--- title: What is Akira ransomware and how does Akira ransomware attack your organization? description: Akira ransomware has extorted $244M from SMBs via VPN exploits since 2023. See its attack chain and how Acronis defends against it. canonical_url: https://www.acronis.com/en/tru/threat-catalog/malware/ransomware/akira/ locale: en last_updated: 2026-10-11 --- # What is Akira ransomware and how does Akira ransomware attack your organization? Akira ransomware has extorted $244M from SMBs via VPN exploits since 2023. See its attack chain and how Acronis defends against it. [Download Threat Report](https://www.acronis.com/en/resource-center/resource/acronis-cyberthreats-report-h2-2025/) [See How Acronis Stops Threats](https://www.acronis.com/en/products/cloud/demo/) ## Key takeaways * Akira is a ransomware-as-a-service (RaaS) operation that has been active since March 2023. * Akira affiliates have collected approximately $244 million in claimed ransom proceeds as of late September 2025, per a joint advisory from [CISA, the FBI and Europol](https://www.cisa.gov/news-events/cybersecurity-advisories/aa24-109a). * Akira primarily targets small and medium-sized businesses across manufacturing, education, health care, financial services and information technology. * Initial access typically comes through VPN vulnerabilities in Cisco and SonicWall appliances, or through stolen credentials. * Akira is assessed to have code-level and financial links to the Conti ransomware group, though no confirmed formal organizational connection exists. ## What is Akira ransomware? ### When did the Akira ransomware group first appear? Akira ransomware was first observed in March 2023. The group initially targeted Windows systems with a C++-based encryptor, and by April 2023 had added a Linux variant capable of encrypting VMware ESXi virtual machines. Akira operates as a ransomware-as-a-service group, publishing victims to a distinctive Tor-based leak site styled after a retro green-screen terminal. A core developer team builds and maintains the ransomware and recruits affiliates who carry out individual intrusions; the developers retain control over ransom demands and negotiation terms. Because affiliates bring their own tactics, techniques and procedures, no single playbook defines every Akira attack. ### Is the current Akira group related to the 2017 Akira ransomware? No. A ransomware variant also named Akira was briefly observed in 2017, and both versions append the .akira extension to encrypted files, which has caused confusion in search results and reporting. The two are distinct malware families with no shared code or infrastructure. This distinction is confirmed by a [Health Sector Cybersecurity Coordination Center (HHS HC3)](https://www.hhs.gov/sites/default/files/akira-randsomware-analyst-note-feb2024.pdf) analyst note from February 2024 and by Trend Micro. ### What connection does Akira ransomware have to the Conti ransomware group? Akira shows two independent lines of evidence connecting it to the Conti ransomware group, though no confirmed formal organizational link has been established. The first is code overlap: researchers at Trend Micro, [Avast](https://www.gendigital.com/blog/insights/research/decrypted-akira-ransomware) and [Qualys](https://blog.qualys.com/vulnerabilities-threat-research/2024/10/02/threat-brief-understanding-akira-ransomware) have documented that Akira shares file exclusion lists, directory exclusion patterns, its ChaCha encryption implementation and other functions with Conti. Because Conti's source code was leaked publicly in March 2022, code similarity alone does not confirm organizational continuity between the two groups. The second is blockchain analysis: [Arctic Wolf Labs](https://arcticwolf.com/resources/blog/conti-and-akira-chained-together/) identified at least three transactions totaling more than $600,000 in which Akira threat actors sent ransom proceeds to Conti-affiliated wallet addresses, two of which were linked to Conti's leadership team. [TRM Labs](https://www.trmlabs.com/resources/intel-library/akira) has separately identified on-chain links between Akira and the Fog and Frag ransomware groups. Arctic Wolf has assessed with high confidence that some Conti-affiliated threat actors are now linked to Akira, but characterizes this as individual actor movement rather than a formal rebrand. CISA's advisory uses the more cautious phrase that Akira actors "may have connections" to Conti. ## Who does Akira ransomware target? ### Which industries does Akira ransomware attack most frequently? According to the November 2025 update to the joint CISA advisory, Akira most frequently targets manufacturing, educational institutions, information technology, health care and public health, financial services and food and agriculture. Vendor reporting from [Cisco Talos](https://blog.talosintelligence.com/akira-ransomware-continues-to-evolve/), [Trellix](https://www.trellix.com/blogs/research/akira-ransomware/) and [Cyberint](https://cyberint.com/blog/research/akira-ransomware-what-soc-teams-need-to-know/) additionally identifies business services, construction and legal services among targeted sectors. Sector targeting varies by affiliate, since individual Akira affiliates choose their own targets within the RaaS model. ### Why are small and medium-sized businesses at higher risk from Akira ransomware? CISA explicitly states that Akira "primarily targets small- and medium-sized businesses." SMBs are attractive targets because they are more likely to rely on single-factor VPN authentication, have less mature [patch management](https://www.acronis.com/en/products/cloud/cyber-protect/rmm-solution/), run limited security operations center (SOC) coverage and have fewer resources to resist extortion demands. Managed service providers are also directly targeted: an [Acronis Threat Research Unit (TRU) blog](https://www.acronis.com/en/tru/posts/msps-a-top-target-for-akira-and-lynx-ransomware/) from 2025 cites the Hitachi Vantara and Toppan Next Tech incidents as examples. ### Which countries are most affected by Akira ransomware attacks? Akira's victims are concentrated in the United States, Canada and Western Europe, with additional victims in Australia, Brazil and countries across Asia and Latin America. Leak site data shows the United States accounts for the majority of disclosed victims. TRM Labs has assessed that Akira's operators are likely based in Russia or the broader post-Soviet region, and the group communicates in Russian on dark web forums. ## How does an Akira ransomware attack work? ### What is the step-by-step Akira ransomware attack lifecycle? Akira intrusions generally proceed through six phases, from initial network entry to encryption and extortion. The table below maps each phase to the attacker's goal and its business impact. **Phase** **Attacker goal** **What does an Akira attack mean for your business?** 1. Initial access Gain network entry via compromised VPN credentials (purchased from brokers or brute-forced), exploitation of unpatched Cisco (CVE-2023-20269) or SonicWall (CVE-2024-40766) appliances, spearphishing or exposed RDP. Akira preferentially targets VPNs without MFA. Perimeter breach. The attacker has authenticated network access indistinguishable from legitimate user traffic. No alert if MFA is absent. 2. Persistence and credential access Create rogue domain accounts (observed naming convention: "itadm"). Install legitimate remote access tools (AnyDesk, LogMeIn, RustDesk) for persistent access. Use Mimikatz, LaZagne and comsvcs.dll MiniDump to extract credentials from LSASS. Perform Kerberoasting. Use PowerShell to dump Veeam credentials and Kerberos tickets. The attacker has persistent access via multiple channels. Domain credentials are compromised and backup server credentials are exposed. Closing the initial entry point does not remove the attacker. 3. Discovery and lateral movement Enumerate Active Directory using AdFind and Nltest. Scan internal networks with Advanced IP Scanner and MASSCAN. Move laterally via RDP and SMB using stolen credentials. Access SharePoint repositories. Use Ngrok tunnels to establish command and control (C2) that bypasses perimeter monitoring. The attacker maps the full environment, including domain controllers, backup servers, file servers and hypervisors. Data collection begins and a C2 channel is established for ongoing control. 4. Defense evasion Disable or modify endpoint security tools (PowerTool). Clear event logs. Use binary padding to obfuscate payloads. Modify the Windows registry to disable Defender. Hide rogue accounts from the login screen via a Userlist registry modification. Security team visibility is degraded and historical forensic evidence is destroyed, letting the attacker operate with a reduced risk of detection. 5. Data exfiltration Archive target data using WinRAR. Exfiltrate using FileZilla, WinSCP, RClone (to Mega or other cloud storage), or Ngrok-based tunnels. Exfiltration can be completed in as little as two hours from Veeam servers, per vendor reporting. Confidential data, including customer PII, financial records and intellectual property, has left the network. This enables a "double extortion" threat regardless of whether encryption succeeds. 