Executive Summary
Akira has spent the past two years methodically expanding from a Windows-only ransomware family into one of the most cross-platform and industrially versatile operations in the ransomware ecosystem. By Q1 2026, it ranked second globally for victim volume behind only Qilin — with 121 named victims in the first quarter alone. The group’s $244 million in documented extortion earnings across its operating lifetime comes from a playbook that has remained largely consistent: compromise an edge VPN appliance, move laterally without custom malware for as long as possible, encrypt ESXi hypervisors to maximise leverage, and run a tight negotiation process.
What has changed is scope. Akira has moved from Cisco ASA and FortiGate exploitation into an extended SonicWall campaign beginning in mid-2025. Its Linux encryptor, initially targeting VMware ESXi, has been adapted to support Hyper-V and Nutanix AHV — extending encryption to environments that were previously outside its operational range. And in a pattern observed across several incidents, the group has experimented with pure data extortion — exfiltrating and threatening to publish without deploying ransomware at all — in cases where encryption would be slower or higher-risk than the data leverage alone.
Threat Actor Profile
Akira was first observed in March 2023. The group runs a distinctive retro-styled data leak site that inverts the aesthetic choices of most ransomware operations — text-based, terminal-style, unusual colour schemes — which has contributed to its notoriety in threat intelligence circles but has no operational significance. Early analysis suggested possible structural relationships with ALPHV/BlackCat, based on code similarities and overlapping tooling choices, but no definitive attribution has been established.
The group does not operate a conventional RaaS affiliate model in the way that RansomHub or LockBit have. Operations are tightly managed by a core team with apparent quality control over targeting and execution. This centralised model limits scale but maintains operational security — the group has avoided the affiliate-driven incidents that have exposed other ransomware operations.
Targeting is primarily volume-driven rather than precision-targeted. Akira scans for vulnerable edge devices across broad IP ranges, maintains access queues, and works through them systematically. The group’s focus is not on maximising the individual ransom demand but on maintaining a high tempo of simultaneous intrusions. This produces the consistent victim volumes that put Akira in the top ransomware groups by activity throughout 2024 and 2025.
Geographically, the US accounts for the majority of victims, followed by the UK, Canada, Germany, and Australia. The sectoral spread is consistent with opportunistic targeting — manufacturing, professional services, healthcare, and education all appear regularly because these sectors have large VPN deployments and are statistically present in the ranges Akira scans, rather than because the group seeks them out specifically.
Tactics, Techniques, and Procedures
Initial Access: The VPN Dependency
Akira’s most defining characteristic is its dependence on VPN appliance vulnerabilities and credential abuse for initial access. The CISA advisory documented this pattern in April 2024; it has not changed fundamentally since, though the specific products targeted have evolved.
Cisco ASA/FTD was the primary initial access vector through 2023-24. CVE-2023-20269 (zero-day in Cisco ASA and FTD SSLVPN enabling credential bruteforce and session fixation) and CVE-2024-20353 (denial of service) provided the group with reliable entry points into Cisco-heavy environments.
FortiGate SSL-VPN has been a persistent target throughout the group’s operation, with Akira adopting compromised credentials from infostealer markets and brute-forcing authentication against FortiGate management interfaces.
SonicWall SSL-VPN became the dominant initial access vector from July 2025 onwards. Darktrace documented a structured Akira campaign specifically targeting SonicWall SMA and SSL-VPN appliances, exploiting CVE-2024-40766 (improper access control in SonicOS) to gain unauthorized VPN access without valid credentials. The SonicWall campaign is notable for its scale — Darktrace observed multiple simultaneous Akira intrusions initiating from SonicWall VPN sessions across different victim environments within compressed timeframes, suggesting automated or semi-automated initial access.
The common thread is not the specific product but the category: internet-facing appliances handling VPN termination that organisations are slow to patch, frequently run with weak credential policies, and that provide authenticated network access on successful compromise.
Post-Exploitation: Living Off the Land Until Encryption
Once inside, Akira demonstrates unusual discipline in minimising its custom-tool footprint during the reconnaissance and lateral movement phases. Post-exploitation activity documented across multiple incident reports follows a consistent pattern:
Credential harvesting from LSASS memory via ProcDump, TaskManager dump, or comsvcs.dll (the MITRE T1003.001 approach); from the Security Account Manager database; and from browser credential stores where VPN client tools or admin portals save passwords. The group also harvests credentials from Active Directory with BloodHound/SharpHound enumeration.
Lateral movement primarily via Remote Desktop Protocol (RDP) and Windows Management Instrumentation (WMI). The group’s preference for legitimate remote access tools — AnyDesk is consistently documented as a persistence mechanism in Akira incidents — allows it to blend with legitimate administrator activity during the dwell period.
Exfiltration via RClone, a legitimate file synchronization tool, targeting cloud storage providers including Mega and Wasabi. The use of RClone with legitimate cloud storage endpoints makes exfiltration harder to distinguish from routine backup traffic without specific alerting on the tool binary and its command-line arguments.
Domain controller targeting follows standard ransomware pre-encryption preparation: the group disables VSS (Volume Shadow Copies) via vssadmin and bcdedit to prevent recovery, and may disable Windows Defender and other endpoint security tools through registry modifications.
Encryption: Cross-Platform Expansion
Akira’s encryption capabilities have expanded significantly since initial deployment. The original Windows encryptor uses ChaCha20 symmetric encryption with RSA-4096 for key protection and appends the .akira extension to encrypted files.
