Consider the following statements regarding Akira Ransomware: It is de...
Statement 1: It is designed to encrypt data and create a ransomware note.
Yes, this statement is correct. Akira Ransomware is a type of malware that is specifically designed to encrypt data on a victim's device and then demand a ransom in exchange for the decryption key. Once the ransomware infects a system, it scans for files and encrypts them using a strong encryption algorithm. This effectively locks the victim out of their own data. After the encryption process is complete, Akira Ransomware typically creates a ransom note that provides instructions on how to pay the ransom and obtain the decryption key. The note usually includes information such as the amount of the ransom, the Bitcoin wallet address to send the payment to, and sometimes even a deadline for payment.
Statement 2: It is found to target only Windows devices.
No, this statement is incorrect. Akira Ransomware targets not only Windows devices but also other operating systems such as macOS and Linux. Ransomware attacks can target any device that has vulnerabilities that can be exploited to gain unauthorized access. While Windows devices have historically been more commonly targeted due to their larger user base, other operating systems are not immune to ransomware attacks. In fact, there have been several instances of Akira Ransomware infecting macOS and Linux systems as well.
In conclusion, statement 1 is correct as Akira Ransomware is designed to encrypt data and create a ransomware note. However, statement 2 is incorrect as Akira Ransomware can target not only Windows devices but also macOS and Linux systems.
Consider the following statements regarding Akira Ransomware: It is de...
Recently, the Computer Emergency Response Team of India issued an alert for ransomware dubbed Akira.
- It is designed to encrypt data, create a ransomware note and delete Windows Shadow Volume copies on affected devices.
- The ransomware gets its name due to its ability to modify filenames of all encrypted files by appending them with the “.akira” extension.
How does Akira Ransomware work?
- The ransomware is designed to close processes or shut down Windows services that may keep it from encrypting files on the affected system.
- It uses VPN services, especially when users have not enabled two-factor authentication, to trick users into downloading malicious files.
- The ransomware also terminates active Windows services using the Windows Restart Manager API, preventing any interference with the encryption process.
- It is designed to not encrypt Program Data, Recycle Bin, Boot, System Volume information, and other folders instrumental in system stability.
- It also avoids modifying Windows system files with extensions like .syn. .msl and .exe.
- Once sensitive data is stolen and encrypted, the ransomware leaves behind a note named akira_readme.txt which includes information about the attack and the link to Akira’s leak and negotiation site.
- Each victim is given a unique negotiation password to be entered into the threat actor’s Tor site.
- Unlike other ransomware operations, this negotiation site just includes a chat system that the victim can use to communicate with the ransomware gang.
- The ransomware found to target both Windows and Linux devices.
Hence only statement 1 is correct.
To make sure you are not studying endlessly, EduRev has designed UPSC study material, with Structured Courses, Videos, & Test Series. Plus get personalized analysis, doubt solving and improvement plans to achieve a great score in UPSC.