Three names keep surfacing in incident reports, ransom notes and post-incident calls: Black Basta, LockBit and Akira. They differ in style, scale and target selection, but strip away the branding and you find the same skeleton underneath — stolen credentials, lateral movement, data theft, encryption, pressure. For defenders, that overlap is useful. Controls that blunt one of these groups tend to blunt all three, and most of the work sits in places you already own.
Three Groups, Three Personalities
LockBit is the volume player. It runs on a ransomware-as-a-service model: the core team maintains the encryptor, the leak site and the negotiation portal, while affiliates do the breaking and entering and take a cut. That structure made it fast, opportunistic and widely spread across healthcare, manufacturing, logistics and public bodies. Its exfiltration tooling moved data out before encryption began. A coordinated takedown in early 2024 disrupted its public infrastructure, but affiliates and rebuilt variants kept working. Treat LockBit as an ecosystem, not a single adversary.
Black Basta arrived in 2022 and behaves more like a boutique operation — fewer victims, larger organisations, longer negotiations. It became known for a distinctly human trick: flooding a mailbox with spam until the target is desperate for help, then calling as IT support to walk them through installing remote management software. Researchers have linked the group to QakBot infrastructure and to people who once worked in the Conti ecosystem.
Akira appeared in 2023 and has proven durable. Its signature move is logging into VPN appliances that were never protected with multi-factor authentication, often using credentials harvested by infostealer malware. It also ships a Linux encryptor aimed at VMware ESXi hosts, which is why victims frequently lose whole virtual estates rather than a handful of file servers. Small and mid-sized businesses — professional services, manufacturing, education, clinics — make up a large share of its victims.
The Entry Points They Share
Attack chains vary in the details, but the front doors are remarkably consistent. If you were to audit only five things, these are the ones worth auditing:
- Remote access without MFA. VPN concentrators, RDP gateways and remote support tools are the single most reused way in.
- Unpatched edge devices. Firewalls, VPN appliances and file transfer servers sit on the internet and are rarely in anyone's patch calendar.
- Valid credentials. Logs from infostealer malware are cheap and plentiful. A reused password from a personal account can open a corporate one.
- Help desk manipulation. An attacker who can talk a service desk into resetting MFA on an account does not need an exploit at all.
- Trusted third parties. Managed service providers and MSP tools give an intruder a legitimate path into dozens of networks at once.
Who They Target, and Why It Matters
Victim selection is rarely random. Groups gravitate toward organisations with a combination of revenue, insurance coverage and thin security teams. That is why hospitals, manufacturers, school districts, municipal governments and mid-market professional firms appear so often: the data is sensitive, downtime is expensive, and an unscheduled outage is felt immediately.
Size is not protection. Akira's focus on smaller companies reflects a simple calculation — a mid-sized firm with no dedicated security staff is easier to compromise and may pay faster than a bank. If your organisation has fewer than 500 staff and no one whose full-time job is security, assume you are in scope.
Double Extortion and the Leak Site Economy
Encryption alone is no longer the threat. Modern operations steal first and encrypt second, which means reliable backups reduce damage but do not remove the leverage. The second lever is disclosure: customer lists, contracts, payroll data and medical records posted publicly, plus the regulatory and contractual obligations that follow.
That shift changes the recovery plan. If your backups work perfectly and you restore within a day, you may still be facing notification duties, legal exposure and clients asking hard questions. Ask your counsel and insurer ahead of time what triggers a breach notification obligation in your jurisdiction, and keep that answer written down somewhere offline.
Defenses That Interrupt the Chain
Identity and access
Roll out phishing-resistant MFA on every remote access path and every privileged account. Kill dormant accounts, service accounts with interactive logon rights, and any local administrator access that is not strictly needed. Put a verification procedure in front of password and MFA resets at the service desk — for example, a callback to a number already on file for that employee, never a number the caller supplies.
Edge devices and patching
Keep a written inventory of everything you expose to the internet. That list is your patch priority. Where a fix is not yet available, use vendor mitigations, restrict access by geography or IP, and require MFA at the appliance itself. An edge device that has been out of support for two years is an incident waiting to be scheduled.
Detection and visibility
You cannot stop what you cannot see. Collect authentication logs from VPNs and identity providers, keep EDR running on servers and hypervisors, and alert on the boring signals: a service account logging in at 3 a.m., a sudden spike in outbound traffic, mass file renames, a new administrative account created outside change control. A single honeytoken file in a share nobody should touch will tell you an intruder is browsing faster than most detection rules.
Backups and recovery
Follow the rule of three: one copy online for speed, one immutable or offline copy that ransomware cannot encrypt or delete, and one kept separate from your production credentials. Then do the part most teams skip — restore something real, on a schedule, and time it. A backup you have never restored is a hope, not a control.
Your First Five Moves
Perfect security is not required. Making the operation expensive is enough to send most crews looking for an easier target. Start here:
- Enforce MFA on every remote access path this month, starting with VPN and remote support tools.
- Inventory and patch your internet-facing devices, and document what you cannot patch yet.
- Create one immutable, offline backup copy and prove a restore works.
- Write a one-page containment checklist: who can isolate a host, who calls the insurer, who talks to staff.
- Run a 60-minute tabletop with IT, legal and communications in the same room. Argue about the hard parts before they are real.
None of this is glamorous. It is also the difference between a bad week and a company-ending one. Where legal, insurance or regulatory obligations are involved, bring in qualified counsel early — your insurer usually has a panel for exactly this reason.
Photo: Alexandra_Koch / Pixabay
