Key takeaways
- Akira is a ransomware-as-a-service (RaaS) operation that has been active since March 2023.
- Akira affiliates have collected approximately $244 million in claimed ransom proceeds as of late September 2025, per a joint advisory from CISA, the FBI and Europol.
- Akira primarily targets small and medium-sized businesses across manufacturing, education, health care, financial services and information technology.
- Initial access typically comes through VPN vulnerabilities in Cisco and SonicWall appliances, or through stolen credentials.
- Akira is assessed to have code-level and financial links to the Conti ransomware group, though no confirmed formal organizational connection exists.
What is Akira ransomware?
When did the Akira ransomware group first appear?
Akira ransomware was first observed in March 2023. The group initially targeted Windows systems with a C++-based encryptor, and by April 2023 had added a Linux variant capable of encrypting VMware ESXi virtual machines. Akira operates as a ransomware-as-a-service group, publishing victims to a distinctive Tor-based leak site styled after a retro green-screen terminal. A core developer team builds and maintains the ransomware and recruits affiliates who carry out individual intrusions; the developers retain control over ransom demands and negotiation terms. Because affiliates bring their own tactics, techniques and procedures, no single playbook defines every Akira attack.
Is the current Akira group related to the 2017 Akira ransomware?
No. A ransomware variant also named Akira was briefly observed in 2017, and both versions append the .akira extension to encrypted files, which has caused confusion in search results and reporting. The two are distinct malware families with no shared code or infrastructure. This distinction is confirmed by a Health Sector Cybersecurity Coordination Center (HHS HC3) analyst note from February 2024 and by Trend Micro.
What connection does Akira ransomware have to the Conti ransomware group?
Akira shows two independent lines of evidence connecting it to the Conti ransomware group, though no confirmed formal organizational link has been established. The first is code overlap: researchers at Trend Micro, Avast and Qualys have documented that Akira shares file exclusion lists, directory exclusion patterns, its ChaCha encryption implementation and other functions with Conti. Because Conti's source code was leaked publicly in March 2022, code similarity alone does not confirm organizational continuity between the two groups. The second is blockchain analysis: Arctic Wolf Labs identified at least three transactions totaling more than $600,000 in which Akira threat actors sent ransom proceeds to Conti-affiliated wallet addresses, two of which were linked to Conti's leadership team. TRM Labs has separately identified on-chain links between Akira and the Fog and Frag ransomware groups.
Arctic Wolf has assessed with high confidence that some Conti-affiliated threat actors are now linked to Akira, but characterizes this as individual actor movement rather than a formal rebrand. CISA's advisory uses the more cautious phrase that Akira actors "may have connections" to Conti.
Who does Akira ransomware target?
Which industries does Akira ransomware attack most frequently?
According to the November 2025 update to the joint CISA advisory, Akira most frequently targets manufacturing, educational institutions, information technology, health care and public health, financial services and food and agriculture. Vendor reporting from Cisco Talos, Trellix and Cyberint additionally identifies business services, construction and legal services among targeted sectors. Sector targeting varies by affiliate, since individual Akira affiliates choose their own targets within the RaaS model.
Why are small and medium-sized businesses at higher risk from Akira ransomware?
CISA explicitly states that Akira "primarily targets small- and medium-sized businesses." SMBs are attractive targets because they are more likely to rely on single-factor VPN authentication, have less mature patch management, run limited security operations center (SOC) coverage and have fewer resources to resist extortion demands. Managed service providers are also directly targeted: an Acronis Threat Research Unit (TRU) blog from 2025 cites the Hitachi Vantara and Toppan Next Tech incidents as examples.
Which countries are most affected by Akira ransomware attacks?
Akira's victims are concentrated in the United States, Canada and Western Europe, with additional victims in Australia, Brazil and countries across Asia and Latin America. Leak site data shows the United States accounts for the majority of disclosed victims. TRM Labs has assessed that Akira's operators are likely based in Russia or the broader post-Soviet region, and the group communicates in Russian on dark web forums.