The Linux variant, deployed against VMware ESXi, uses the same ChaCha20/RSA approach but targets virtual machine disk files (.vmdk, .vmx, .nvram) directly on the datastore rather than accessing individual VMs. This approach encrypts the storage layer rather than individual operating systems, allowing Akira to encrypt an entire virtualised environment by compromising a single ESXi host.
The more significant recent expansion is to Hyper-V and Nutanix AHV hypervisors. Targeting Hyper-V extends Akira’s reach into Windows Server-based virtualisation environments common in mid-market organisations that have not migrated to VMware. Nutanix AHV coverage adds enterprise cloud infrastructure environments. The practical effect is that organisations previously outside Akira’s encryption scope — running Hyper-V rather than ESXi — are now targeted.
In some recent incidents, Akira has deployed no ransomware at all, relying exclusively on the threat of data publication to extract payment. This pattern is consistent with increased security tooling making encryption detection faster, and with the observation that organisations increasingly restore from backup rather than pay ransoms — making the data theft leverage more operationally reliable than the encryption component.
Targeting Profile and Victim Impact
Akira’s victim sectors across its operating history show broad opportunism rather than targeted selection:
- Manufacturing: Process manufacturers, industrial equipment, automotive suppliers. VMware ESXi is common in manufacturing environments, making them high-value encryption targets.
- Professional services: Law firms, accounting practices, consulting firms. High-sensitivity data (client matters, financial records) provides strong extortion leverage.
- Healthcare: Hospitals, clinics, and healthcare adjacent businesses. Data sensitivity and operational pressure create payment motivation.
- Education: Universities and school districts. Often large VMware installations with older patch cycles.
- Finance: Financial advisors, wealth management firms, smaller banks. Regulatory pressure around breach disclosure creates strong incentives to resolve incidents quietly.
Akira’s negotiation process is characterised by short timelines — typically 5-7 days before data publication — and ransom demands calibrated to visible revenue from business registries and financial disclosures. Documented ransom demands have ranged from approximately $200,000 for small businesses to $20 million for large enterprises.
Recent Campaign Activity: SonicWall and Hypervisor Expansion
The SonicWall campaign beginning July 2025 represents Akira’s most systematic exploitation of a specific product category. CVE-2024-40766, a CVSS 9.3 vulnerability in SonicOS management access and SSL-VPN that allows unauthenticated access to resources and potential firewall crashes, was initially disclosed by SonicWall in August 2024. CISA added it to the Known Exploited Vulnerabilities catalogue in September 2024.
Akira’s adoption of SonicWall as a primary initial access vector accelerated through late 2024 and into 2025, as organisations running Cisco ASA (the previous primary target) progressively patched or replaced affected appliances. The SonicWall installed base — particularly SMA100 series and SSL-VPN appliances in smaller businesses and branch office environments — provided a large, partially unpatched target population.
Darktrace’s investigation into the SonicWall campaign documented Akira using the same post-exploitation pattern regardless of initial access vector: RDP lateral movement within minutes of gaining VPN access, rapid BloodHound enumeration, and ESXi encryption within 12-24 hours of initial access. The speed of the operation is consistent with a practiced team executing against a known playbook rather than adapting to each environment.
Defensive Implications
Akira’s operational model creates specific defensive opportunities at each phase of the attack chain.
VPN hardening is the primary prevention priority. The group’s dependence on VPN initial access means that organisations with properly patched, MFA-enforced VPN infrastructure are substantially harder initial targets. Akira scans for vulnerable appliances and moves to next targets when initial exploitation fails. Key actions:
- Apply all critical patches for Cisco ASA/FTD, FortiGate, and SonicWall SSL-VPN appliances immediately — Akira’s targeting is drawn from KEV and exploit-available CVEs
- Enforce MFA for all VPN authentication — credential-only authentication is the primary way Akira converts a compromised credential into network access
- Review SSL-VPN access logs for authentication anomalies: authentication from unusual geolocations, off-hours access from known-normal accounts, and rapid sequential authentication from multiple accounts
Detection during dwell. Akira’s living-off-the-land approach during reconnaissance is detectable through behavioural patterns rather than tool signatures:
- Alert on RClone execution with known cloud storage endpoints (Mega, Wasabi, BackBlaze) in command-line arguments — this is a high-fidelity Akira exfiltration indicator
- Monitor for BloodHound/SharpHound LDAP enumeration (large LDAP queries, directory enumeration by non-admin accounts)
- Alert on AnyDesk installation from command line or staged binary — the group uses this as a backup access mechanism
- Monitor for vssadmin delete shadows and bcdedit commands — these are pre-encryption indicators
ESXi and hypervisor protection. The ESXi-to-Hyper-V expansion means that hypervisor attack surface management extends beyond VMware:
- Enable vSphere and ESXi authentication logging and alert on ESXi direct access from unusual sources
- Restrict management plane access for both ESXi and Hyper-V to jump servers or management networks rather than flat enterprise access
- Ensure hypervisor-layer backups (snapshots, replication) are stored offline or in immutable storage — Akira’s ESXi encryption targets the storage layer, so backups on the same NFS datastore will be encrypted alongside production VMs
The group’s continued prominence — second only to Qilin in Q1 2026 victim volume — reflects an operation that has found a durable model and iterates it efficiently. There is no indication of operational disruption or law enforcement action targeting Akira at the infrastructure level; the group continues to operate at high tempo.