Loading story…
The Akira ransomware group has claimed responsibility for breaching Apache OpenOffice and exfiltrating 23 GB of sensitive data, including employee records, financial documents, internal confidential files, and reports related to application issues. The stolen employee data reportedly contains physical addresses, phone numbers, driver’s licenses, social security cards, and credit card information. Akira has threatened to leak these corporate files, but as of now, the Apache Software Foundation has not confirmed the breach or the authenticity of the claims. Users have been advised to download OpenOffice only from official sources to avoid potential compromise, and there is no indication that the public download infrastructure has been affected.
Akira, a ransomware-as-a-service operation known for double extortion tactics, has previously targeted hundreds of organizations worldwide, typically avoiding Russian-speaking countries. The group’s claims about the Apache OpenOffice breach remain unverified, and it is unclear whether the data is newly compromised or recycled from previous incidents. The situation is being monitored, and the Apache Software Foundation has been contacted for comment, but no official response has been issued at this time.
TTPs, infrastructure, and targeting history in one profile.
1 event from the most recent confirmed update back to the earliest known activity.
The Akira ransomware group allegedly added Apache OpenOffice to its leak site and claimed it stole 23GB of data from the project. The available references do not provide a more specific incident date beyond the reporting timeframe.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers and incident responders reported that **Akira ransomware** affiliates used a repeatable intrusion playbook built around stolen VPN credentials and exploitation of internet-facing appliances, including Fortinet flaws `CVE-2019-6693` and `CVE-2022-40684` and Cisco ASA/FTD flaw `CVE-2023-20269`. Recovered attacker infrastructure exposed direct evidence of reconnaissance, credential theft, and exfiltration activity, including decrypted Fortinet configurations, password-protected RAR archives containing stolen victim data, and command history showing downloads from a public-facing victim server. Investigators said the operators relied heavily on legitimate administration tools such as AnyDesk, TeamViewer, OpenSSH, MobaXterm, PowerShell, WMI, Impacket, WinSCP, FileZilla, and Cloudflared, while moving laterally through RDP and SMB and attempting to disable defenses, erase evidence, and destroy Veeam backups before encryption. Analysis of Akira’s malware and victim activity showed a **double-extortion** model that spans both Windows and Linux environments. The Linux variant supports selective path targeting, network-share encryption, partial encryption, file exclusions, and multithreaded execution using AES and RSA, dropping `akira_readme.txt` ransom notes with Tor-based contact details. Reporting also tied Akira to broad U.S.-focused targeting across sectors and suggested some operators may overlap with other ransomware-as-a-service programs, including possible links to Snatch. The group’s activity continued to affect organizations such as Texas-based **CF Supply**, where attackers were reported to have compromised corporate data that could include client project records, personal information, contracts, and agreements.
Aug 14, 2026
U.S. and European cyber authorities released an updated joint advisory detailing the latest tactics, techniques, and procedures (TTPs) used by the Akira ransomware group, which has rapidly become one of the most consequential ransomware threats targeting critical infrastructure and businesses worldwide. The advisory, supported by agencies including CISA, FBI, DoD Cyber Crime Center, HHS, Europol, and law enforcement from France, Germany, and the Netherlands, highlights Akira’s evolution, its double-extortion model, and its targeting of sectors such as manufacturing, education, IT, healthcare, financial, and agriculture. Akira actors exploit vulnerabilities in edge devices, backup servers, and VPN products—including SonicWall (CVE-2024-40766), Cisco, Windows, VMware ESXi, and Veeam—using techniques like credential theft, brute-force attacks, and initial access brokers. They employ remote management tools (AnyDesk, LogMeIn) for defense evasion, uninstall endpoint detection and response (EDR) systems, and leverage custom malware such as POORTRY for privilege escalation. As of late September 2025, Akira has extorted over $244 million in ransom payments, primarily from small- and medium-sized businesses. The group is associated with other threat actors such as Storm-1567, Howling Scorpius, Punk Spider, and Gold Sahara, and may have links to the disbanded Conti group. The FBI ranks Akira among the top five ransomware variants it investigates, citing its significant financial and operational impact on victims. The advisory provides updated indicators of compromise (IOCs), detection methods, and a list of newly exploited vulnerabilities to help organizations defend against Akira’s ongoing campaigns.
Jun 29, 2026
Sophos reported that **Akira** has become a major threat to small and medium-sized organizations across Europe, North America, and Australia, hitting sectors including government, manufacturing, technology, education, consulting, pharmaceuticals, and telecommunications. The group commonly gained initial access through unauthorized logins to **Cisco ASA SSL VPN** and **Cisco AnyConnect** systems that lacked MFA, and in some cases exploited `CVE-2023-20269` and Veeam `CVE-2023-27532`. Researchers said Akira operators routinely stole credentials, moved laterally, established persistence, and attempted to evade defenses before either encrypting systems or stealing data for extortion. Sophos said Akira shifted notably toward **extortion-only** operations beginning in late 2023, exfiltrating data without always deploying ransomware. During intrusions, the actors dumped **LSASS**, extracted `NTDS.dit` and `SYSTEM` hives, targeted Veeam, browser, and KeePass credentials, and used tools including **Mimikatz, AdFind, Advanced IP Scanner, RDP, SMB, wmiexec, PsExec, AnyDesk, WinRAR, rclone, and MEGA**. The report also identified a previously unreported backdoor, **`crome.exe`**, communicating with `170.130.165[.]171`, alongside repeated efforts to disable Sophos and Microsoft Defender protections. When encryption was used, Akira deployed binaries such as `w.exe`, `Lck.exe`, `1.exe`, and `locker.exe`, appended the `.akira` extension, dropped `akira_readme.txt`, deleted Volume Shadow Copies, and in one case encrypted about 65,000 files on a server.
Aug 14, 2026