Akira

Akira is a ransomware-as-a-service operation that emerged in 2023 and became a prominent double-extortion threat targeting organizations across multiple sectors, with especially heavy activity against manufacturing, construction, retail, technology, healthcare, finance, education, and other enterprise environments in North America and Europe. The operation is widely tracked as Akira and has also been associated with aliases including Storm-1567, Howling Scorpius, PUNK SPIDER, and MITRE group identifier G1024. Reporting has noted suspected ties to former Conti ecosystem members based on code and operational overlap.

Akira conducts intrusions by obtaining network access through compromised VPN credentials, exploitation of internet-facing edge devices and SSL VPN appliances, spearphishing, brute-force activity against remote access services, and access purchased from initial access brokers. The group has repeatedly been associated with exploitation of vulnerabilities in products from vendors such as Cisco, SonicWall, Fortinet, Citrix, and Check Point, and multiple investigations have highlighted Akira activity against environments lacking multi-factor authentication on VPN accounts. Campaigns have also been observed using SEO poisoning and trojanized software installers that led to follow-on malware deployment before Akira encryption.

Once inside a victim environment, Akira commonly establishes persistence through newly created privileged accounts and deployment of remote access tools. It performs reconnaissance with network scanners, Active Directory enumeration utilities, PowerShell, and native administrative tooling. Credential theft is a core part of its tradecraft and has included harvesting from LSASS, Active Directory databases, browser stores, backup software, and other enterprise credential sources using tools such as Mimikatz, DonPAPI, LaZagne, PCHunter, NirSoft utilities, and Veeam-focused credential extraction methods.

Akira operators move laterally through enterprise networks using RDP, SMB administrative shares, PsExec, WMI, WMIC, Impacket, and SSH, including movement into virtualization and backup infrastructure. The group has been repeatedly observed targeting backup systems and recovery mechanisms, terminating database, backup, and security services, deleting shadow copies, and otherwise inhibiting restoration before encryption. Data theft typically precedes encryption, with archives staged and exfiltrated using common transfer tools and cloud or file-transfer services. This supports Akira’s double-extortion model, in which stolen data is used to pressure victims in addition to system encryption.

The malware family has evolved into multiple variants. Akira initially used a Windows encryptor written in C++, later introduced a Rust-based variant known as Megazord, and expanded to Linux and ESXi environments. Reporting also describes Akira activity against Nutanix AHV virtual machine disks. The operation is therefore capable of impacting Windows endpoints and servers as well as Linux-based virtualization infrastructure. Akira’s encryptors use hybrid cryptography and are accompanied by ransom notes directing victims to negotiation and leak infrastructure.

Akira has also been associated with defense-evasion techniques including disabling Windows Defender, clearing event logs, covert tunneling, command obfuscation, and bring-your-own-vulnerable-driver activity to impair endpoint protections. Incident reporting has documented use of vulnerable drivers, remote administration tools, reverse tunnels, and cloud tunneling services during post-compromise operations. In several investigations, Akira deployment followed a relatively short dwell time after initial access, though broader reporting indicates the group often spends time on stealth, staging, credential access, exfiltration, and lateral expansion before encryption.

Akira is one of the most active ransomware groups of the mid-2020s and has been linked to hundreds of victims and substantial illicit revenue. Its operational pattern reflects a mature RaaS ecosystem combining credential-driven intrusion, edge-device exploitation, broad post-exploitation capability, data exfiltration, and enterprise-wide encryption across both traditional Windows networks and virtualized infrastructure.