Check Point picks apart Akira's Rust ransomware for ESXi

Check Point analyzed the Rust-based variant of Akira ransomware that affiliates promoted as “Akira v2” in early 2024. By default it targets VMware ESXi, encrypting everything under /vmfs/volumes and optionally powering off virtual machines first, but it has all it needs to work as general-purpose Linux ransomware. The researchers blame most of the reversing pain on release-mode compilation and aggressive inlining rather than deliberate obfuscation. To experiment with Rust, the authors left behind many of their usual anti-analysis tricks and leaned on ready-made crates such as seahorse, indicatif and rust-crypto, and that boilerplate turned out to be a gift to the analysts. Cisco Talos reported that the original Linux encryptor was written in C++, and that new C++ samples from September 2024 suggest the group is going back to C++ encryptors for Windows and Linux, now using the faster ChaCha8 stream cipher. Rust’s mix of cross-platform support, good ergonomics and ready-made libraries keeps attracting malware authors, but Akira shows that not every experiment sticks.