Akira
IntrusionSet · ATTACK:enterprise:G1024
Attributed source ↗ · Plaintext record · Complete record and assertions JSON
Inspect structured metadata and provenance
{
"id": "ATTACK:enterprise:G1024",
"title": "Akira",
"type": "IntrusionSet",
"source_url": "https://attack.mitre.org/groups/G1024",
"snapshot": "enterprise-attack-20.0.json",
"status": "active",
"rights": "Source metadata only; source notices retained; no operational prose or payloads",
"review_status": "machine-extracted; source-specific checks passed, editorial review pending",
"stix_id": "intrusion-set--46bb06cb-f2d9-4b37-8c92-a27e224ad90d",
"external_id": "G1024",
"domain": "enterprise",
"created": "2024-02-20T23:59:25.966Z",
"modified": "2026-07-31T18:47:54.331Z",
"version": "2.0",
"aliases": [
"Akira",
"GOLD SAHARA",
"PUNK SPIDER",
"Howling Scorpius"
],
"tactics": [
],
"source_references": [
{
"source_name": "PUNK SPIDER"
},
{
"source_name": "Howling Scorpius"
},
{
"source_name": "GOLD SAHARA"
},
{
"source_name": "CISA Akira Ransomware APR 2024",
"url": "https://www.cisa.gov/sites/default/files/2024-04/aa24-109a-stopransomware-akira-ransomware_2.pdf"
},
{
"source_name": "CrowdStrike PUNK SPIDER",
"url": "https://www.crowdstrike.com/adversaries/punk-spider/"
},
{
"source_name": "Cisco Akira Ransomware OCT 2024",
"url": "https://blog.talosintelligence.com/akira-ransomware-continues-to-evolve/"
},
{
"source_name": "Secureworks GOLD SAHARA",
"url": "https://www.secureworks.com/research/threat-profiles/gold-sahara"
},
{
"source_name": "Arctic Wolf Akira 2023",
"url": "https://arcticwolf.com/resources/blog/conti-and-akira-chained-together/"
},
{
"source_name": "BushidoToken Akira 2023",
"url": "https://blog.bushidotoken.net/2023/09/tracking-adversaries-akira-another.html"
},
{
"source_name": "Palo Alto Howling Scorpius DEC 2024",
"url": "https://unit42.paloaltonetworks.com/threat-assessment-howling-scorpius-akira-ransomware/"
}
]
}Explicit source assertions (25)
First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.
ATTACK:enterprise:G1024 → uses → ATTACK:enterprise:T1567.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--036b0dfd-5d52-4b10-9951-8d967fc8df3c
Secureworks GOLD SAHARAATTACK:enterprise:G1024 → uses → ATTACK:enterprise:T1213.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--0e472133-290f-42f3-9dd3-104b7ba978d2
Secureworks GOLD SAHARAATTACK:enterprise:G1024 → uses → ATTACK:enterprise:T1531
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--21247679-6bd8-43dc-921b-530d255d1d6c
Secureworks GOLD SAHARAATTACK:enterprise:G1024 → uses → ATTACK:enterprise:T1482
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--35d6d4f5-3c25-47bb-97d9-67d1e004d180
Arctic Wolf Akira 2023ATTACK:enterprise:G1024 → uses → ATTACK:enterprise:S0002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--3fff8382-175d-44ce-b430-ae32930817ec
Arctic Wolf Akira 2023ATTACK:enterprise:G1024 → uses → ATTACK:enterprise:T1036.005
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--5263da97-9946-4768-99de-b5b7e91e52ba
Cisco Akira Ransomware OCT 2024ATTACK:enterprise:G1024 → uses → ATTACK:enterprise:T1078
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--536ce093-85f3-4e80-9f61-4fa3739e874a
Cisco Akira Ransomware OCT 2024 · Secureworks GOLD SAHARA · Arctic Wolf Akira 2023ATTACK:enterprise:G1024 → uses → ATTACK:enterprise:T1558
