Loading story…
Sophos reported that Akira has become a major threat to small and medium-sized organizations across Europe, North America, and Australia, hitting sectors including government, manufacturing, technology, education, consulting, pharmaceuticals, and telecommunications. The group commonly gained initial access through unauthorized logins to Cisco ASA SSL VPN and Cisco AnyConnect systems that lacked MFA, and in some cases exploited CVE-2023-20269 and Veeam CVE-2023-27532. Researchers said Akira operators routinely stole credentials, moved laterally, established persistence, and attempted to evade defenses before either encrypting systems or stealing data for extortion.
Sophos said Akira shifted notably toward extortion-only operations beginning in late 2023, exfiltrating data without always deploying ransomware. During intrusions, the actors dumped LSASS, extracted NTDS.dit and SYSTEM hives, targeted Veeam, browser, and KeePass credentials, and used tools including Mimikatz, AdFind, Advanced IP Scanner, RDP, SMB, wmiexec, PsExec, AnyDesk, WinRAR, rclone, and MEGA. The report also identified a previously unreported backdoor, crome.exe, communicating with 170.130.165[.]171, alongside repeated efforts to disable Sophos and Microsoft Defender protections. When encryption was used, Akira deployed binaries such as w.exe, Lck.exe, 1.exe, and locker.exe, appended the .akira extension, dropped akira_readme.txt, deleted Volume Shadow Copies, and in one case encrypted about 65,000 files on a server.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
9 events from the most recent confirmed update back to the earliest known activity.
In research published on 2026-05-27, SANS ISC reconstructed an Akira intrusion at a mid-sized organization using SSLVPN firewall syslog and Windows EVTX logs. The analysis traced initial access to a forgotten local VPN account without MFA and detailed discovery, Kerberoasting, RDP-based lateral movement, account creation, defense evasion, shadow-copy deletion, and rapid encryption, while emphasizing log-correlation-based detection opportunities.
In its research published on 2026-01-01, Sophos detailed Akira's use of credential theft, lateral movement, defense evasion, remote access tools, and a previously unreported backdoor named crome.exe communicating with 170.130.165[.]171.
A report published on 2024-04-19 said Akira had extorted about $42 million and had expanded its operations to target Linux servers. The update marked a notable escalation in the group's impact and platform targeting beyond previously documented activity.
Beginning in October 2023, Sophos observed a notable change in Akira operations toward data theft and extortion-only incidents in which attackers exfiltrated data without deploying ransomware.
In research published on 2023-08-22, SentinelOne reported that Akira intrusions repeatedly involved Cisco VPN access and identified the group's use of the legitimate RustDesk remote access tool for stealthy remote access and file transfer. The report also described post-compromise actions including SQL database manipulation, firewall disabling, enabling RDP, and disabling Windows security features.
According to Kroll, Cisco stated that Akira targeted the Cisco ASA zero-day CVE-2023-20269 in August 2023. The flaw enabled brute-force attacks and clientless SSL VPN sessions because of improper AAA separation.
A report published on 2023-07-26 said Akira ransomware had compromised at least 63 victims since beginning operations in March 2023. The reporting marked an early assessment of the group's scale and activity during its first months of operation.
Sophos said Akira began operating in March 2023 and quickly became a significant threat to small and medium-sized organizations in Europe, North America, and Australia across multiple sectors.
During 2023, Akira intrusions commonly began through unauthorized logins to Cisco ASA SSL VPN or Cisco AnyConnect instances without MFA, with some cases also involving exploitation of Cisco CVE-2023-20269 and Veeam CVE-2023-27532.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
9 references tracked. Mallory keeps watching after this page renders.
