Akira is a ransomware-as-a-service (RaaS) operation that has been active since March 2023.
Akira affiliates have collected approximately $244 million in claimed ransom proceeds as of late September 2025, per a joint advisory from CISA, the FBI and Europol.
Akira primarily targets small and medium-sized businesses across manufacturing, education, health care, financial services and information technology.
Initial access typically comes through VPN vulnerabilities in Cisco and SonicWall appliances, or through stolen credentials.
Akira is assessed to have code-level and financial links to the Conti ransomware group, though no confirmed formal organizational connection exists.
What is Akira ransomware?
When did the Akira ransomware group first appear?
Akira ransomware was first observed in March 2023. The group initially targeted Windows systems with a C++-based encryptor, and by April 2023 had added a Linux variant capable of encrypting VMware ESXi virtual machines. Akira operates as a ransomware-as-a-service group, publishing victims to a distinctive Tor-based leak site styled after a retro green-screen terminal. A core developer team builds and maintains the ransomware and recruits affiliates who carry out individual intrusions; the developers retain control over ransom demands and negotiation terms. Because affiliates bring their own tactics, techniques and procedures, no single playbook defines every Akira attack.
Is the current Akira group related to the 2017 Akira ransomware?
No. A ransomware variant also named Akira was briefly observed in 2017, and both versions append the .akira extension to encrypted files, which has caused confusion in search results and reporting. The two are distinct malware families with no shared code or infrastructure. This distinction is confirmed by a Health Sector Cybersecurity Coordination Center (HHS HC3) analyst note from February 2024 and by Trend Micro.
What connection does Akira ransomware have to the Conti ransomware group?
Akira shows two independent lines of evidence connecting it to the Conti ransomware group, though no confirmed formal organizational link has been established. The first is code overlap: researchers at Trend Micro, Avast and Qualys have documented that Akira shares file exclusion lists, directory exclusion patterns, its ChaCha encryption implementation and other functions with Conti. Because Conti's source code was leaked publicly in March 2022, code similarity alone does not confirm organizational continuity between the two groups. The second is blockchain analysis: Arctic Wolf Labs identified at least three transactions totaling more than $600,000 in which Akira threat actors sent ransom proceeds to Conti-affiliated wallet addresses, two of which were linked to Conti's leadership team. TRM Labs has separately identified on-chain links between Akira and the Fog and Frag ransomware groups.
Arctic Wolf has assessed with high confidence that some Conti-affiliated threat actors are now linked to Akira, but characterizes this as individual actor movement rather than a formal rebrand. CISA's advisory uses the more cautious phrase that Akira actors "may have connections" to Conti.
Who does Akira ransomware target?
Which industries does Akira ransomware attack most frequently?
According to the November 2025 update to the joint CISA advisory, Akira most frequently targets manufacturing, educational institutions, information technology, health care and public health, financial services and food and agriculture. Vendor reporting from Cisco Talos, Trellix and Cyberint additionally identifies business services, construction and legal services among targeted sectors. Sector targeting varies by affiliate, since individual Akira affiliates choose their own targets within the RaaS model.
Why are small and medium-sized businesses at higher risk from Akira ransomware?
CISA explicitly states that Akira "primarily targets small- and medium-sized businesses." SMBs are attractive targets because they are more likely to rely on single-factor VPN authentication, have less mature patch management, run limited security operations center (SOC) coverage and have fewer resources to resist extortion demands. Managed service providers are also directly targeted: an Acronis Threat Research Unit (TRU) blog from 2025 cites the Hitachi Vantara and Toppan Next Tech incidents as examples.
Which countries are most affected by Akira ransomware attacks?
Akira's victims are concentrated in the United States, Canada and Western Europe, with additional victims in Australia, Brazil and countries across Asia and Latin America. Leak site data shows the United States accounts for the majority of disclosed victims. TRM Labs has assessed that Akira's operators are likely based in Russia or the broader post-Soviet region, and the group communicates in Russian on dark web forums.
How does an Akira ransomware attack work?
What is the step-by-step Akira ransomware attack lifecycle?
Akira intrusions generally proceed through six phases, from initial network entry to encryption and extortion. The table below maps each phase to the attacker's goal and its business impact.
Phase
Attacker goal
What does an Akira attack mean for your business?
