Risk Letters

Threat actor

Akira

TLP:CLEAR

Facts

  • Also known as: GOLD SAHARA, PUNK SPIDER, Howling Scorpius, Storm-1567
  • Motivation: Financial
  • Malware and tools: AdFind, Advanced IP Scanner, Advanced Port Scanner, Akira, Akira _v2, AnyDesk, Bloodhound, churchill_driver.sys / fidget.sys, Cloudflared, consent.exe (msimg32.dll / wmsgapi.dll), CrackMapExec, DonPAPI
  • Techniques (MITRE ATT&CK): Account Access Removal, Archive via Utility, Binary Padding, Data Encrypted for Impact, Disable or Modify Tools, Domain Trust Discovery, Exfiltration to Cloud Storage, External Remote Services, Financial Theft, Match Legitimate Resource Name or Location, PowerShell, Remote Access Tools
  • Last seen: 7 October 2026

Members get the actor's profile, its recent incidents and our assessment in the dashboard.

Get the full brief

Data: NVD (public domain), CISA KEV, FIRST EPSS, MITRE ATT&CK, AlienVault OTX.