Redbike

REDBIKE is a ransomware family publicly known as Akira. In 2025 reporting based on Mandiant incident response data and Google Threat Intelligence Group analysis, it was identified as the most frequently deployed or most prevalent ransomware family, accounting for about 30% of analyzed or observed ransomware incidents. The reporting states that operators using REDBIKE/Akira were among the prolific ransomware actors that expanded as other major RaaS groups such as LockBit, ALPHV, Basta, and RansomHub were weakened or disrupted.

High-confidence reporting associates REDBIKE/Akira activity with post-compromise ransomware deployments that commonly also involve data theft extortion. Across the analyzed ransomware intrusions, suspected or confirmed data theft was present in 77% of cases, and the majority of incidents involved theft of sensitive business data before encryption. Threat actors were reported using tools such as Rclone, WinRAR, FileZilla, and WinSCP, and exfiltration destinations including MEGA, OneDrive, and Azure; targeted data types included legal documents, HR records, accounting data, and business development files.

The content also states that ransomware operators including those using REDBIKE/Akira increasingly targeted recovery-denial infrastructure in 2025, specifically backup infrastructure, identity services, and virtualization management planes. Reported behaviors in these incidents included deleting backup objects from cloud storage, compromising backup management servers, extracting credentials from configuration databases or enterprise credential vaults, forcing password changes on privileged accounts, exploiting misconfigured Active Directory Certificate Services templates to create administrator accounts, targeting hypervisors and virtualization storage layers, compressing and archiving virtual hard disks directly on hypervisors, and deploying ransomware at the hypervisor level by encrypting datastore files to render multiple virtual machines inoperable simultaneously.

For the broader ransomware incidents in which REDBIKE/Akira appeared, the most common initial access pattern reported was exploitation of vulnerabilities, especially in VPNs and firewalls, accounting for about one-third of incidents. The affected organizations spanned Asia Pacific, Europe, North America, and South America and covered nearly every industry sector.