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--5869cc87-316e-46ae-9f4f-fb6876b42d39
Cisco Akira Ransomware OCT 2024ATTACK:enterprise:G1024 → uses → ATTACK:enterprise:S0029
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--5b8fab1d-c033-487b-a9c5-c699a0f11907
Arctic Wolf Akira 2023ATTACK:enterprise:G1024 → uses → ATTACK:enterprise:T1018
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--5d23f25a-d98a-47a6-8da7-86e8a73c3407
Arctic Wolf Akira 2023ATTACK:enterprise:G1024 → uses → ATTACK:enterprise:T1021.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--7aa62231-de12-4fc9-a3dd-fcbc948fbc77
Cisco Akira Ransomware OCT 2024ATTACK:enterprise:G1024 → uses → ATTACK:enterprise:T1059.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--7bd50f5d-26d2-45b5-a09d-6e775efa944a
Cisco Akira Ransomware OCT 2024ATTACK:enterprise:G1024 → uses → ATTACK:enterprise:T1657
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--7e57b3e4-207c-4ef0-89bb-dc062fcad62e
CISA Akira Ransomware APR 2024 · BushidoToken Akira 2023ATTACK:enterprise:G1024 → uses → ATTACK:enterprise:S0552
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--9092578b-593b-4a4b-ba3f-2bfeed172567
Arctic Wolf Akira 2023ATTACK:enterprise:G1024 → uses → ATTACK:enterprise:S1194
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--9a315900-f87e-4276-af68-a731198259cb
CISA Akira Ransomware APR 2024 · Cisco Akira Ransomware OCT 2024 · Palo Alto Howling Scorpius DEC 2024ATTACK:enterprise:G1024 → uses → ATTACK:enterprise:T1486
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--9ed66c72-199a-47d7-8bdd-95c34a370d33
CISA Akira Ransomware APR 2024 · BushidoToken Akira 2023ATTACK:enterprise:G1024 → uses → ATTACK:enterprise:S1129
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--b240e6ba-9c38-4a6b-a4e9-30c07736711b
Kersten Akira 2023 · Cisco Akira Ransomware OCT 2024ATTACK:enterprise:G1024 → uses → ATTACK:enterprise:S1191
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--c685df5b-8916-41f0-9558-eed76b445a8d
CISA Akira Ransomware APR 2024 · Cisco Akira Ransomware OCT 2024 · Palo Alto Howling Scorpius DEC 2024ATTACK:enterprise:G1024 → uses → ATTACK:enterprise:T1133
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--d2825a04-d5c4-4598-aa3d-cb72cfe74ac4
Secureworks GOLD SAHARAATTACK:enterprise:G1024 → uses → ATTACK:enterprise:T1027.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--d50f6966-5085-48e3-bf48-e6e252a0b6be
Cisco Akira Ransomware OCT 2024ATTACK:enterprise:G1024 → uses → ATTACK:enterprise:T1685
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--daf8822d-3f33-4c18-8472-4da8a1b6d5ad
Cisco Akira Ransomware OCT 2024ATTACK:enterprise:G1024 → uses → ATTACK:enterprise:T1219
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--e514f2a1-c3ae-403d-bbf4-8b72e29c49f1
Secureworks GOLD SAHARA · Arctic Wolf Akira 2023ATTACK:enterprise:G1024 → uses → ATTACK:enterprise:S0349
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--e5328a4e-b37a-4020-b242-ea6c60605e02
Arctic Wolf Akira 2023ATTACK:enterprise:G1024 → uses → ATTACK:enterprise:S1040
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--e59eafd8-6579-4ca0-b357-6df989142449
Arctic Wolf Akira 2023ATTACK:enterprise:G1024 → uses → ATTACK:enterprise:T1560.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--f7416b2f-b3b3-4fc4-a463-05ae302a6b24
Secureworks GOLD SAHARA