Akira Ransomware Encryption Cracked!

Akira’s Encryption Vulnerability Exposed

The notorious Akira ransomware, known for targeting high-profile organizations, has suffered a setback. A new method has been discovered to bypass its encryption, offering hope to affected companies. This counterattack leverages the power of GPUs to brute-force the encryption keys, potentially unlocking ransomware-locked files.

GPU Power Breaks Akira’s Defense

Tinyhack, a security researcher, revealed that certain Akira variants employ encryption methods susceptible to brute-force attacks. Using a single RTX 4090, decryption could take approximately seven days. However, by utilizing a cluster of 16 GPUs, this timeframe can be reduced to just over ten hours. This breakthrough marks a significant development in the ongoing battle against ransomware.

Technical Details of the Exploit

The Akira ransomware utilizes the chacha8 and Kcipher2 encryption algorithms, generating per-file encryption keys based on four distinct timestamps. While these timestamps are recorded in nanoseconds, they fall within a relatively narrow range, making them vulnerable to brute-force attacks using high-end GPUs. Organizations seeking to implement this decryption method must ensure that encrypted files remain untouched to preserve the accuracy of the timestamps.

Circumventing NFS Challenges

Organizations utilizing Network File Systems (NFS) may encounter additional challenges during the decryption process. Server lag can complicate the accurate determination of timestamps, potentially hindering the brute-force attack. Proper planning and resource allocation are crucial for successful decryption. Consider leveraging software outsourcing to optimize your decryption efforts.

Real-World Application and Recommendations

Tinyhack’s client successfully decrypted a complete set of VM files in approximately three weeks using this method. Organizations affected by Akira ransomware are advised to explore GPU server rental services like runpod or vast.ai to expedite the decryption process. This approach significantly reduces the time required to recover valuable data.

A Victory for Cybersecurity

The discovery of this decryption method represents a major win for cybersecurity research. While the developers of Akira ransomware are likely to patch this vulnerability in future versions, organizations already affected can potentially recover their systems without paying the ransom. Don’t become a victim, explore custom software development options to improve your security posture.

Further Exploration and Resources

For a comprehensive understanding of the vulnerability and detailed decryption instructions, refer to Tinyhack’s blog post. This resource provides an in-depth look at the brute-forcing process and offers practical guidance for organizations seeking to recover from Akira ransomware attacks. Need help implementing these solutions? Contact Evotek today.

Stay Informed and Protected

Ransomware continues to evolve, posing a persistent threat to organizations worldwide. Stay informed about the latest threats and vulnerabilities by subscribing to cybersecurity newsletters and resources. Proactive measures and robust security protocols are essential for mitigating the risk of ransomware attacks.