Akira Ransomware Accelerates Encryption While Copycat Campaign Spoofs Its Brand

The Akira ransomware group has streamlined attacks to move from initial access to data encryption in under four hours, and in some cases in as little as one hour, according to Halcyon. Since emerging in 2023, the group has compromised hundreds of organizations and is estimated to have collected at least $245 million in ransom payments through September 2025. Researchers said Akira gains entry through zero-day exploits, access bought from initial access brokers, VPNs lacking multifactor authentication, and attacks on Veeam Backup & Replication, Cisco VPN, and SonicWall systems. The operation also uses double extortion, stealing data before encryption and threatening leaks, while relying on intermittent encryption and dependable decryption to increase the likelihood that victims pay.

Separately, ESET identified a South American ransomware campaign that impersonates Akira while actually deploying a Babuk-based encryptor against Windows users. The malware appends the .akira extension to files and drops ransom notes that mimic Akira’s language and Tor negotiation links, raising the risk of false attribution. Researchers said the campaign reflects a broader pattern of threat actors reusing leaked Babuk code and borrowing the branding of established ransomware groups, underscoring the need for defenders to verify attribution through technical analysis rather than ransom-note branding alone.