1. Initial access
Gain network entry via compromised VPN credentials (purchased from brokers or brute-forced), exploitation of unpatched Cisco (CVE-2023-20269) or SonicWall (CVE-2024-40766) appliances, spearphishing or exposed RDP. Akira preferentially targets VPNs without MFA.
Perimeter breach. The attacker has authenticated network access indistinguishable from legitimate user traffic. No alert if MFA is absent.
2. Persistence and credential access
Create rogue domain accounts (observed naming convention: "itadm"). Install legitimate remote access tools (AnyDesk, LogMeIn, RustDesk) for persistent access. Use Mimikatz, LaZagne and comsvcs.dll MiniDump to extract credentials from LSASS. Perform Kerberoasting. Use PowerShell to dump Veeam credentials and Kerberos tickets.
The attacker has persistent access via multiple channels. Domain credentials are compromised and backup server credentials are exposed. Closing the initial entry point does not remove the attacker.
3. Discovery and lateral movement
Enumerate Active Directory using AdFind and Nltest. Scan internal networks with Advanced IP Scanner and MASSCAN. Move laterally via RDP and SMB using stolen credentials. Access SharePoint repositories. Use Ngrok tunnels to establish command and control (C2) that bypasses perimeter monitoring.
The attacker maps the full environment, including domain controllers, backup servers, file servers and hypervisors. Data collection begins and a C2 channel is established for ongoing control.
4. Defense evasion
Disable or modify endpoint security tools (PowerTool). Clear event logs. Use binary padding to obfuscate payloads. Modify the Windows registry to disable Defender. Hide rogue accounts from the login screen via a Userlist registry modification.
Security team visibility is degraded and historical forensic evidence is destroyed, letting the attacker operate with a reduced risk of detection.
5. Data exfiltration
Archive target data using WinRAR. Exfiltrate using FileZilla, WinSCP, RClone (to Mega or other cloud storage), or Ngrok-based tunnels. Exfiltration can be completed in as little as two hours from Veeam servers, per vendor reporting.
Confidential data, including customer PII, financial records and intellectual property, has left the network. This enables a "double extortion" threat regardless of whether encryption succeeds.
6. Encryption and extortion
Delete Volume Shadow Copies via WMI. Encrypt files using a hybrid ChaCha20/RSA scheme. Deploy platform-appropriate encryptors for Windows (.akira/.akiranew), ESXi (Akira_v2) and Nutanix AHV. In some cases, delete data outright instead of encrypting it. Deliver a ransom note directing victims to a Tor-based negotiation site, and contact victims by phone to apply additional pressure.
Business operations halt. File recovery is blocked by shadow copy deletion. Ransom demands range from $200,000 to more than $4 million. Even where backups exist, the exfiltrated data creates ongoing extortion leverage. Downtime is measured in days to weeks.
Documented dwell times illustrate how fast this lifecycle can complete. Arctic Wolf reported sub-four-hour intrusions during the 2025 SonicWall campaign, with the fastest observed case reaching encryption in approximately 55 minutes from initial access. The DFIR Report separately documented a Bumblebee-to-Akira intrusion chain that took roughly 44 hours to reach first encryption. This range underscores why automated detection and immutable backups matter more than manual response speed: manual SOC triage alone may be too slow to intervene before encryption begins.
How much financial damage has Akira ransomware caused?
How much has Akira ransomware collected in ransom payments?
Akira's ransom collection has grown sharply since the group's emergence. The original joint CISA and FBI advisory, published in April 2024, attributed $42 million in ransom payments to Akira from approximately 250 organizations between March 2023 and January 2024. An updated advisory from CISA, the FBI and Europol, issued in November 2025, raised that figure to $244.17 million in claimed proceeds as of late September 2025. TRM Labs separately reports that Akira collected more than $150 million in 2025 alone, making it the most prolific ransomware group by ransom proceeds that year. Individual ransom demands range from $200,000 to more than $4 million, according to the Department of Health and Human Services' Health Sector Cybersecurity Coordination Center.
These figures represent claimed proceeds. Actual amounts may differ, and verification methodology varies by source.
How many organizations has Akira ransomware compromised?
