| ⓘ This advisory addresses the increase of Akira Ransomware attacks on critical information infrastructure due to VPN vulnerabilities. |
Attention constituent:
CIRT-BS is observing an uptick in Akira Ransomware malware attacks impacting Bahamian critical infrastructure.
Arika Ransomware, which emerged in March 2023, has two distinct variants that target outdated versions of VMware ESXi virtual machines, encrypting the files and blocking access to these systems.
Akira threat actors are also known to exploit vulnerabilities in Cisco Router/Adaptive Security Appliance (ASA) Clientless SSL VPN. Akira also employs other tactics, including phishing attempts and password brute force, to gain system access.
| Immediate Actions to Consider |
- Remediate all system vulnerabilities.
- Enable multifactor authentication (MFA) wherever possible, including webmail, VPN, and accounts that access critical systems.
- Regularly patch and update software and applications to their latest version and conduct regular vulnerability assessments.
- Segment networks appropriately.
- Upgrade unsupported hardware and software.
- Implement compensating controls for end-of-life equipment and software.
- Conduct regular user security awareness training for staff.
|
For further details, please visit #StopRansomware: Akira Ransomware | CISA.
Best,
|
