Threadlinqs IntelligenceStart free

Threat actorMYTracked since 2026-03

Akira

Also known as:Storm-1567FogFrag ransomware operatorsDragonForceClopMedusaLockerQilinINC RansomINC Ransom - G1032LynxGOLD SAHARALockBit

As of 2026-10-31, Akira is a MY-nexus threat actor tracked by Threadlinqs Intelligence across 15 threats spanning ransomware, threat intel, vulnerability. Also known as Storm-1567, Fog, Frag ransomware operators, DragonForce. ATT&CK coverage spans 112 techniques across 15 tactics in 15 of 15 tracked threats. Most-observed techniques: T1078 (Valid Accounts), T1490 (Inhibit System Recovery), T1133 (External Remote Services).

Tracked threats
153 critical · 11 high
First seen
2026-03-15
Last seen
2026-10-31
ATT&CK techniques
112across 15 of 15 threats
Related CVEs
36Referenced by its activity
Attribution
MYNation or origin
Nation: MY · 15 tracked threat(s) · Categories: RANSOMWARE, THREAT_INTEL, VULNERABILITY

Activity timeline

Akira appears in 15 tracked threats between and ; the busiest month was 2026-10 with 6 reports.

ATT&CK techniques observed

112 techniques observed across 15 of 15 tracked threats · Credential Access (15), Discovery (12), Initial Access (12), Execution (11), Persistence (10), Stealth (formerly Defense Evasion) (9)
  • T1078 Valid Accounts — Initial Accessobserved in 11 of 15 tracked threats
  • T1490 Inhibit System Recovery — Impactobserved in 11 of 15 tracked threats
  • T1133 External Remote Services — Initial Accessobserved in 10 of 15 tracked threats
  • T1190 Exploit Public-Facing Application — Initial Accessobserved in 9 of 15 tracked threats
  • T1219 Remote Access Tools — Command and Controlobserved in 9 of 15 tracked threats
  • T1021.001 Remote Desktop Protocol — Lateral Movementobserved in 8 of 15 tracked threats
  • T1567.002 Exfiltration to Cloud Storage — Exfiltrationobserved in 8 of 15 tracked threats
  • T1059.001 PowerShell — Executionobserved in 7 of 15 tracked threats
  • T1018 Remote System Discovery — Discoveryobserved in 6 of 15 tracked threats
  • T1685 Disable or Modify Tools — Defense Impairmentobserved in 6 of 15 tracked threats
  • T1003.001 OS Credential Dumping: LSASS Memory — Credential Accessobserved in 5 of 15 tracked threats
  • T1087.002 Account Discovery: Domain Account — Discoveryobserved in 5 of 15 tracked threats
  • T1486 Data Encrypted for Impact — Impactobserved in 5 of 15 tracked threats
  • T1555 Credentials from Password Stores — Credential Accessobserved in 5 of 15 tracked threats
  • T1567 Exfiltration Over Web Service — Exfiltrationobserved in 5 of 15 tracked threats

Tracked threats

Related CVEs

36 CVEs referenced by tracked Akira activity