Loading story…
An Akira ransomware affiliate breached a victim through a SonicWall SSL VPN account that lacked MFA after a credential-spraying attempt, then used RDP and Active Directory enumeration to map the environment, collect data, and stage exfiltration. Huntress reported the attacker created AdUsers.txt and AdComp.txt with PowerShell-based AD dumps, used WinRAR to package files, s5cmd to move data to S3, and installed AnyDesk for persistent remote access and payload delivery before launching the Akira encryptor.
The intrusion’s notable defense-evasion step was forcing a compromised Windows host to reboot into Safe Mode with Networking, a technique tracked by MITRE ATT&CK as T1688, to disable endpoint protections while preserving connectivity. In Safe Mode, the Huntress agent and Microsoft Defender real-time protection were suppressed, but the Akira encryptor appears to have hit virtual-memory errors and failed to complete encryption; Defender later detected akira.exe yet could not quarantine it until the system returned to normal mode. Researchers warned the failure was accidental rather than protective, and urged organizations to enforce MFA on VPN access and monitor for failed VPN login bursts, Safe Mode boot changes, and unexpected security-service stoppages.
TTPs, infrastructure, and targeting history in one profile.
10 events from the most recent confirmed update back to the earliest known activity.
On August 12, 2026, Huntress disclosed that an Akira affiliate had compromised a victim in early August, used Safe Mode with Networking to impair defenses, and then failed to encrypt the host after hitting out-of-virtual-memory errors. Huntress said it had not previously observed Akira using this Safe Mode tactic and warned the failure was accidental rather than a reliable defense.
At 08:10 UTC on August 4, 2026, the attacker rebooted the compromised system back into normal Windows. After the reboot, Microsoft Defender real-time protection was restored and successfully cleaned up the Akira payload.
Akira's payload executed at 06:34:29 UTC on August 4, 2026, but the host began generating memory errors shortly after the reboot and the encryptor failed to complete endpoint encryption. Huntress assessed that constrained virtual memory in Safe Mode caused the failure.
After the Safe Mode reboot, the Huntress agent stopped and Windows Defender real-time protection was disabled while network access remained available. Huntress said this was the first time it had observed Akira using Safe Mode with Networking in an intrusion.
At 06:29:21 UTC on August 4, 2026, the attacker used msconfig.exe to force a compromised host to reboot into Safe Mode with Networking and added AnyDesk to the SafeBoot Network registry list so it could still run.
During the intrusion, the attacker installed AnyDesk as a Windows-starting service and used it for hands-on-keyboard access, command-and-control activity, and payload delivery on the victim environment.
The attacker pivoted to an application server, downloaded WinRAR to archive mapped file shares, and used s5cmd to upload the staged data to attacker-controlled cloud storage, indicating double-extortion activity before encryption.
After gaining VPN access, the attacker connected to the domain controller over RDP, opened an elevated command shell, and used PowerShell to dump extensive Active Directory user and computer data to AdUsers.txt and AdComp.txt.
At 03:52:42 UTC on August 4, 2026, the attacker successfully authenticated to the SonicWall SSL VPN using a valid account that lacked multi-factor authentication. Huntress said this access followed the failed login burst by seven minutes.
Beginning around 03:45 UTC on August 4, 2026, the victim's SonicWall SSL VPN recorded multiple failed login attempts against several usernames from external IP addresses, consistent with a credential-spray attack.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.
14 references tracked. Mallory keeps watching after this page renders.
