Check Point · Published 3 Dec
Inside Akira Ransomware's Rust Experiment
By benhe
Excerpt
Executive Summary
Check Point Research analyzed the construction and control flow of Akira ransomware’s Rust version that circulated in early 2024, which has specific features uniquely targeting ESXi server. Our analysis demonstrates how Rust idioms, boilerplate code, and compiler strategies come together to account for the complicated assembly.
The report outlines principles to follow when analyzing ITW Rust binaries in general.
We present an analysis of the design strategies used by the malware’s authors, as indicated by the assembly and parts of the reconstructed source code.
Introduction…
The opening of the report, shown for reference. The full report, with its figures and indicators, is published by Check Point on research.checkpoint.com.
Mentioned in the excerpt1
More from Check Point98
Check Point · Web page · Published 12 Dec
November 2023’s Most Wanted Malware: New AsyncRAT Campaign Discovered while FakeUpdates Re-Entered the Top Ten after Brief Hiatus
Researchers reported on a new AsyncRAT campaign where malicious HTML files were being used to spread the stealthy malware. Meanwhile, downloader FakeUpdates jumped straight into second place after a short break from the top ten list Our latest Global Threat…
Check Point · Web page · Published 10 Apr
The Muddy Waters of APT Attacks
The Iranian APT, MuddyWater, has been active since at least 2017. Most recently though, a new campaign, targeting Belarus, Turkey and Ukraine, has emerged that caught the attention of Check Point researchers. Ever since at least 2017, the attackers behind…
Check Point · Web page · Published 13 Jan
Unveiling VoidLink - A Stealthy, Cloud-Native Linux Malware Framework
VoidLink is an advanced malware framework made up of custom loaders, implants, rootkits, and modular plugins designed to maintain long-term access to Linux systems. The framework includes multiple cloud-focused capabilities and modules, and is engineered to…
Check Point · Web page · Published 7 Mar
Pandas with a Soul: Chinese Espionage Attacks Against Southeast Asian Government Entities
In 2021, Check Point Research published a report on a previously undisclosed toolset used by Sharp Panda, a long-running Chinese cyber-espionage operation targeting Southeast Asian government entities. Since then, we have continued to track the use of these…
On the same topics
shaddy43.com · Web page · Published 13 Oct
Breaking Akira’s Clock: Recovering Files Without the Ransom Key
Malware Analysis Series · 13 October 2026 · updated 23 October 2026 · by shaddy43 An Akira-branded Windows encryptor builds every file key from the machine’s uptime. We take it apart function by function, show how a responder can turn that into decrypted…
SOCRadar · Web page · Published 20 Oct
INC and The Gentlemen Ransomware: Exposed AI Infrastructure
SOCRadar Threat Research Unit (STRU) has uncovered an AI-driven intrusion ecosystem run by affiliates of the INC Ransomware and The Gentlemen Ransomware groups. A single publicly accessible command-and-control server exposed the operators’ AI session…
The Hacker News · Web page · Published 26 Oct
Attackers Use Microsoft Teams IT Support Scams to Deploy Malware and Ransomware
Cybersecurity researchers are calling attention to what they say is a "recurring social engineering pattern" across hundreds of cases in which threat actors use Microsoft Teams' external chat creation feature to conduct impersonation scams or to deliver…
Synacktiv · Web page · Added 25 Oct
Etude de cas : Comment Hunters International et ses affiliés ciblent
Hunters International est un groupe de Ransomware-as-a-Service (RaaS) apparu en octobre 2023, après avoir acquis le code source et l'infrastructure du groupe Hive, aujourd'hui démantelé. À ce jour, selon les statistiques publiées, Hunters International et ses…