Security News New Akira Lookalike Ransomware Campaign Targeting Windows Users in South America

[Divergent]

Content source

https://cybersecuritynews.com/new-akira-lookalike-ransomware-campaign/

A new and dangerous ransomware campaign has surfaced across South America, targeting Windows users with a carefully crafted strain that closely imitates the well-known Akira ransomware.

While the two may appear nearly identical on the surface, this new threat is built on an entirely different foundation — one that quietly borrows from another notorious ransomware family to carry out its attacks.

The campaign has raised serious concern within the cybersecurity community because of how convincingly it mimics Akira.

New Akira Lookalike Ransomware Campaign Targeting Windows Users in South America

A new and dangerous ransomware campaign has surfaced across South America, targeting Windows users with a carefully crafted strain that closely imitates the well-known Akira ransomware. While the two may appear nearly identical on the surface, this new threat is built on an entirely different...

cybersecuritynews.com

 

[Divergent]

Executive Summary

Confirmed Facts
A ransomware campaign targeting Windows users in South America is utilizing a Babuk-based encryptor that appends the .akira extension and drops ransom notes mirroring Akira's Tor URLs.

Assessment
Threat actors are highly likely leveraging leaked Babuk source code to rapidly deploy encryptors while using the Akira brand as a false flag to misdirect incident response, attribution, and threat intelligence efforts.

Technical Analysis & Remediations

MITRE ATT&CK Mapping

T1486
Data Encrypted for Impact

T1036
Masquerading (Mimicking Akira branding and communication style)

CVE Profile
Delivery CVE: [Unknown/Insufficient Evidence]. Historically, Akira and associated affiliates exploit CVE-2023-20269 [NVD Score: 9.9]
[CISA KEV Status: Active] for initial access via Cisco ASA/FTD.

Constraint
The structure resembles the Akira ransomware family operationally (using the .akira extension and specific Tor-based URLs), but the underlying execution mechanism suggests a Babuk-derived payload.

Remediation - THE ENTERPRISE TRACK (NIST SP 800-61r3 / CSF 2.0)

GOVERN (GV) – Crisis Management & Oversight

Command
Initiate incident response protocols for potential ransomware deployment; alert legal and communications teams regarding potential double-extortion data leak tactics.

DETECT (DE) – Monitoring & Analysis

Command
Deploy SIEM/EDR hunting queries for unauthorized file modifications appending the .akira extension and monitor for known Babuk-based encryptor behaviors (e.g., volume shadow copy deletion).

RESPOND (RS) – Mitigation & Containment

Command
Isolate affected Windows endpoints from the network immediately to halt lateral movement and network-share encryption.

RECOVER (RC) – Restoration & Trust

Command
Validate the integrity of offline backups and initiate phased restoration only after verifying the environment is clean of persistence mechanisms.

IDENTIFY & PROTECT (ID/PR) – The Feedback Loop

Command
Patch edge devices (e.g., VPNs, firewalls) against known exploited vulnerabilities, enforce MFA globally, and restrict SMB/RDP access.

Remediation - THE HOME USER TRACK (Safety Focus)

Priority 1: Safety

Command
Disconnect from the internet immediately if unexpected file encryption or the .akira extension is observed on your Windows machine.

Command
Do not log into banking/email until verified clean.

Priority 2: Identity

Command
Reset passwords and enforce MFA for all critical accounts using a known clean device (e.g., mobile phone on cellular data).

Priority 3: Persistence

Command
Check Scheduled Tasks, Startup Folders, and Browser Extensions for anomalous entries that may survive a standard reboot.

Hardening & References

Baseline
CIS Benchmarks for Windows 10/11 (Focus on Account Policies, UAC enforcement, and Network Access Restrictions).

Framework
NIST CSF 2.0 / SP 800-61r3 guidelines for Ransomware Risk Management.

Note
The probability of successful decryption without paying the ransom (P(recovery)) relies heavily on identifying flaws in the specific Babuk implementation used, as Babuk's leaked builder has known cryptographic weaknesses in certain historical iterations. Thorough binary analysis is required before declaring data permanently lost.

Source

Cyber Security News

 

[Halp2001]

To complement the information from a home user perspective, here are 5 golden rules to help mitigate the risk of these types of attacks in personal environments:

• Constant Updates: Keeping Windows and applications up to date is essential to close the security holes that these programs try to exploit.
• Email Caution: Avoiding unexpected attachments or links—even if the sender looks familiar—prevents the execution of malicious payloads.
• Official Downloads: Using original websites to download software avoids the risks associated with cracks, activators, or third-party pages.
• Identity Protection: Implementing strong passwords and enabling Multi-Factor Authentication (MFA) adds a critical barrier against unauthorized access.
• External Backups: Having backups on disconnected drives or secure cloud services ensures file recovery without relying on decryption tools.

Thanks for sharing the technical details, Divergente. It’s a very useful analysis to understand how these variants recycle Babuk code to mislead response teams.

 

[Szellem]

To complement the information from a home user perspective, here are 5 golden rules to help mitigate the risk of these types of attacks in personal environments:

• Constant Updates: Keeping Windows and applications up to date is essential to close the security holes that these programs try to exploit.
• Email Caution: Avoiding unexpected attachments or links—even if the sender looks familiar—prevents the execution of malicious payloads.
• Official Downloads: Using original websites to download software avoids the risks associated with cracks, activators, or third-party pages.
• Identity Protection: Implementing strong passwords and enabling Multi-Factor Authentication (MFA) adds a critical barrier against unauthorized access.
• External Backups: Having backups on disconnected drives or secure cloud services ensures file recovery without relying on decryption tools.

Thanks for sharing the technical details, Divergente. It’s a very useful analysis to understand how these variants recycle Babuk code to mislead response teams.

Users themselves can do a great deal to prevent infections. By following the basic rules you mention, certain problems can be avoided. We shouldn’t rely solely on antivirus protection; we should also teach people to practice basic digital hygiene.