Akira attacks El Milagro
Incident Date:
July 25, 2023
Overview
Title
Akira attacks El Milagro
Victim
El Milagro
Attacker
Akira
Location
First Reported
July 25, 2023
The Akira Ransomware Gang's Attack on El Milagro
The Akira ransomware gang has attacked El Milagro. El Milagro is a well-established and reputable Mexican food company that has garnered recognition for its authentic and traditional culinary offerings. Specializing in the production of tortillas, tamales, and other Mexican delicacies, the company has become a popular choice among consumers seeking genuine flavors and high-quality products. Founded on the principles of family traditions and time-honored recipes, El Milagro takes pride in using premium ingredients and adhering to traditional preparation methods. This dedication to maintaining the essence of Mexican cuisine has earned them a loyal customer base, both within the local communities they serve and beyond.
Akira posted El Milagro to its data leak site on July 25th, claiming to have stolen personal information, accounting and financial data, but provided no further details.
The Akira Ransomware Methodology
The Akira ransomware gang, first identified in May 2023, utilizes the Windows Restart Manager API to effectively close processes or terminate Windows services that might be actively using a file, thereby allowing the encryption process to proceed unhindered. In each computer folder affected by the ransomware, a ransom note named "akira_readme.txt" is placed. This note serves as a communication from the attackers, explaining the situation and providing links to the Akira data leak and negotiation sites.
The ransom note issued by the Akira group contains a chilling warning: "Regarding your data, in the event that we fail to reach an agreement, we will attempt to sell your personal information, trade secrets, databases, source codes, and anything else deemed valuable on the dark market to multiple threat actors simultaneously. Subsequently, all of this compromised information will be publicly exposed on our blog."
Impact and Tactics of the Akira Gang
Like other ransomware groups, the Akira gang infiltrates corporate networks and expands its reach to other connected devices. After acquiring Windows domain admin credentials, the threat actors deploy their ransomware across the entire network. Before encrypting the files, the attackers take the additional step of exfiltrating sensitive corporate data. This stolen information is then used as leverage during their extortion tactics, as they warn victims that the data will be made public unless a ransom payment is made.
The Akira gang has invested considerable effort into designing their data leak website, which features a retro aesthetic and allows visitors to navigate through it using command inputs.
Recent Ransomware Attacks
The Recent Ransomware Attacks (RRA) site acts as a watchtower, providing you with near real-time ransomware tracking of attacks, groups and their victims. Given threat actors’ overarching, lucrative success so far, ransomware attacks have become the most ubiquitous, and financially and informationally impactful cyber threat to businesses and organizations today.
The site’s data is generated based on hosting choices of real-world threat actors, and a handful of other trackers. While sanitization efforts have been taken, we cannot guarantee 100% accuracy of the data. Attack updates will be made as source data is reported by reputable sources. By viewing, accessing, or using RRA you acknowledge you are doing so at your own risk.