Akira

Akira is a Russian-language ransomware operation that emerged in April 2023 and has remained one of the most prolific financially motivated threat groups through 2026. It is widely tracked under the name Akira and has also been referred to as Gold Sahara, Howling Scorpius, Punk Spider, and Storm-1567. The operation is associated with a ransomware-as-a-service model or affiliate-based structure, with reporting also referring to Akira ransomware affiliates, operators, and crew. Akira conducts double-extortion intrusions, combining data theft with file encryption and threatening public release of stolen information to increase pressure on victims. The group has repeatedly targeted organizations in the United States and has also victimized entities in Europe and elsewhere. Reported victimology spans manufacturing, construction, professional services, transportation and logistics, technology, finance-related services, and other commercial sectors. Multiple 2026 reporting streams characterize Akira as one of the dominant or top-tier ransomware operations active in the global threat landscape. Akira has been linked to exploitation of internet-facing remote access and edge infrastructure, particularly VPN and SSL VPN appliances. Reporting has associated the group with campaigns involving SonicWall devices and with broader exploitation trends affecting products from vendors including Fortinet, SonicWall, Citrix, and Check Point. In some cases, investigators observed Akira intrusions involving compromised VPN accounts but could not conclusively determine whether access derived from direct appliance exploitation or from previously stolen credentials and other authentication artifacts. Observed Akira tradecraft includes credential abuse, remote access through exposed edge services, lateral movement across Windows environments, privilege escalation to domain administrator, internal reconnaissance, and large-scale data staging prior to ransomware deployment. The group has been observed abusing legitimate or dual-use tools to support operations, including remote administration software, file transfer utilities, port scanners, and Remote Desktop Protocol. Reporting has specifically linked Akira activity to the use of tools such as FileZilla for exfiltration support and MASSCAN for discovery of additional remote targets. In at least one documented intrusion, the operators maintained access for weeks, moved across multiple networks, staged substantial volumes of data for exfiltration, and then deployed ransomware broadly. Initial access associated with Akira has included social engineering and malware-enabled footholds as well as exploitation of perimeter technology. One reported case tied the group’s access to a user-driven download of SectopRAT after a fake verification prompt, after which the attackers expanded control, compromised privileged accounts, and prepared data theft before encryption. This reflects Akira’s willingness to blend commodity intrusion methods with hands-on-keyboard post-compromise activity. Akira is consistently described as pairing encryption with data theft rather than relying on encryption alone. Public victim-claim reporting through 2026 places the group among the most active ransomware brands by volume, with totals approaching 1,500 claimed victims overall and more than 300 claimed in the first half of 2026 alone. Despite fluctuations in quarterly rankings, Akira remains a significant ransomware threat with sustained operational tempo, broad victimology, and recurring use of edge-device and credential-based intrusion paths.