Threadlinqs IntelligenceStart free

Threat actorMYTracked since 2026-03

Akira

Also known as:Storm-1567DragonForceClopMedusaLockerQilinINC RansomINC Ransom - G1032LynxGOLD SAHARALockBitPhobos47

As of 2026-10-09, Akira is a MY-nexus threat actor tracked by Threadlinqs Intelligence across 12 threats spanning ransomware, threat intel, vulnerability. Also known as Storm-1567, DragonForce, Clop, MedusaLocker. ATT&CK coverage spans 107 techniques across 15 tactics in 12 of 12 tracked threats. Most-observed techniques: T1078 (Valid Accounts), T1490 (Inhibit System Recovery), T1021.001 (Remote Desktop Protocol).

Tracked threats
122 critical · 9 high
First seen
2026-03-15
Last seen
2026-10-09
ATT&CK techniques
107across 12 of 12 threats
Related CVEs
33Referenced by its activity
Attribution
MYNation or origin
Nation: MY · 12 tracked threat(s) · Categories: RANSOMWARE, THREAT_INTEL, VULNERABILITY

Activity timeline

Akira appears in 12 tracked threats between and ; the busiest month was 2026-08 with 3 reports.

ATT&CK techniques observed

107 techniques observed across 12 of 12 tracked threats · Credential Access (15), Discovery (12), Initial Access (10), Execution (9), Persistence (9), Stealth (formerly Defense Evasion) (9)
  • T1078 Valid Accounts — Initial Accessobserved in 9 of 12 tracked threats
  • T1490 Inhibit System Recovery — Impactobserved in 9 of 12 tracked threats
  • T1021.001 Remote Desktop Protocol — Lateral Movementobserved in 8 of 12 tracked threats
  • T1133 External Remote Services — Initial Accessobserved in 8 of 12 tracked threats
  • T1219 Remote Access Tools — Command and Controlobserved in 8 of 12 tracked threats
  • T1190 Exploit Public-Facing Application — Initial Accessobserved in 7 of 12 tracked threats
  • T1567.002 Exfiltration to Cloud Storage — Exfiltrationobserved in 7 of 12 tracked threats
  • T1059.001 PowerShell — Executionobserved in 6 of 12 tracked threats
  • T1685 Disable or Modify Tools — Defense Impairmentobserved in 6 of 12 tracked threats
  • T1018 Remote System Discovery — Discoveryobserved in 5 of 12 tracked threats
  • T1486 Data Encrypted for Impact — Impactobserved in 5 of 12 tracked threats
  • T1003.001 LSASS Memory — Credential Accessobserved in 4 of 12 tracked threats
  • T1087.002 Account Discovery: Domain Account — Discoveryobserved in 4 of 12 tracked threats
  • T1482 Domain Trust Discovery — Discoveryobserved in 4 of 12 tracked threats
  • T1555 Credentials from Password Stores — Credential Accessobserved in 4 of 12 tracked threats

Tracked threats

Related CVEs

33 CVEs referenced by tracked Akira activity