isc.sans.edu
Open sourceisc.sans.edu
Open sourcenews.sophos.com
Open sourcesophos.com
Open sourcecommunity.fortinet.com
Open sourcethehackernews.com
Open sourcekroll.com
Open sourcebleepingcomputer.com
Open sourcenews.sophos.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Sophos reported that newly emerged **Akira ransomware** was deployed in two separate April 2023 attacks against organizations in North America, with victims’ files renamed using the `.akira` extension and ransom notes dropped as `fn.txt`. The company said the strain appears unrelated to a 2017 ransomware family of the same name. In one intrusion, attackers gained access to an account through **MFA bypass** activity linked to **TOR exit nodes**, dumped `LSASS` memory via `comsvcs.dll` launched with `rundll32.exe`, moved laterally over **RDP**, tampered with **Windows Defender**, installed **AnyDesk**, and launched encryption after about seven days in the environment. In the second case, attackers entered through **single-factor VPN access**, likely harvested credentials as indicated by `MEMORY.DMP`, conducted reconnaissance with **Advanced IP Scanner** and **LANSweeper** data, used **Cloudflare Tunnel** and **Radmin** for remote access, and staged data with **WinRAR** before deploying ransomware after more than 30 days. Sophos said Akira targeted a relatively narrow set of 26 file extensions, focusing largely on databases, virtual disks, and memory image files while avoiding some file types to preserve system stability, and noted that the slower pace of both operations created multiple opportunities for defenders to detect and disrupt the attacks before encryption.
Jun 29, 2026
The **Akira** ransomware group has streamlined attacks to move from initial access to data encryption in under four hours, and in some cases in as little as one hour, according to Halcyon. Since emerging in 2023, the group has compromised hundreds of organizations and is estimated to have collected at least **$245 million** in ransom payments through September 2025. Researchers said Akira gains entry through zero-day exploits, access bought from initial access brokers, VPNs lacking multifactor authentication, and attacks on **Veeam Backup & Replication**, **Cisco VPN**, and **SonicWall** systems. The operation also uses **double extortion**, stealing data before encryption and threatening leaks, while relying on intermittent encryption and dependable decryption to increase the likelihood that victims pay. Separately, ESET identified a South American ransomware campaign that **impersonates Akira** while actually deploying a **Babuk-based** encryptor against Windows users. The malware appends the `.akira` extension to files and drops ransom notes that mimic Akira’s language and Tor negotiation links, raising the risk of false attribution. Researchers said the campaign reflects a broader pattern of threat actors reusing leaked Babuk code and borrowing the branding of established ransomware groups, underscoring the need for defenders to verify attribution through technical analysis rather than ransom-note branding alone.
Jun 29, 2026
U.S. and European cyber authorities released an updated joint advisory detailing the latest tactics, techniques, and procedures (TTPs) used by the Akira ransomware group, which has rapidly become one of the most consequential ransomware threats targeting critical infrastructure and businesses worldwide. The advisory, supported by agencies including CISA, FBI, DoD Cyber Crime Center, HHS, Europol, and law enforcement from France, Germany, and the Netherlands, highlights Akira’s evolution, its double-extortion model, and its targeting of sectors such as manufacturing, education, IT, healthcare, financial, and agriculture. Akira actors exploit vulnerabilities in edge devices, backup servers, and VPN products—including SonicWall (CVE-2024-40766), Cisco, Windows, VMware ESXi, and Veeam—using techniques like credential theft, brute-force attacks, and initial access brokers. They employ remote management tools (AnyDesk, LogMeIn) for defense evasion, uninstall endpoint detection and response (EDR) systems, and leverage custom malware such as POORTRY for privilege escalation. As of late September 2025, Akira has extorted over $244 million in ransom payments, primarily from small- and medium-sized businesses. The group is associated with other threat actors such as Storm-1567, Howling Scorpius, Punk Spider, and Gold Sahara, and may have links to the disbanded Conti group. The FBI ranks Akira among the top five ransomware variants it investigates, citing its significant financial and operational impact on victims. The advisory provides updated indicators of compromise (IOCs), detection methods, and a list of newly exploited vulnerabilities to help organizations defend against Akira’s ongoing campaigns.
Jun 29, 2026