TRM Labs recorded approximately 980 victims posted to Akira's leak site between January 1 and December 11, 2025. Ransomware.live separately tracks approximately 1,387 known Akira victims as of late 2025. The original April 2024 advisory noted more than 250 organizations, and Cyberint recorded a record month in November 2024, with more than 30 victims posted in a single day.
Leak site victim counts represent only publicly disclosed victims and are unlikely to be comprehensive, since many organizations pay ransoms and are never listed.
What vulnerabilities does Akira ransomware exploit?
Which Cisco and SonicWall CVEs has Akira ransomware exploited?
The table below lists the CVEs most associated with Akira intrusions, drawn from the November 2025 CISA advisory and Cisco Talos reporting.
CVE
Product
Vulnerability type
CVE-2020-3259
Cisco ASA / AnyConnect
Information disclosure
CVE-2020-3580
Cisco ASA
Cross-site scripting (added November 2025)
CVE-2023-20269
Cisco ASA / FTD
Unauthorized VPN access (brute-force enablement)
CVE-2024-40766
SonicWall SonicOS
Improper access control (primary 2025 campaign vector)
CVE-2023-28252
Windows CLFS
Heap-based buffer overflow (privilege escalation)
CVE-2024-37085
VMware ESXi
Authentication bypass
CVE-2023-27532
Veeam Backup and Replication
Missing authentication for a critical function
CVE-2024-40711
Veeam Backup and Replication
Deserialization of untrusted data
CVE-2023-48788
Fortinet FortiClientEMS
SQL injection (per Cisco Talos)
How does Akira ransomware target backup infrastructure?
Akira specifically targets backup infrastructure to remove an organization's ability to recover without paying. The group exploits two Veeam Backup and Replication vulnerabilities, CVE-2023-27532 and CVE-2024-40711, and uses PowerShell scripts to dump Veeam credentials during the persistence and credential access phase of an intrusion. During the final phase, operators delete Volume Shadow Copies using Windows Management Instrumentation. In some cases, Akira deletes data outright instead of encrypting it, which prevents recovery through data-carving techniques. Finland's National Cyber Security Centre has separately warned that Akira specifically targets and wipes backup infrastructure.
How does Akira ransomware map to the MITRE ATT&CK framework?
The table below maps Akira's observed techniques to MITRE ATT&CK IDs and tactics, sourced from MITRE ATT&CK Group G1024 and Software entries S1129 (Akira ransomware), S1191 (Megazord) and S1194 (Akira_v2), cross-referenced with CISA Advisory AA24-109A (November 2025 update) and ATT&CK version 18.
Technique name
ATT&CK ID
Tactic
External Remote Services
T1133
Initial Access
Valid Accounts
T1078
Initial Access / Persistence
Exploit Public-Facing Application
T1190
Initial Access
Spearphishing Attachment / Link
T1566.001 / T1566.002
Initial Access
Brute Force / Password Spraying
T1110 / T1110.003
Credential Access
Create Account: Domain Account
T1136.002
Persistence
Remote Access Tools (AnyDesk, RustDesk)
T1219
Persistence / Command and Control
Command and Scripting Interpreter: PowerShell
T1059.001
Execution
Command and Scripting Interpreter: VBScript
T1059.005
Execution
Windows Management Instrumentation
T1047
Execution
OS Credential Dumping: LSASS Memory
T1003.001
Credential Access
Steal or Forge Kerberos Tickets (Kerberoasting)
T1558
Credential Access
Remote Desktop Protocol
T1021.001
Lateral Movement
Remote Services: SSH
T1021.004
Lateral Movement
Lateral Tool Transfer
T1570
Lateral Movement
Domain Trust Discovery
T1482
Discovery
Remote System Discovery
T1018
Discovery
Network Share Discovery
T1135
Discovery
System Information Discovery
T1082
Discovery
Process Discovery
T1057
Discovery
Impair Defenses: Disable or Modify Tools
T1562.001
Defense Evasion
Masquerading
T1036.005
Defense Evasion
Obfuscated Files: Binary Padding
T1027.001
Defense Evasion
Protocol Tunneling (Ngrok)
T1572
Command and Control
Archive Collected Data: Archive via Utility (WinRAR)
T1560.001
Collection
Data from Information Repositories: SharePoint
T1213.002
Collection
Exfiltration to Cloud Storage (RClone)
T1567.002
Exfiltration
Data Encrypted for Impact
T1486
Impact
Inhibit System Recovery (shadow copy deletion)
T1490
Impact
Service Stop
T1489
Impact
Account Access Removal
T1531
Impact
Financial Theft (double extortion)
T1657
Impact
How does Acronis protect against Akira ransomware?
