Attention! The Linux version of Akira ransomware targets VMware ESXi servers

The Akira ransomware utilizes a Linux encryptor to encrypt VMware ESXi virtual machines, launching double-extortion attacks against enterprises worldwide.

First appearing in March 2023, Akira targeted Windows systems across multiple industries including education, finance, real estate, manufacturing, and consulting.

Like other ransomware groups targeting enterprises, these attackers steal data from compromised networks and encrypt files, subjecting victims to double extortion and demanding ransoms reaching up to millions of dollars.

Since its launch, there have been over 30 victims in North America alone, with two distinct spikes in activity on ID Ransomware submissions at the end of May and currently.

Akira's activity over the past few months (MOVEit)

▍Akira Targets VMware ESXi

The Linux version of Akira was first discovered by malware analyst rivitna, who shared a sample of a new encryptor on VirusTotal last week.

Analysis reveals that the encryptor's project name is "Esxi_Build_Esxi6", indicating that the attackers designed it specifically for VMware ESXi servers.

For example, one source code file of the project is
/mnt/d/vcprojects/Esxi_Build_Esxi6/argh.h.

Over the past few years, as enterprises have transitioned to using virtual machines as servers for better device management and efficient resource utilization, ransomware groups have created many customized Linux encryptors to encrypt VMware ESXi servers.

By targeting ESXi servers, attackers can encrypt many servers running as virtual machines in a single run of the ransomware encryptor.

However, unlike other VMware ESXi encryptors, Akira's encryptor does not include many advanced features, such as automatically shutting down virtual machines before encrypting files using the esxcli command.

That being said, the binary does support several command-line arguments, allowing attackers to customize the attack:

-p --encryption_path (Target file/folder path)

-s --share_file (Target network drive path)

-n --encryption_percent (Encryption percentage)

--fork (Create a child process for encryption)

Files encrypted by Akira on a Linux server

The -n parameter is particularly noteworthy, as it allows attackers to define how much data is encrypted on each file.

The lower this setting is, the faster the encryption speed, but the more likely it is that victims can recover their original files without paying a ransom.

When encrypting files, the Linux Akira encryptor targets the following extensions:

.4dd, .accdb, .accdc, .accde, .accdr, .accdt, .accft, .adb, .ade, .adf, .adp, .arc, .ora, .alf, .ask, .btr, .bdf, .cat, .cdb, .ckp, .cma, .cpd, .dacpac, .dad, .dadiagrams, .daschema, .db-shm, .db-wa, .db3, .dbc, .dbf, .dbs, .dbt, .dbv, .dbx, .dcb, .dct, .dcx, .dlis, .dp1, .dqy, .dsk, .dsn, .dtsx, .eco, .ecx, .edb, .epim, .exb, .fcd, .fdb, .fic, .fmp, .fmp12, .fmps, .fp3, .fp4, .fp5, .fp7, .fpt, .frm, .gdb, .grdb, .gwi, .hdb, .his, .idb, .ihx, .itdb, .itw, .jet, .jtx, .kdb, .kexi, .kexic, .kexis, .lgc, .lwx, .maf, .maq, .mar, .mas, .mav, .mdb, .mdf, .mpd, .mrg, .mud, .mwb, .myd, .ndf, .nnt, .nrmlib, .ns2, .ns3, .ns4, .nsf, .nv2, .nwdb, .nyf, .odb, .oqy, .orx, .owc, .p96, .p97, .pan, .pdb, .pdm, .pnz, .qry, .qvd, .rbf, .rctd, .rod, .rodx, .rpd, .rsd, .sas7bdat, .sbf, .scx, .sdb, .sdc, .sdf, .sis, .spq, .sqlite, .sqlite3, .sqlitedb, .temx, .tmd, .tps, .trc, .trm, .udb, .usr, .v12, .vis, .vpd, .vvv, .wdb, .wmdb, .wrk, .xdb, .xld, .xmlff, .abcddb, .abs, .abx, .accdw, .adn, .db2, .fm5, .hjt, .icg, .icr, .lut, .maw, .mdn, .mdt, .vdi, .vhd, .vmdk, .pvm, .vmem, .vmsn, .vmsd, .nvram, .vmx, .raw, .qcow2, .subvo, .bin, .vsv, .avhd, .vmrs, .vhdx, .avdx, .vmcx, .iso

Curiously, the Linux locker appears to skip the following folders and files, all of which are related to Windows folders and executables, suggesting that Akira's Linux variant was ported from the Windows version.

winnt, temp, thumb, $Recycle.Bin, $RECYCLE.BIN, System Volume Information, Boot, Windows, Trend Micro, .exe, .dll, .lnk, .sys, .msi

Analysts at Cyble also published a report on Akira's Linux version, explaining that the encryptor includes a public RSA encryption key and utilizes multiple symmetric key algorithms for file encryption, including AES, CAMELLIA, IDEA-CB, and DES.

Symmetric keys are used to encrypt the victim's files, which are then encrypted using the RSA public key. This prevents access to the decryption key unless you possess the private RSA decryption key, which is held solely by the attackers.

RSA public key used by Akira (Cyble)

Encrypted files renamed with the .akira extension, along with a hardcoded ransom note named akira_readme.txt, will be created in every folder on the encrypted device.

Ransom note of Akira on a Linux server

The recently announced number of victims by Akira reflects its expanding scope of targets, which only worsens the threats faced by organizations globally.

Unfortunately, adding Linux support is a growing trend among ransomware groups, with many using off-the-shelf tools to do so as it is a simple and almost foolproof way to increase profits.

Other ransomware operations using Linux ransomware encryptors, primarily targeting VMware ESXi, include Royal, Black Basta, LockBit, BlackMatter, AvosLocker, REvil, HelloKitty, RansomEXX, and Hive.

The custom adversary simulation library of SecuritySentry now includes the attack methods of the Akira ransomware. You can search for the keyword "Akira" in the SecuritySentry platform to access relevant attack simulation experiments, or search for other ransomware keywords, such as "LockBit" and "BlackMatter", to verify if your security defense system can effectively counter the various attack techniques employed by these groups.