Loading story…
Akira ransomware operators breached a multinational agriculture company through an unpatched single-factor VPN appliance and then exploited the VMware vCenter Server remote code execution flaw CVE-2021-21972 to deepen access inside the victim environment. VMware had previously issued VMSA-2021-0002 to address the vulnerability in ESXi and vCenter Server, but in this intrusion the exposed weakness enabled the attackers to compromise vCenter and pivot into the organization’s virtual infrastructure.
After taking control of vCenter, the attackers created a new virtual machine in the ESXi environment, mounted copied VMDK files from a powered-down domain controller, and extracted NTDS.dit and the SYSTEM hive to obtain highly privileged credentials. With domain administrator access, Akira moved laterally, exfiltrated data, and deployed ransomware in under six hours, using a legacy Veritas Backup Exec Client service and network shares for distribution along with tools including NetCat, RustDesk, AnyDesk, WinSCP, WinRAR, and network scanners; the tradecraft was notable for abusing virtualization layers to evade conventional EDR visibility and was reported to resemble activity previously linked to UTA0178.
TTPs, infrastructure, and targeting history in one profile.
6 events from the most recent confirmed update back to the earliest known activity.
S-RM released a report detailing the intrusion, including the use of vCenter compromise, attacker-created virtual machines, NTDS.dit extraction, and tooling such as RustDesk, AnyDesk, WinSCP, WinRAR, NetCat, and network scanners. The report also noted similarities to activity previously attributed to China-linked actor UTA0178 and shared indicators including repairdll[.]net/jHKIOEyC/.
Using credentials derived from NTDS.dit and the SYSTEM hive, Akira compromised a highly privileged domain administrator account, moved laterally, exfiltrated data, and deployed ransomware in under six hours. The group distributed ransomware via network shares and the legacy Veritas Backup Exec Client service.
Following the vCenter compromise, Akira created a new virtual machine on the ESXi environment, powered down a domain controller VM, copied its VMDK files, and attached them to the attacker-created VM. This let the attackers extract NTDS.dit and the SYSTEM hive outside normal endpoint monitoring.
After obtaining VPN access, the attackers exploited CVE-2021-21972 on VMware vCenter, uploaded a malicious JSP file named healthcheck_beat.jsp, and used it to execute commands and establish a reverse shell with NetCat.
In early 2024, Akira ransomware operators accessed a multinational agriculture company through an unpatched single-factor VPN appliance. This initial foothold preceded exploitation of the victim's VMware environment.
VMware published advisory VMSA-2021-0002 addressing multiple vulnerabilities in ESXi and vCenter Server, including CVE-2021-21972, the vCenter uploadOVA remote code execution flaw later exploited in the Akira intrusion.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers and incident responders reported that **Akira ransomware** affiliates used a repeatable intrusion playbook built around stolen VPN credentials and exploitation of internet-facing appliances, including Fortinet flaws `CVE-2019-6693` and `CVE-2022-40684` and Cisco ASA/FTD flaw `CVE-2023-20269`. Recovered attacker infrastructure exposed direct evidence of reconnaissance, credential theft, and exfiltration activity, including decrypted Fortinet configurations, password-protected RAR archives containing stolen victim data, and command history showing downloads from a public-facing victim server. Investigators said the operators relied heavily on legitimate administration tools such as AnyDesk, TeamViewer, OpenSSH, MobaXterm, PowerShell, WMI, Impacket, WinSCP, FileZilla, and Cloudflared, while moving laterally through RDP and SMB and attempting to disable defenses, erase evidence, and destroy Veeam backups before encryption. Analysis of Akira’s malware and victim activity showed a **double-extortion** model that spans both Windows and Linux environments. The Linux variant supports selective path targeting, network-share encryption, partial encryption, file exclusions, and multithreaded execution using AES and RSA, dropping `akira_readme.txt` ransom notes with Tor-based contact details. Reporting also tied Akira to broad U.S.-focused targeting across sectors and suggested some operators may overlap with other ransomware-as-a-service programs, including possible links to Snatch. The group’s activity continued to affect organizations such as Texas-based **CF Supply**, where attackers were reported to have compromised corporate data that could include client project records, personal information, contracts, and agreements.
Aug 14, 2026
Sophos reported that **Akira** has become a major threat to small and medium-sized organizations across Europe, North America, and Australia, hitting sectors including government, manufacturing, technology, education, consulting, pharmaceuticals, and telecommunications. The group commonly gained initial access through unauthorized logins to **Cisco ASA SSL VPN** and **Cisco AnyConnect** systems that lacked MFA, and in some cases exploited `CVE-2023-20269` and Veeam `CVE-2023-27532`. Researchers said Akira operators routinely stole credentials, moved laterally, established persistence, and attempted to evade defenses before either encrypting systems or stealing data for extortion. Sophos said Akira shifted notably toward **extortion-only** operations beginning in late 2023, exfiltrating data without always deploying ransomware. During intrusions, the actors dumped **LSASS**, extracted `NTDS.dit` and `SYSTEM` hives, targeted Veeam, browser, and KeePass credentials, and used tools including **Mimikatz, AdFind, Advanced IP Scanner, RDP, SMB, wmiexec, PsExec, AnyDesk, WinRAR, rclone, and MEGA**. The report also identified a previously unreported backdoor, **`crome.exe`**, communicating with `170.130.165[.]171`, alongside repeated efforts to disable Sophos and Microsoft Defender protections. When encryption was used, Akira deployed binaries such as `w.exe`, `Lck.exe`, `1.exe`, and `locker.exe`, appended the `.akira` extension, dropped `akira_readme.txt`, deleted Volume Shadow Copies, and in one case encrypted about 65,000 files on a server.
Aug 14, 2026
Ransomware operators are exploiting **CVE-2026-59310**, a critical unauthenticated VMware vCenter Server flaw in the Syslog server, to compromise vCenter management infrastructure and encrypt managed ESXi virtual machines with Babuk-derived payloads. Broadcom patched the vulnerability on July 29, but successful exploitation was observed within five days; reported activity affected 361 victim IP addresses across 47 countries. No ransomware group has been publicly identified. Initial intrusions used reverse-SSH tunnels and cron-job persistence, activity assessed as likely associated with an advanced persistent threat actor before ransomware deployment emerged. CISA has added the 9.8-CVSS vulnerability to its Known Exploited Vulnerabilities catalog and warned of ransomware use. Organizations should urgently install VMware's latest cumulative updates, remove vCenter interfaces from direct internet exposure, limit administration to trusted networks and jump hosts, and investigate formerly exposed or unpatched vCenter instances for persistence and unauthorized access.
Sep 17, 2026