securityaffairs.com
Open sourcecsoonline.com
Open sourcemkd-cirt.mk
Open sourcecsoonline.com
Open sourcecyberveille.ch
Open sourcetheregister.com
Open sourcehuntress.com
Open sourceattack.mitre.org
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Sophos reported that **Akira** has become a major threat to small and medium-sized organizations across Europe, North America, and Australia, hitting sectors including government, manufacturing, technology, education, consulting, pharmaceuticals, and telecommunications. The group commonly gained initial access through unauthorized logins to **Cisco ASA SSL VPN** and **Cisco AnyConnect** systems that lacked MFA, and in some cases exploited `CVE-2023-20269` and Veeam `CVE-2023-27532`. Researchers said Akira operators routinely stole credentials, moved laterally, established persistence, and attempted to evade defenses before either encrypting systems or stealing data for extortion. Sophos said Akira shifted notably toward **extortion-only** operations beginning in late 2023, exfiltrating data without always deploying ransomware. During intrusions, the actors dumped **LSASS**, extracted `NTDS.dit` and `SYSTEM` hives, targeted Veeam, browser, and KeePass credentials, and used tools including **Mimikatz, AdFind, Advanced IP Scanner, RDP, SMB, wmiexec, PsExec, AnyDesk, WinRAR, rclone, and MEGA**. The report also identified a previously unreported backdoor, **`crome.exe`**, communicating with `170.130.165[.]171`, alongside repeated efforts to disable Sophos and Microsoft Defender protections. When encryption was used, Akira deployed binaries such as `w.exe`, `Lck.exe`, `1.exe`, and `locker.exe`, appended the `.akira` extension, dropped `akira_readme.txt`, deleted Volume Shadow Copies, and in one case encrypted about 65,000 files on a server.
Aug 14, 2026
Sophos reported that newly emerged **Akira ransomware** was deployed in two separate April 2023 attacks against organizations in North America, with victims’ files renamed using the `.akira` extension and ransom notes dropped as `fn.txt`. The company said the strain appears unrelated to a 2017 ransomware family of the same name. In one intrusion, attackers gained access to an account through **MFA bypass** activity linked to **TOR exit nodes**, dumped `LSASS` memory via `comsvcs.dll` launched with `rundll32.exe`, moved laterally over **RDP**, tampered with **Windows Defender**, installed **AnyDesk**, and launched encryption after about seven days in the environment. In the second case, attackers entered through **single-factor VPN access**, likely harvested credentials as indicated by `MEMORY.DMP`, conducted reconnaissance with **Advanced IP Scanner** and **LANSweeper** data, used **Cloudflare Tunnel** and **Radmin** for remote access, and staged data with **WinRAR** before deploying ransomware after more than 30 days. Sophos said Akira targeted a relatively narrow set of 26 file extensions, focusing largely on databases, virtual disks, and memory image files while avoiding some file types to preserve system stability, and noted that the slower pace of both operations created multiple opportunities for defenders to detect and disrupt the attacks before encryption.
Jun 29, 2026
Researchers and incident responders reported that **Akira ransomware** affiliates used a repeatable intrusion playbook built around stolen VPN credentials and exploitation of internet-facing appliances, including Fortinet flaws `CVE-2019-6693` and `CVE-2022-40684` and Cisco ASA/FTD flaw `CVE-2023-20269`. Recovered attacker infrastructure exposed direct evidence of reconnaissance, credential theft, and exfiltration activity, including decrypted Fortinet configurations, password-protected RAR archives containing stolen victim data, and command history showing downloads from a public-facing victim server. Investigators said the operators relied heavily on legitimate administration tools such as AnyDesk, TeamViewer, OpenSSH, MobaXterm, PowerShell, WMI, Impacket, WinSCP, FileZilla, and Cloudflared, while moving laterally through RDP and SMB and attempting to disable defenses, erase evidence, and destroy Veeam backups before encryption. Analysis of Akira’s malware and victim activity showed a **double-extortion** model that spans both Windows and Linux environments. The Linux variant supports selective path targeting, network-share encryption, partial encryption, file exclusions, and multithreaded execution using AES and RSA, dropping `akira_readme.txt` ransom notes with Tor-based contact details. Reporting also tied Akira to broad U.S.-focused targeting across sectors and suggested some operators may overlap with other ransomware-as-a-service programs, including possible links to Snatch. The group’s activity continued to affect organizations such as Texas-based **CF Supply**, where attackers were reported to have compromised corporate data that could include client project records, personal information, contracts, and agreements.
Aug 14, 2026