Loading threat actor…
Akira is a financially motivated ransomware-as-a-service operation active since 2023, also tracked as GOLD SAHARA, Howling Scorpius, PUNK SPIDER, and Storm-1567. It primarily targets small and medium-sized businesses and has attacked businesses and critical infrastructure across North America, Europe, and Australia. Its targets include manufacturing, transportation, professional services, food production and distribution, technology, and defense organizations. The operation uses double extortion, combining file encryption with threats to publish stolen information through a dedicated leak site. PUNK SPIDER develops and maintains the ransomware and associated leak infrastructure. Akira operators and affiliates obtain initial access through compromised credentials, password spraying and other brute-force attacks, exposed RDP services, spear phishing, and VPN services lacking multifactor authentication. They have exploited Cisco vulnerabilities CVE-2020-3259 and CVE-2023-20269 and also purchase access from initial access brokers. Post-compromise activity includes reconnaissance, credential dumping, lateral movement, and data exfiltration. Akira-associated ransomware has also encrypted files remotely over SMB shares from unmanaged systems without placing the ransomware executable on the target systems. Its malware includes the original C++-based Akira ransomware, the Rust-based Megazord variant used since August 2023, and Akira_v2.
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Who, where, and (when attributed) which flag flies behind the operation. Pulled from open-source reporting and Mallory's analyst review.
Sectors the actor has been observed targeting.
Geographies tied to known operations.
Attributed origin per open-source reporting.
41 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
12 malware families attributed to this actor across reporting.
7 additional families tracked in Mallory.
19 CVEs this actor has used in observed campaigns. 19 of them exploited in the wild.
The author reports strong indications that Akira and Fog were exploiting CVE-2024-40766 for unauthorized access, with more than 100 suspected victim organizations as of December 23, 2024. However, the article explicitly states that exploitation had not been definitively established. At least 48,933 internet-exposed SonicWall devices reportedly remained unpatched as of December 24, 2024.
Akira uses VPN services without MFA, mostly using known Cisco vulnerabilities CVE-2020-3259 and CVE-2023-20269. CISA added CVE-2020-3259, a Cisco ASA and FTD information disclosure vulnerability, to its known exploited vulnerabilities catalog on February 15, 2024.
Akira uses VPN services without MFA, mostly using known Cisco vulnerabilities CVE-2020-3259 and CVE-2023-20269. CISA added CVE-2023-20269 to its known exploited vulnerabilities catalog on September 13, 2023.
They also exploit CVE-2023-27532 in Veeam Backup & Replication to steal clear-text credentials stored in the backup server's configuration database.
Lateral Movement: Exploiting flaws such as CVE-2023-20269 (Cisco VPN) and CVE-2024-40711 (Veeam Backup & Replication).
14 more CVEs tied to this actor tracked in Mallory.
202 indicators attributed to this actor: domains, IPs, hashes, and other artifacts pulled from reporting. View more in app.
20 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Cited as an example of ransomware actors purchasing existing access rather than performing the initial intrusion themselves. No specific RAT association is established.
Akira is identified as responsible for a reported ransomware attack against an Arizona law firm, discovered on October 15, 2026. The group claims possession of 24 GB of corporate data, including client identity documents, Social Security numbers, court files, contracts, financial records, and confidential documents. The content describes a threatened publication, not a confirmed release, and provides no technical details establishing the intrusion method or encryption activity.
Reportedly conducted a ransomware attack against UK-based Videk, a provider of print verification systems, scanning systems, and data management software. The incident was discovered on October 15, 2026. The attackers claim to possess 8 GB of corporate data and threaten to publish employee and customer information, contracts, financial records, and nondisclosure agreements. The content does not independently verify the data-theft claim.
The report attributes a ransomware attack against Sun Valley Dairy, based in Keizer, Oregon, to Akira. The incident was discovered on October 15, 2026. The attackers claim to possess employee documents, customer information, contracts, and confidential financial records, and threaten to publish corporate data. The content does not independently verify the claimed theft or identify the initial access method.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.