Loading story…
Akira ransomware-as-a-service affiliates breached organizations through compromised Atera RMM/MSP credentials, stolen RDP credentials, and a compromised SSL-VPN service account in three intrusions observed in a shared managed environment. Despite differing entry points, the actors performed reconnaissance, activated accounts, and stole credentials; two used Impacket WmiExec and esentutl to obtain Chrome credentials. Their outcomes diverged: one targeted ESXi with a Linux encryptor, one exfiltrated data without observed encryption, and another shut down Hyper-V virtual machines before deploying a renamed Akira encryptor.
The affiliates used varied data-theft paths, including Rclone with Wasabi, WinSCP/SFTP, and—in one case—no observed exfiltration before encryption. Defenders should prioritize detection of suspicious RMM-launched child processes, Cloudflare Tunnel activity, Veeam database credential queries, Impacket output redirection, browser-database copying, archive staging, and SafeBoot, ESXi, or Hyper-V actions preceding encryption. Akira has historically relied heavily on compromised VPN credentials where MFA was absent and uses double extortion; reporting has also linked some Akira ransom-payment flows and technical traits to Conti-affiliated actors.
TTPs, infrastructure, and targeting history in one profile.
7 events from the most recent confirmed update back to the earliest known activity.
The FBI and CISA updated their #StopRansomware advisory AA24-109A on Akira ransomware, following the agencies' original April 2024 advisory.
Avast released a decryptor for Akira ransomware. Akira actors subsequently modified their encryption routine, potentially limiting the decryptor's usefulness for files encrypted later.
Akira ransomware was first observed as a ransomware-as-a-service operation. It typically exfiltrates data before encrypting systems to support double-extortion demands.
In a third intrusion, an affiliate used a compromised third-party monitoring-agent service account to access an SSL-VPN, reset the account password, performed discovery, and stole browser credentials and sensitive employee documents. The actor shut down Hyper-V virtual machines and executed a renamed Akira encryptor, creating an Akira ransom note after encryption began.
In a second intrusion, an affiliate accessed the environment through external RDP using a compromised domain-administrator account. The actor activated local Administrator accounts, harvested Chrome credentials, staged password-protected archives, and exfiltrated data through WinSCP to external SFTP servers; no ransomware deployment was observed.
In one intrusion, an Akira affiliate used compromised managed-service-provider credentials to access an Atera RMM portal and execute commands on managed endpoints. The actor installed Cloudflare Tunnel and AnyDesk, obtained Veeam database credentials, exfiltrated backup and QuickBooks data, and prepared an ESXi host for Linux ransomware deployment.
Arctic Wolf's blockchain analysis identified at least three transactions in which Akira actors sent full ransom payments totaling more than $600,000 to Conti-affiliated addresses. The firm assessed with high confidence that some Conti-affiliated actors were linked to Akira.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.
6 references tracked. Mallory keeps watching after this page renders.
shroudcloud.io
Open sourceshroudcloud.io
Open sourcehalcyon.ai
Open sourceblog.talosintelligence.com
Open sourcearcticwolf.com
Open sourceunit42.paloaltonetworks.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers and incident responders reported that **Akira ransomware** affiliates used a repeatable intrusion playbook built around stolen VPN credentials and exploitation of internet-facing appliances, including Fortinet flaws `CVE-2019-6693` and `CVE-2022-40684` and Cisco ASA/FTD flaw `CVE-2023-20269`. Recovered attacker infrastructure exposed direct evidence of reconnaissance, credential theft, and exfiltration activity, including decrypted Fortinet configurations, password-protected RAR archives containing stolen victim data, and command history showing downloads from a public-facing victim server. Investigators said the operators relied heavily on legitimate administration tools such as AnyDesk, TeamViewer, OpenSSH, MobaXterm, PowerShell, WMI, Impacket, WinSCP, FileZilla, and Cloudflared, while moving laterally through RDP and SMB and attempting to disable defenses, erase evidence, and destroy Veeam backups before encryption. Analysis of Akira’s malware and victim activity showed a **double-extortion** model that spans both Windows and Linux environments. The Linux variant supports selective path targeting, network-share encryption, partial encryption, file exclusions, and multithreaded execution using AES and RSA, dropping `akira_readme.txt` ransom notes with Tor-based contact details. Reporting also tied Akira to broad U.S.-focused targeting across sectors and suggested some operators may overlap with other ransomware-as-a-service programs, including possible links to Snatch. The group’s activity continued to affect organizations such as Texas-based **CF Supply**, where attackers were reported to have compromised corporate data that could include client project records, personal information, contracts, and agreements.
Aug 14, 2026
Sophos reported that **Akira** has become a major threat to small and medium-sized organizations across Europe, North America, and Australia, hitting sectors including government, manufacturing, technology, education, consulting, pharmaceuticals, and telecommunications. The group commonly gained initial access through unauthorized logins to **Cisco ASA SSL VPN** and **Cisco AnyConnect** systems that lacked MFA, and in some cases exploited `CVE-2023-20269` and Veeam `CVE-2023-27532`. Researchers said Akira operators routinely stole credentials, moved laterally, established persistence, and attempted to evade defenses before either encrypting systems or stealing data for extortion. Sophos said Akira shifted notably toward **extortion-only** operations beginning in late 2023, exfiltrating data without always deploying ransomware. During intrusions, the actors dumped **LSASS**, extracted `NTDS.dit` and `SYSTEM` hives, targeted Veeam, browser, and KeePass credentials, and used tools including **Mimikatz, AdFind, Advanced IP Scanner, RDP, SMB, wmiexec, PsExec, AnyDesk, WinRAR, rclone, and MEGA**. The report also identified a previously unreported backdoor, **`crome.exe`**, communicating with `170.130.165[.]171`, alongside repeated efforts to disable Sophos and Microsoft Defender protections. When encryption was used, Akira deployed binaries such as `w.exe`, `Lck.exe`, `1.exe`, and `locker.exe`, appended the `.akira` extension, dropped `akira_readme.txt`, deleted Volume Shadow Copies, and in one case encrypted about 65,000 files on a server.
Aug 14, 2026
The **Akira** ransomware group has streamlined attacks to move from initial access to data encryption in under four hours, and in some cases in as little as one hour, according to Halcyon. Since emerging in 2023, the group has compromised hundreds of organizations and is estimated to have collected at least **$245 million** in ransom payments through September 2025. Researchers said Akira gains entry through zero-day exploits, access bought from initial access brokers, VPNs lacking multifactor authentication, and attacks on **Veeam Backup & Replication**, **Cisco VPN**, and **SonicWall** systems. The operation also uses **double extortion**, stealing data before encryption and threatening leaks, while relying on intermittent encryption and dependable decryption to increase the likelihood that victims pay. Separately, ESET identified a South American ransomware campaign that **impersonates Akira** while actually deploying a **Babuk-based** encryptor against Windows users. The malware appends the `.akira` extension to files and drops ransom notes that mimic Akira’s language and Tor negotiation links, raising the risk of false attribution. Researchers said the campaign reflects a broader pattern of threat actors reusing leaked Babuk code and borrowing the branding of established ransomware groups, underscoring the need for defenders to verify attribution through technical analysis rather than ransom-note branding alone.
Jun 29, 2026