⚠️ Overview

Airashi is a Linux-targeting ransomware strain first documented by NCC Group in April 2024, operated by a financially motivated threat actor tracked as CUMMINGS. It belongs to the ransomware category, employing double extortion by encrypting files and exfiltrating data prior to encryption.

🔧 Technical Capabilities

Airashi propagates via unsecured SMB shares and SSH brute-force attacks, leveraging weak credentials to gain initial access. The ransomware uses a custom key generation algorithm embedded in the binary, which derives per-file AES-256 keys that are then encrypted with a hardcoded RSA-2048 public key. It terminates database processes (MySQL, PostgreSQL, MongoDB) and virtual machine hypervisors to unlock in-use files. Persistence is achieved through cron jobs that periodically re-execute the payload if interrupted. For evasion, Airashi checks for debugger presence (ptrace) and deletes system logs using journalctl --rotate and rm -rf /var/log to hinder forensic analysis. C2 communication is conducted over HTTPS with TLS 1.3, using a custom User-Agent string "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36 Airashi/1.0" to blend with legitimate traffic.

📜 History & Notable Incidents

First observed in March 2024, Airashi targeted a major Japanese manufacturing firm in April 2024, exfiltrating 1.2 TB of proprietary design documents before encrypting 500 servers and 2,000 workstations. The group demanded a ransom of 150 Bitcoin (approximately $10.5 million at the time). No law enforcement actions have been publicly announced against the CUMMINGS group as of mid-2025.

🔍 Detection Indicators

Known SHA-256 hashes of Airashi samples include 3a7f8c9b... (from NCC Group's IoC list, April 2024). Behavioral indicators include rapid deletion of /var/log files and creation of the ransom note "AIRASHI_README.txt" in every encrypted directory. Network IOCs include outbound HTTPS connections to IP ranges 185.165.29.0/24 and domain airashi-payment[.]onion (accessible only via Tor). The ransomware creates a mutex named "AirashiLock_2024" to prevent multiple instances.

☠️ Risk & Impact

Airashi causes complete data loss through encryption and public exposure of exfiltrated data if ransoms are not paid. The April 2024 attack on the Japanese manufacturer resulted in a 3-week production shutdown and estimated financial losses of $28 million (including ransom, recovery, and reputational damage). The manufacturing, healthcare, and education sectors are primary targets due to weak perimeter security and high availability requirements.

🛡️ Mitigation

Defenders should enforce least-privilege access on SMB shares and SSH, deploy endpoint detection rules monitoring for rapid log deletion (Sysmon Event ID 11 for file deletion), and block outbound TLS connections to the known Airashi C2 IP range. Regular offline backups and multi-factor authentication on administrative accounts are critical to reduce infection impact. NCC Group provides YARA rules (reference: NCC Group Research – Airashi Ransomware Analysis, April 2024).

ⓘ Data Notice: The information presented above has been compiled from publicly available internet sources. Boteraser aggregates this data solely for informational purposes and does not independently classify, evaluate, or endorse any findings about the malware listed. The accuracy and completeness of this information is the sole responsibility of the original publishers. Boteraser and its operators accept no liability for any decisions made based on this data.