CISA added a Windows local privilege escalation vulnerability (CVE-2026-33825, BlueHammer) to its KEV catalog due to active exploitation in ransomware attacks. Check Point attributed zero-day exploitation of a critical vulnerability in its Remote Access VPN (CVE-2026-50751) to the Qilin ransomware group. Additionally, the PayoutsKing group was observed using QEMU to deploy hidden Alpine Linux-based virtual machines as a stealthy backdoor technique.
securelist ·3w ago
Backdoor.Mistic: New Backdoor May be Linked to Ransomware Access Broker
Backdoor.Mistic is a newly identified stealthy memory-resident backdoor used in cybercrime intrusions since April 2026. It has been deployed alongside ModeloRAT, a Python-based RAT linked to the financially motivated threat actor Woodgnat (aka KongTuke), known for selling initial access to ransomware affiliates including Qilin, Black Basta, and Rhysida. Mistic is sideloaded via legitimate binaries like MpExtMs.exe and loads malicious DLLs such as EndpointDlp.dll, enabling fileless execution, in-memory payload loading, and self-deletion via a kill switch. The actor uses social engineering lures (ClickFix, FileFix, CrashFix) and Microsoft Teams for initial access, with opportunistic targeting across insurance, education, IT, and professional services sectors.
security-com ·2mo ago