6. Encryption and extortion Delete Volume Shadow Copies via WMI. Encrypt files using a hybrid ChaCha20/RSA scheme. Deploy platform-appropriate encryptors for Windows (.akira/.akiranew), ESXi (Akira_v2) and Nutanix AHV. In some cases, delete data outright instead of encrypting it. Deliver a ransom note directing victims to a Tor-based negotiation site, and contact victims by phone to apply additional pressure. Business operations halt. File recovery is blocked by shadow copy deletion. Ransom demands range from $200,000 to more than $4 million. Even where backups exist, the exfiltrated data creates ongoing extortion leverage. Downtime is measured in days to weeks. Documented dwell times illustrate how fast this lifecycle can complete. Arctic Wolf reported sub-four-hour intrusions during the 2025 SonicWall campaign, with the fastest observed case reaching encryption in approximately 55 minutes from initial access. [The DFIR Report](https://thedfirreport.com/2025/08/05/from-bing-search-to-ransomware-bumblebee-and-adaptixc2-deliver-akira/) separately documented a Bumblebee-to-Akira intrusion chain that took roughly 44 hours to reach first encryption. This range underscores why automated detection and [immutable backups](https://www.acronis.com/en/products/cloud/cyber-protect/backup/) matter more than manual response speed: manual SOC triage alone may be too slow to intervene before encryption begins. ## How much financial damage has Akira ransomware caused? ### How much has Akira ransomware collected in ransom payments? Akira's ransom collection has grown sharply since the group's emergence. The original joint CISA and FBI advisory, published in April 2024, attributed $42 million in ransom payments to Akira from approximately 250 organizations between March 2023 and January 2024. An updated advisory from CISA, the FBI and Europol, issued in November 2025, raised that figure to $244.17 million in claimed proceeds as of late September 2025. TRM Labs separately reports that Akira collected more than $150 million in 2025 alone, making it the most prolific ransomware group by ransom proceeds that year. Individual ransom demands range from $200,000 to more than $4 million, according to the Department of Health and Human Services' Health Sector Cybersecurity Coordination Center. These figures represent claimed proceeds. Actual amounts may differ, and verification methodology varies by source. ### How many organizations has Akira ransomware compromised? TRM Labs recorded approximately 980 victims posted to Akira's leak site between January 1 and December 11, 2025. [Ransomware.live](https://ransomware.live/group/akira) separately tracks approximately 1,387 known Akira victims as of late 2025. The original April 2024 advisory noted more than 250 organizations, and Cyberint recorded a record month in November 2024, with more than 30 victims posted in a single day. Leak site victim counts represent only publicly disclosed victims and are unlikely to be comprehensive, since many organizations pay ransoms and are never listed. ## What vulnerabilities does Akira ransomware exploit? ### Which Cisco and SonicWall CVEs has Akira ransomware exploited? The table below lists the CVEs most associated with Akira intrusions, drawn from the November 2025 CISA advisory and Cisco Talos reporting. **CVE** **Product** **Vulnerability type** CVE-2020-3259 Cisco ASA / AnyConnect Information disclosure CVE-2020-3580 Cisco ASA Cross-site scripting (added November 2025) CVE-2023-20269 Cisco ASA / FTD Unauthorized VPN access (brute-force enablement) CVE-2024-40766 SonicWall SonicOS Improper access control (primary 2025 campaign vector) CVE-2023-28252 Windows CLFS Heap-based buffer overflow (privilege escalation) CVE-2024-37085 VMware ESXi Authentication bypass CVE-2023-27532 Veeam Backup and Replication Missing authentication for a critical function CVE-2024-40711 Veeam Backup and Replication Deserialization of untrusted data CVE-2023-48788 Fortinet FortiClientEMS SQL injection (per Cisco Talos) ### How does Akira ransomware target backup infrastructure? Akira specifically targets backup infrastructure to remove an organization's ability to recover without paying. The group exploits two Veeam Backup and Replication vulnerabilities, CVE-2023-27532 and CVE-2024-40711, and uses PowerShell scripts to dump Veeam credentials during the persistence and credential access phase of an intrusion. During the final phase, operators delete Volume Shadow Copies using Windows Management Instrumentation. In some cases, Akira deletes data outright instead of encrypting it, which prevents recovery through data-carving techniques. [Finland's National Cyber Security Centre](https://www.kyberturvallisuuskeskus.fi/en/news/national-cyber-security-centre-finlands-weekly-review-522023) has separately warned that Akira specifically targets and wipes backup infrastructure. ## How does Akira ransomware map to the MITRE ATT&CK framework? The table below maps Akira's observed techniques to MITRE ATT&CK IDs and tactics, sourced from [MITRE ATT&CK Group G1024](https://attack.mitre.org/groups/G1024/) and Software entries [S1129](https://attack.mitre.org/software/S1129/) (Akira ransomware), [S1191](https://attack.mitre.org/software/S1191/) (Megazord) and [S1194](https://attack.mitre.org/software/S1194/) (Akira_v2), cross-referenced with CISA Advisory AA24-109A (November 2025 update) and ATT&CK version 18. **Technique name** **ATT&CK ID** **Tactic** External Remote Services T1133 Initial