Akira _v2
Software · ATTACK:enterprise:S1194
Attributed source ↗ · Plaintext record · Complete record and assertions JSON
Inspect structured metadata and provenance
{
"id": "ATTACK:enterprise:S1194",
"title": "Akira _v2",
"type": "Software",
"source_url": "https://attack.mitre.org/software/S1194",
"snapshot": "enterprise-attack-20.0.json",
"status": "active",
"rights": "Source metadata only; source notices retained; no operational prose or payloads",
"review_status": "machine-extracted; source-specific checks passed, editorial review pending",
"stix_id": "malware--929d0d4d-b7c6-4ee8-81eb-43c849294e27",
"external_id": "S1194",
"domain": "enterprise",
"created": "2025-01-09T18:38:40.311Z",
"modified": "2025-03-11T15:37:48.613Z",
"version": "1.0",
"aliases": [
],
"tactics": [
],
"source_references": [
{
"source_name": "CISA Akira Ransomware APR 2024",
"url": "https://www.cisa.gov/sites/default/files/2024-04/aa24-109a-stopransomware-akira-ransomware_2.pdf"
},
{
"source_name": "Cisco Akira Ransomware OCT 2024",
"url": "https://blog.talosintelligence.com/akira-ransomware-continues-to-evolve/"
},
{
"source_name": "Palo Alto Howling Scorpius DEC 2024",
"url": "https://unit42.paloaltonetworks.com/threat-assessment-howling-scorpius-akira-ransomware/"
}
]
}Explicit source assertions (7)
First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.
ATTACK:enterprise:S1194 → uses → ATTACK:enterprise:T1543
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--4320c156-79a0-40fb-869f-32a574dcef0b
CISA Akira Ransomware APR 2024ATTACK:enterprise:G1024 → uses → ATTACK:enterprise:S1194
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--9a315900-f87e-4276-af68-a731198259cb
CISA Akira Ransomware APR 2024 · Cisco Akira Ransomware OCT 2024 · Palo Alto Howling Scorpius DEC 2024ATTACK:enterprise:S1194 → uses → ATTACK:enterprise:T1654
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--9c0b8bff-6cfe-4b12-843c-19985efd2d3b
Cisco Akira Ransomware OCT 2024 · Palo Alto Howling Scorpius DEC 2024ATTACK:enterprise:S1194 → uses → ATTACK:enterprise:T1486
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--b5ae6046-3a14-4cae-8612-c9d414567e19
Cisco Akira Ransomware OCT 2024 · Palo Alto Howling Scorpius DEC 2024ATTACK:enterprise:S1194 → uses → ATTACK:enterprise:T1083
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--b7cd4d27-492d-4abf-8fee-27e2449ba26d
CISA Akira Ransomware APR 2024 · Cisco Akira Ransomware OCT 2024 · Palo Alto Howling Scorpius DEC 2024ATTACK:enterprise:S1194 → uses → ATTACK:enterprise:T1489
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--f67c6c6d-8e35-408a-87cf-6f9af30d73b9
CISA Akira Ransomware APR 2024 · Cisco Akira Ransomware OCT 2024 · Palo Alto Howling Scorpius DEC 2024ATTACK:enterprise:S1194 → uses → ATTACK:enterprise:T1480
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--fd4c608f-ebfc-4c17-947d-f79e854b4bb1
Cisco Akira Ransomware OCT 2024