Akira

Akira is a ransomware-as-a-service operation and ransomware family that emerged in 2023 and became a prominent financially motivated threat through double-extortion attacks. The group steals data before encryption and pressures victims with both operational disruption and threatened public release of stolen information. Akira has been associated by multiple vendors with former Conti-linked tradecraft and is also tracked under aliases including Howling Scorpius, Storm-1567, PUNK SPIDER, GOLD SAHARA, and MITRE group identifier G1024.

Akira initially deployed a Windows encryptor written in C++, later introduced a Rust-based variant known as Megazord, and expanded to Linux and ESXi environments. Reporting also describes encryption of virtualized infrastructure including VMware ESXi and, in later activity, Nutanix AHV. The malware supports multithreaded encryption, drive and process enumeration, process termination, shadow copy deletion, ransom note creation, and file encryption using hybrid cryptography. Operators commonly target backup, database, and security-related services before encryption to inhibit recovery and maximize impact.

Observed Akira intrusions span the full ransomware lifecycle. Initial access has been repeatedly linked to compromised VPN credentials, especially where MFA is absent, exploitation of edge-device and VPN vulnerabilities, spearphishing, brute-force activity against remote access services, access purchased from initial access brokers, and at least one documented SEO-poisoning chain that delivered a trojanized enterprise software installer. Post-compromise activity includes creation of privileged accounts, deployment of remote access tools for persistence, credential theft from LSASS, Active Directory, backup systems, browsers, and other stores, broad internal reconnaissance, lateral movement via RDP, SMB, SSH, PsExec, WMI, and related administrative mechanisms, and exfiltration of archived data to external services before encryption.

Akira operators have also demonstrated strong defense-evasion tradecraft. Reported behavior includes disabling endpoint protections, clearing event logs, deleting shadow copies and backup catalogs, using covert tunneling services, and employing bring-your-own-vulnerable-driver techniques to neutralize security controls. Commonly observed tooling in Akira intrusions includes credential-dumping utilities, remote administration software, network scanners, Active Directory discovery tools, archivers, and file-transfer clients.

Victimology is broad, with repeated targeting across manufacturing, industrial services, healthcare, education, finance, IT, retail, and other enterprise sectors, with especially heavy activity reported in North America and Europe. Akira has been repeatedly described as one of the most active ransomware groups of the mid-2020s and a significant threat to organizations with exposed remote access infrastructure, weak identity protections, and recoverable but insufficiently isolated backup environments.