Access Valid Accounts T1078 Initial Access / Persistence Exploit Public-Facing Application T1190 Initial Access Spearphishing Attachment / Link T1566.001 / T1566.002 Initial Access Brute Force / Password Spraying T1110 / T1110.003 Credential Access Create Account: Domain Account T1136.002 Persistence Remote Access Tools (AnyDesk, RustDesk) T1219 Persistence / Command and Control Command and Scripting Interpreter: PowerShell T1059.001 Execution Command and Scripting Interpreter: VBScript T1059.005 Execution Windows Management Instrumentation T1047 Execution OS Credential Dumping: LSASS Memory T1003.001 Credential Access Steal or Forge Kerberos Tickets (Kerberoasting) T1558 Credential Access Remote Desktop Protocol T1021.001 Lateral Movement Remote Services: SSH T1021.004 Lateral Movement Lateral Tool Transfer T1570 Lateral Movement Domain Trust Discovery T1482 Discovery Remote System Discovery T1018 Discovery Network Share Discovery T1135 Discovery System Information Discovery T1082 Discovery Process Discovery T1057 Discovery Impair Defenses: Disable or Modify Tools T1562.001 Defense Evasion Masquerading T1036.005 Defense Evasion Obfuscated Files: Binary Padding T1027.001 Defense Evasion Protocol Tunneling (Ngrok) T1572 Command and Control Archive Collected Data: Archive via Utility (WinRAR) T1560.001 Collection Data from Information Repositories: SharePoint T1213.002 Collection Exfiltration to Cloud Storage (RClone) T1567.002 Exfiltration Data Encrypted for Impact T1486 Impact Inhibit System Recovery (shadow copy deletion) T1490 Impact Service Stop T1489 Impact Account Access Removal T1531 Impact Financial Theft (double extortion) T1657 Impact ## How does Acronis protect against Akira ransomware? Acronis maps its defensive capabilities to the six lifecycle phases described above. The table below shows the risk at each phase, the capability required to address it, and the corresponding Acronis response. **Attack stage** **Risk** **Required capability** **Acronis capability** **Outcome** 1. Initial access Network entry via compromised VPN credentials or exploitation of unpatched Cisco and SonicWall vulnerabilities Automated vulnerability identification and patch deployment [Vulnerability assessment](https://www.acronis.com/en/products/cloud/cyber-protect/) (standard) and automated patch management (Advanced Management add-on) Closes the CVEs that are Akira's primary entry points before affiliates exploit them. Credential rotation should accompany patch deployment: Arctic Wolf found SonicWall credentials exfiltrated before patching in some cases. 2. Persistence and credential access Rogue domain account creation, LSASS credential dumping, Kerberoasting and Veeam credential theft Post-exploitation behavioral detection and isolated backup credentials [EDR](https://www.acronis.com/en/products/cloud/cyber-protect/security-edr/)/[XDR](https://www.acronis.com/en/products/cloud/cyber-protect/extended-detection-and-response/) and immutable, isolated backups Detects credential-theft tooling in progress and keeps backup credentials out of reach of Veeam-targeted harvesting. 3. Discovery and lateral movement Active Directory enumeration, internal network scanning and lateral movement via RDP and SMB using stolen credentials Cross-endpoint correlation EDR/XDR cross-endpoint correlation Identifies lateral movement using stolen credentials across the environment. 4. Defense evasion Disabling or modifying endpoint security tools, clearing event logs and registry changes to disable Defender Tamper-resistant agent Anti-tampering ([Active Protection](https://www.acronis.com/en/products/cloud/cyber-protect/features/)) Resists attempts to disable security tooling, preserving detection coverage. 5. Data exfiltration Archiving and exfiltration via FileZilla, WinSCP, RClone or Ngrok tunnels, in as little as two hours from Veeam servers Post-exploitation detection of exfiltration tooling EDR/XDR (detects RClone execution) Flags exfiltration tooling in use. Immutable backup does not neutralize data that has already been exfiltrated. 6. Encryption and extortion Shadow copy deletion via WMI, hybrid ChaCha20/RSA encryption and platform-specific encryptors for Windows, ESXi and Nutanix AHV Real-time behavioral encryption detection and immutable, rollback-capable recovery Active Protection and immutable cloud backup with automated rollback Blocks encryption activity in progress, including zero-day variants, and restores files to their pre-attack state even if shadow copies are deleted. ## Frequently asked questions about Akira ransomware ### Can Akira ransomware be decrypted without paying the ransom? Generally, no. Avast released a free decryptor for early Akira versions in June 2023, but Akira's developers patched the underlying encryption flaw shortly afterward. There is no publicly known decryptor for Akira variants released after July 2023, nor for the Megazord or Akira_v2 