Acronis maps its defensive capabilities to the six lifecycle phases described above. The table below shows the risk at each phase, the capability required to address it, and the corresponding Acronis response.
Attack stage
Risk
Required capability
Acronis capability
Outcome
1. Initial access
Network entry via compromised VPN credentials or exploitation of unpatched Cisco and SonicWall vulnerabilities
Automated vulnerability identification and patch deployment
Closes the CVEs that are Akira's primary entry points before affiliates exploit them. Credential rotation should accompany patch deployment: Arctic Wolf found SonicWall credentials exfiltrated before patching in some cases.
Resists attempts to disable security tooling, preserving detection coverage.
5. Data exfiltration
Archiving and exfiltration via FileZilla, WinSCP, RClone or Ngrok tunnels, in as little as two hours from Veeam servers
Post-exploitation detection of exfiltration tooling
EDR/XDR (detects RClone execution)
Flags exfiltration tooling in use. Immutable backup does not neutralize data that has already been exfiltrated.
6. Encryption and extortion
Shadow copy deletion via WMI, hybrid ChaCha20/RSA encryption and platform-specific encryptors for Windows, ESXi and Nutanix AHV
Real-time behavioral encryption detection and immutable, rollback-capable recovery
Active Protection and immutable cloud backup with automated rollback
Blocks encryption activity in progress, including zero-day variants, and restores files to their pre-attack state even if shadow copies are deleted.
Frequently asked questions about Akira ransomware
Can Akira ransomware be decrypted without paying the ransom?
Generally, no. Avast released a free decryptor for early Akira versions in June 2023, but Akira's developers patched the underlying encryption flaw shortly afterward. There is no publicly known decryptor for Akira variants released after July 2023, nor for the Megazord or Akira_v2 variants. Recovery depends on having clean, isolated backups available before an attack occurs.
How quickly can Akira ransomware encrypt a network after initial access?
Dwell times vary by affiliate and target environment. Arctic Wolf documented sub-four-hour intrusions during the 2025 SonicWall campaign, with the fastest case reaching encryption in approximately 55 minutes. The DFIR Report documented a separate Bumblebee-to-Akira intrusion chain that took roughly 44 hours to reach first encryption. This range shows why automated detection matters more than manual response speed.
Does Akira ransomware target VMware ESXi and other hypervisors?
Yes. Akira has targeted VMware ESXi since April 2023 through its Akira_v2 variant and added Nutanix AHV capability by June 2025. Targeting hypervisors directly allows mass encryption of many virtual machines from a single point of control. See the attack lifecycle section above for the technical detail behind this capability.
What should an organization do if it is infected with Akira ransomware?
Isolate affected systems immediately. Do not pay the ransom: The FBI and CISA strongly discourage payment. Preserve forensic evidence and engage an incident response team. Restore systems from clean, offline backups. Report the incident to the FBI's Internet Crime Complaint Center and, if applicable, the local CISA field office. Check whether a working decryptor exists for the specific variant involved, though this is unlikely for current Akira variants.
How does Akira ransomware differ from LockBit and other major ransomware groups?
Akira is a ransomware-as-a-service operation like LockBit, but it runs a closed operation with controlled affiliate recruitment, compared with LockBit's more open affiliate model. Akira preferentially targets small and medium-sized businesses, while LockBit has historically targeted larger organizations. Akira's assessed Conti lineage and its aggressive VPN exploitation further differentiate its operational playbook. Unlike some ransomware groups, Akira does not state a ransom demand up front; victims must contact the group directly to receive a demand.
What indicators of compromise are associated with Akira ransomware?
The CISA advisory (AA24-109A, updated November 2025) contains the most current indicator set. Because indicators of compromise rotate frequently, behavioral indicators tend to be more durable for detection. These include creation of an "itadm" administrative account, Ngrok tunnel activity, WinRAR archiving followed by RClone-based exfiltration, WMI-based shadow copy deletion and files appended with the .akira, .akiranew or .aki extensions. See the MITRE ATT&CK table above for the full technique mapping.
