IOC Radar

Indicators are what attackers leave behind. Stolen credentials are what they arrive with.

Check Your Exposure
TLP:WHITE3 IOCs

Up a Creek Without a Command Line: Mapping an Akira Ransomware Attack

HU
Huntress
Published October 6, 2026Original Report

Threat Actors

Malware Families

Diamond Model

SOCIAL AXISTECHNOLOGY AXISADVERSARYAkiraCl0pSandwormINFRASTRUCTURE64.227.4.134CAPABILITYAkiraCl0pCobalt StrikeVICTIMunknown
Adversary(4)
Infrastructure(1)
Capability(6)
Victim

Indicators of Compromise

Indicators of Compromise3

TypeIndicatorConfidenceScoreFirst Seen
SHA2561f1bb322591b6d27fd2946e373d7d2efc2f4e1e66818846060d391600b600fba
exploitfile-hashintel-blog
High
61
Oct 9, 26
IP64.227.4.134
exploitintel-blogmalware
High
64
Oct 9, 26
SHA256d00833318a04caa019c6f95dcb3598ad947d405010bfb2f3cbd04530a00bc3a4
exploitfile-hashintel-blog
High
61
Oct 9, 26

IOC Relationship Graph

IOC Relationship Graph3 total IOCs
SHA256IP
SHA2562IP1Actors4Malware5REPORTUp a Creek Without a CommaAkiraCl0pSandwormUNC5330AkiraCl0pCobalt StrikeMETA StealerProcdump
scroll to zoom · drag to pan · click IOC to open