Update on Akira Ransomware BYOVD

Cohesity REDLab has released updates to the threat library to detect emerging Akira related ransomware variants that are actively exploiting targets in the wild. Akira was first spotted last year, and this is an updated to the original detection. Users should closely monitor ant-ransomware backup anomalies in Security Center. Threat Scan feature should also be used in tandem to scan backup data using the default threat library or custom YARA rules. Users should also run periodic file-hash scans to detect dormant malware in backup data.

Analysis

Akira and affiliates used compromised firewall appliances as an initial-access vector. After gaining access they deploy evasive “bring your own vulnerable driver” (BYOVD) techniques that load signed but vulnerable and legitimate drivers to defeat AV/EDR for data theft and rapid ransomware encryption.

• Initial access via firewall appliances: By abusing compromised credentials or exploiting known vulnerabilities attackers received access to remote VPN/web-console of firewall appliances.
• Establish persistence & reconnaissance: Once on the appliance or via VPN tunnel, attackers enumerate internal hosts and credential stores. They attempt to harvest admin credentials and legitimate remote-access accounts for broader access.
• Deploy evasive tooling (BYOVD / malicious drivers): Rather than relying only on file-based loaders, operators load vulnerable or signed drivers (often legitimate vendor drivers abused intentionally) to disable or interfere with EDR protections and to load kernel hooks.
• Data theft / exfiltration: Attackers steal sensitive data, often prior to encryption, to increase leverage for extortion.
• Ransomware deployment & encryption: Ransomware is deployed for rapid encryption and data is encrypted

Takeaways

Cohesity’s Anti-Ransomware and Threat Detection feature lets you scan backups snapshots and secondary stored data for anomalous behavior, known malware signatures, indicators of compromise (IOCs), using both built-in threat feeds and custom YARA rules. This helps ensure that the data recovered from backups is clean and avoids re-infecting production after a breach. It works by integrating curated threat intelligence and anomaly detection into Cohesity data protection platform so that customers can schedule or initiate threat scans over backups, inspect snapshots for malicious or suspicious artifacts, flag or quarantine compromised backups, and then use those evaluations to guide rapid recovery and response.

References:

• CISA: https://www.cisa.gov/news-events/cybersecurity-advisories/aa24-109a
• RAPID7: https://www.rapid7.com/blog/post/dr-akira-ransomware-group-utilizing-sonicwall-devices-for-initial-access/
• CISA: https://www.cisa.gov/news-events/alerts/2025/09/22/sonicwall-releases-advisory-customers-after-security-incident
• GUIDEPOINT: https://www.guidepointsecurity.com/blog/gritrep-akira-sonicwall/