The Akira Ransomware Gang's Attack on Frost and Sullivan

Frost & Sullivan, a global consulting and research firm known for providing market analysis, growth strategies, and industry insights to companies and organizations, has been targeted by the Akira ransomware gang. Established in 1961, the company offers a range of services designed to help businesses make informed decisions and achieve competitive advantage in various markets. Frost & Sullivan's areas of expertise cover multiple industries, including technology, healthcare, energy, aerospace, and more. The firm conducts extensive research, market analysis, and trend forecasting to assist clients in identifying growth opportunities, understanding market dynamics, and making strategic decisions.

Akira's Claim and Method of Attack

Akira posted Frost and Sullivan to its data leak site on July 29th, claiming to have stolen 90GB of contract and personal information. The Akira ransomware gang, first identified in May 2023, utilizes the Windows Restart Manager API to effectively close processes or terminate Windows services that might be actively using a file, thereby allowing the encryption process to proceed unhindered. In each computer folder affected by the ransomware, a ransom note named "akira_readme.txt" is placed. This note serves as a communication from the attackers, explaining the situation and providing links to the Akira data leak and negotiation sites.

The Threat of Data Exposure

The ransom note issued by the Akira group contains a chilling warning: "Regarding your data, in the event that we fail to reach an agreement, we will attempt to sell your personal information, trade secrets, databases, source codes, and anything else deemed valuable on the dark market to multiple threat actors simultaneously. Subsequently, all of this compromised information will be publicly exposed on our blog." Like other ransomware groups, the Akira gang infiltrates corporate networks and expands its reach to other connected devices. After acquiring Windows domain admin credentials, the threat actors deploy ransomware across the entire network. Before encrypting the files, the attackers take the additional step of exfiltrating sensitive corporate data. This stolen information is then used as leverage during their extortion tactics, as they warn victims that the data will be made public unless a ransom payment is made.

Design of the Data Leak Website

The Akira gang has invested considerable effort into designing their data leak website, which features a retro aesthetic and allows visitors to navigate it using command inputs.