ako

Executive Summary

Ako is a medium-sophisticated criminal threat actor specializing in ransomware operations for financial gain. The group deploys MedusaLocker ransomware, which encrypts files using AES and RSA-2048 encryption while avoiding executable files to maintain system functionality. Ako targets organizations seeking financial gain through ransom payments, focusing on sectors and countries where data value is high.

Goals & Targeting

Ako's primary objectives are organizational-gain through ransomware campaigns. Targets include industries with valuable data and higher willingness to pay ransoms, such as healthcare, finance, and legal sectors. The group likely selects victims based on their ability to disrupt operations and extract maximum financial benefits from ransoms.

Ako operates as a criminal threat actor group primarily motivated by financial gain, employing the MedusaLocker ransomware. This ransomware encrypts victim files with strong encryption algorithms (AES and RSA-2048) while avoiding executable files to prevent rendering systems unusable, which could deter victims from paying ransoms. The malware appends various extensions to encrypted files, making it identifiable. Ako's operations are characterized by strategic approach in targeting sectors and countries where data theft or encryption yields significant financial returns.

Key Capabilities

• Ransomware deployment (MedusaLocker)
• Strong encryption using AES/RSA-2048
• Targeted attacks on vulnerable organizations
• Avoidance of executable files to maintain system functionality

MITRE ATT&CK Tactics

ATT&CK Techniques

Software / Tooling

Campaigns & Victims

Ako's campaigns are characterized by targeted, stealthy operations to avoid detection. Their use of strong encryption and avoidance of disrupting system functionality make their attacks more persistent. Campaign patterns likely involve phishing emails or exploit kits for initial access. Ako has conducted campaigns focusing on smaller businesses with sufficient data value but limited defenses.

IOC Patterns

• Spear-phishing emails with malicious attachments
• Execution of MedusaLocker ransomware
• File encryption with .encrypted, .bomber, etc.
• Network traffic analysis for C2 communication

Recommended Actions

• Implement robust email filtering to detect phishing attempts.
• Monitor network traffic for signs of ransomware activity.
• Enhance endpoint detection and response capabilities.
• Regularly back up data and store it offline securely.

Suggested Tags