variants. Recovery depends on having clean, isolated backups available before an attack occurs. ### How quickly can Akira ransomware encrypt a network after initial access? Dwell times vary by affiliate and target environment. Arctic Wolf documented sub-four-hour intrusions during the 2025 SonicWall campaign, with the fastest case reaching encryption in approximately 55 minutes. The DFIR Report documented a separate Bumblebee-to-Akira intrusion chain that took roughly 44 hours to reach first encryption. This range shows why automated detection matters more than manual response speed. ### Does Akira ransomware target VMware ESXi and other hypervisors? Yes. Akira has targeted VMware ESXi since April 2023 through its Akira_v2 variant and added Nutanix AHV capability by June 2025. Targeting hypervisors directly allows mass encryption of many virtual machines from a single point of control. See the attack lifecycle section above for the technical detail behind this capability. ### What should an organization do if it is infected with Akira ransomware? Isolate affected systems immediately. Do not pay the ransom: The FBI and CISA strongly discourage payment. Preserve forensic evidence and engage an incident response team. Restore systems from clean, offline backups. Report the incident to the FBI's Internet Crime Complaint Center and, if applicable, the local CISA field office. Check whether a working decryptor exists for the specific variant involved, though this is unlikely for current Akira variants. ### How does Akira ransomware differ from LockBit and other major ransomware groups? Akira is a ransomware-as-a-service operation like LockBit, but it runs a closed operation with controlled affiliate recruitment, compared with LockBit's more open affiliate model. Akira preferentially targets small and medium-sized businesses, while LockBit has historically targeted larger organizations. Akira's assessed Conti lineage and its aggressive VPN exploitation further differentiate its operational playbook. Unlike some ransomware groups, Akira does not state a ransom demand up front; victims must contact the group directly to receive a demand. ### What indicators of compromise are associated with Akira ransomware? The CISA advisory (AA24-109A, updated November 2025) contains the most current indicator set. Because indicators of compromise rotate frequently, behavioral indicators tend to be more durable for detection. These include creation of an "itadm" administrative account, Ngrok tunnel activity, WinRAR archiving followed by RClone-based exfiltration, WMI-based shadow copy deletion and files appended with the .akira, .akiranew or .aki extensions. See the MITRE ATT&CK table above for the full technique mapping. Related attacks & insights 21 August 2025 ![Image 1: MSP cybersecurity news digest, August 13, 2025](https://staticfiles.acronis.com/images/content/e0b3027fff454658d74877d4beea84be.png) [MSP cybersecurity news digest, August 13, 2025](https://www.acronis.com/en/tru/posts/msp-cybersecurity-news-digest-august-13-2025/) Clinical data stolen in cyberattack on dialysis provider DaVita, Chanel, Pandora, Google and Cisco... Author:[Acronis Threat Research Unit](https://www.acronis.com/en/tru/authors/acronis-threat-research-unit/) 04 August 2025 ![Image 2: MSPs a top target for Akira and Lynx ransomware](https://staticfiles.acronis.com/images/content/8cfdba1c0ff43a2f6dd7cbf1db6f4fc2.png) [MSPs a top target for Akira and Lynx ransomware](https://www.acronis.com/en/tru/posts/msps-a-top-target-for-akira-and-lynx-ransomware/) Acronis Threat Research Unit (TRU) analyzed recent samples of Akira and Lynx ransomware families to... Author:[Acronis Threat Research Unit](https://www.acronis.com/en/tru/authors/acronis-threat-research-unit/) 20 May 2025 ![Image 3: MSP cybersecurity news digest, May 12, 2025](https://staticfiles.acronis.com/images/content/c2a97def6823ea859c5fbb1d98216f07.png) [MSP cybersecurity news digest, May 12, 2025](https://www.acronis.com/en/tru/posts/msp-cybersecurity-news-digest-may-12-2025/) U.K.’s Legal Aid Agency and major retailers are recent victims of DragonForce ransomware group, U.S.... Author:[Acronis Threat Research Unit](https://www.acronis.com/en/tru/authors/acronis-threat-research-unit/) Related attacks & insights [What is phishing? How phishing attacks work and how to defend against them](https://www.acronis.com/en/tru/threat-catalog/social-engineering/phishing/) [What is vishing? How voice phishing attacks work and how to defend against them](https://www.acronis.com/en/tru/threat-catalog/social-engineering/vishing/) [What is StealC malware? How StealC works, its role in ransomware and how to defend against it](https://www.acronis.com/en/tru/threat-catalog/malware/infostealers/stealc/) [What is Lumma Stealer (LummaC2), how LummaC2 malware works and how to defend against it](https://www.acronis.com/en/tru/threat-catalog/malware/infostealers/lumma/)