Akira Ransomware Affiliates Exploited Edge Devices and Expanded Cross-Platform Attacks

Researchers and incident responders reported that Akira ransomware affiliates used a repeatable intrusion playbook built around stolen VPN credentials and exploitation of internet-facing appliances, including Fortinet flaws CVE-2019-6693 and CVE-2022-40684 and Cisco ASA/FTD flaw CVE-2023-20269. Recovered attacker infrastructure exposed direct evidence of reconnaissance, credential theft, and exfiltration activity, including decrypted Fortinet configurations, password-protected RAR archives containing stolen victim data, and command history showing downloads from a public-facing victim server. Investigators said the operators relied heavily on legitimate administration tools such as AnyDesk, TeamViewer, OpenSSH, MobaXterm, PowerShell, WMI, Impacket, WinSCP, FileZilla, and Cloudflared, while moving laterally through RDP and SMB and attempting to disable defenses, erase evidence, and destroy Veeam backups before encryption.

Analysis of Akira’s malware and victim activity showed a double-extortion model that spans both Windows and Linux environments. The Linux variant supports selective path targeting, network-share encryption, partial encryption, file exclusions, and multithreaded execution using AES and RSA, dropping akira_readme.txt ransom notes with Tor-based contact details. Reporting also tied Akira to broad U.S.-focused targeting across sectors and suggested some operators may overlap with other ransomware-as-a-service programs, including possible links to Snatch. The group’s activity continued to affect organizations such as Texas-based CF Supply, where attackers were reported to have compromised corporate data that could include client project records, personal information, contracts, and agreements.