How does an Akira ransomware attack work?
What is the step-by-step Akira ransomware attack lifecycle?
Akira intrusions generally proceed through six phases, from initial network entry to encryption and extortion. The table below maps each phase to the attacker's goal and its business impact.
Documented dwell times illustrate how fast this lifecycle can complete. Arctic Wolf reported sub-four-hour intrusions during the 2025 SonicWall campaign, with the fastest observed case reaching encryption in approximately 55 minutes from initial access. The DFIR Report separately documented a Bumblebee-to-Akira intrusion chain that took roughly 44 hours to reach first encryption. This range underscores why automated detection and immutable backups matter more than manual response speed: manual SOC triage alone may be too slow to intervene before encryption begins.
How much financial damage has Akira ransomware caused?
How much has Akira ransomware collected in ransom payments?
Akira's ransom collection has grown sharply since the group's emergence. The original joint CISA and FBI advisory, published in April 2024, attributed $42 million in ransom payments to Akira from approximately 250 organizations between March 2023 and January 2024. An updated advisory from CISA, the FBI and Europol, issued in November 2025, raised that figure to $244.17 million in claimed proceeds as of late September 2025. TRM Labs separately reports that Akira collected more than $150 million in 2025 alone, making it the most prolific ransomware group by ransom proceeds that year. Individual ransom demands range from $200,000 to more than $4 million, according to the Department of Health and Human Services' Health Sector Cybersecurity Coordination Center.
These figures represent claimed proceeds. Actual amounts may differ, and verification methodology varies by source.
How many organizations has Akira ransomware compromised?
TRM Labs recorded approximately 980 victims posted to Akira's leak site between January 1 and December 11, 2025. Ransomware.live separately tracks approximately 1,387 known Akira victims as of late 2025. The original April 2024 advisory noted more than 250 organizations, and Cyberint recorded a record month in November 2024, with more than 30 victims posted in a single day.
Leak site victim counts represent only publicly disclosed victims and are unlikely to be comprehensive, since many organizations pay ransoms and are never listed.
What vulnerabilities does Akira ransomware exploit?
Which Cisco and SonicWall CVEs has Akira ransomware exploited?
The table below lists the CVEs most associated with Akira intrusions, drawn from the November 2025 CISA advisory and Cisco Talos reporting.
How does Akira ransomware target backup infrastructure?
Akira specifically targets backup infrastructure to remove an organization's ability to recover without paying. The group exploits two Veeam Backup and Replication vulnerabilities, CVE-2023-27532 and CVE-2024-40711, and uses PowerShell scripts to dump Veeam credentials during the persistence and credential access phase of an intrusion. During the final phase, operators delete Volume Shadow Copies using Windows Management Instrumentation. In some cases, Akira deletes data outright instead of encrypting it, which prevents recovery through data-carving techniques. Finland's National Cyber Security Centre has separately warned that Akira specifically targets and wipes backup infrastructure.
How does Akira ransomware map to the MITRE ATT&CK framework?
The table below maps Akira's observed techniques to MITRE ATT&CK IDs and tactics, sourced from MITRE ATT&CK Group G1024 and Software entries S1129 (Akira ransomware), S1191 (Megazord) and S1194 (Akira_v2), cross-referenced with CISA Advisory AA24-109A (November 2025 update) and ATT&CK version 18.
How does Acronis protect against Akira ransomware?
Acronis maps its defensive capabilities to the six lifecycle phases described above. The table below shows the risk at each phase, the capability required to address it, and the corresponding Acronis response.
Frequently asked questions about Akira ransomware
Can Akira ransomware be decrypted without paying the ransom?
How quickly can Akira ransomware encrypt a network after initial access?
Does Akira ransomware target VMware ESXi and other hypervisors?
What should an organization do if it is infected with Akira ransomware?
How does Akira ransomware differ from LockBit and other major ransomware groups?
What indicators of compromise are associated with Akira ransomware?
