Loading malware…
Akira is a financially motivated ransomware family and ransomware-as-a-service operation first identified in early 2023. It targets Windows, Linux, and VMware ESXi environments and employs double extortion, stealing sensitive information before encrypting systems and threatening to publish stolen data. Victims include small and medium-sized businesses and critical infrastructure organizations across North America, Europe, Australia, and other regions, spanning manufacturing, healthcare, education, finance, professional services, and additional sectors.
Akira affiliates obtain initial access through compromised credentials, internet-facing VPN and RDP services, spearphishing, and exploitation of perimeter vulnerabilities. Documented exploitation includes CVE-2020-3259 and CVE-2023-20269 in Cisco ASA and Firepower Threat Defense, and CVE-2024-40766 in SonicWall appliances. Affiliates also purchase access from initial access brokers and conduct password-spraying and brute-force attacks, particularly against accounts without multifactor authentication.
Post-compromise operations include network and Active Directory discovery, credential dumping, privilege escalation, and lateral movement through RDP, WMI, and PowerShell Remoting. Operators maintain access using legitimate remote-administration software and tunnels, and exfiltrate data through utilities such as Rclone, WinSCP, and FileZilla. Defense evasion includes disabling security controls and abusing a vulnerable, signed Zemana anti-malware driver through PowerTool to terminate endpoint security processes. Windows volume shadow copies are deleted to hinder recovery.
Early Akira encryptors were written in C++; subsequent development introduced the Rust-based Megazord variant and Akira_v2, while C++ variants continued to evolve. Akira uses hybrid encryption combining ChaCha20 and RSA, with variants supporting partial encryption and targeting of virtual machines. The operation has been tracked under the threat-actor designations PUNK SPIDER and GOLD SAHARA.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
11 CVEs Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.
SonicWall has determined that the recent SSLVPN exploitation is not due to a zero-day vulnerability, but is instead related to CVE-2024-40766, which was publicly disclosed in August 2024. | They also disabled security controls using native Windows tools such as Set-MpPreference and netsh.exe before deleting Volume Shadow Copies and deploying the Akira ransomware.
Akira uses VPN services without MFA, mostly using known Cisco vulnerabilities CVE-2020-3259 and CVE-2023-20269. CISA added CVE-2020-3259, a Cisco ASA and FTD information disclosure vulnerability, to its known exploited vulnerabilities catalog on February 15, 2024. | Initial iterations of the Akira ransomware variant were coded in C++ and encrypted files with a .akira extension.
Akira uses VPN services without MFA, mostly using known Cisco vulnerabilities CVE-2020-3259 and CVE-2023-20269. CISA added CVE-2023-20269 to its known exploited vulnerabilities catalog on September 13, 2023. | Initial iterations of the Akira ransomware variant were coded in C++ and encrypted files with a .akira extension.
The threat actors have also been observed exploiting CVE-2020-3259, CVE-2023-20263, and CVE-2023-48788.
Lateral Movement: Exploiting flaws such as CVE-2023-20269 (Cisco VPN) and CVE-2024-40711 (Veeam Backup & Replication).
The threat actors have also been observed exploiting CVE-2020-3259, CVE-2023-20263, and CVE-2023-48788.
They also exploit CVE-2023-27532 in Veeam Backup & Replication to steal clear-text credentials stored in the backup server's configuration database.
CVE-2022-40684 is a critical authentication bypass vulnerability in Fortinet FortiOS, FortiProxy, and FortiManager network edge appliances. With a CVSS score of 9.8, this vulnerability allows attackers to bypass authentication mechanisms completely, granting them administrator-level access to affected devices. | Threat groups like “Akira” have exploited CVE-2022-40684 for ransomware deployment.
Akira ransomware is a ransomware-as-a-service (RaaS) operation active since March 2023 that steals a victim’s data and then encrypts their systems to force payment.
The first of these tools was named decrypt.py ... and is used for decrypting password data from Fortinet devices vulnerable to CVE-2019-6693... Unlike decrypt.py, this tool chains CVE-2019-6693 and CVE-2022-40684 in order to increase the effectiveness of exploitation. | Stairwell researchers recovered a home directory that had been accidentally publicly exposed from a server conducting exploitation of Fortinet appliances and deploying the Akira ransomware.
Once connected via the VPN, the threat actor leveraged a remote code execution (RCE) vulnerability (CVE-2021-21972) in the VMware vCenter server. This vulnerability affects the ‘uploadOVA’ function, allowing unauthenticated attackers to upload malicious files to the vulnerable ‘/ui/vropspluginui/rest/services/*’ endpoint. | In this special Cyber Intelligence Briefing, our cyber experts at S-RM, Ineta Simkunaite and Callum Wilson, unravel a recent encounter with the Akira ransomware group. Their review unveils a novel privilege escalation technique used by attackers.
9 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
Initial iterations of the Akira ransomware variant were coded in C++ and encrypted files with a .akira extension.
Akira ransomware is a ransomware-as-a-service (RaaS) operation active since March 2023 that steals a victim’s data and then encrypts their systems to force payment.
Ransomware operators such as BlackByte, Storm-0506, Storm-1175, Octo Tempest, and Manatee Tempest have been actively exploiting CVE-2024-37085 ... where some of these cases have led to Akira and Black Basta ransomware deployments.
Ransomware operators such as BlackByte, Storm-0506, Storm-1175, Octo Tempest, and Manatee Tempest have been actively exploiting CVE-2024-37085 ... where some of these cases have led to Akira and Black Basta ransomware deployments.
Ransomware operators such as BlackByte, Storm-0506, Storm-1175, Octo Tempest, and Manatee Tempest have been actively exploiting CVE-2024-37085 ... where some of these cases have led to Akira and Black Basta ransomware deployments.
Ransomware operators such as BlackByte, Storm-0506, Storm-1175, Octo Tempest, and Manatee Tempest have been actively exploiting CVE-2024-37085 ... where some of these cases have led to Akira and Black Basta ransomware deployments.
20 distinct techniques documented for this family, organized by ATT&CK tactic.
Techniques to delete shadow copies and disable security tools to hinder recovery efforts will be used.
Akira threat actors encrypt data on target systems to interrupt availability to system and network resources.
379 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Other indicator types observed in public reporting.
200 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Mentioned as an example of ransomware operations whose affiliates purchase initial access. No relationship with a particular RAT family is established.
Ransomware associated with an affiliate intrusion through SonicWall SSL VPN access lacking MFA. The affiliate stole credentials and file-share data, but the attempted ransomware deployment failed. The content does not identify a specific exploited vulnerability or establish that Akira itself performed the credential or data theft.
Encrypted the victim’s file shares. Investigators reconstructed repeated encryption activity using Shellbags, PowerShell events recording shadow-copy deletion, and Akira log files despite the absence of initial EDR telemetry.
Ransomware used to encrypt files in an organization's Shares folder. Investigators reconstructed repeated encryption activity by correlating Akira log files, Shellbags artifacts, and concurrent PowerShell commands deleting volume shadow copies. Limited pre-installation EDR telemetry prevented a complete reconstruction of initial access and earlier attacker activity.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.