Akira
Ransomware-as-a-service operation active since March 2023, characterized by an unusually retro 1980s-terminal-styled leak site. CISA estimated $42M+ in extracted ransoms across 250+ organizations within the first year. Notable for targeting Cisco ASA/FTD VPN appliances lacking MFA as the initial-access vector, and for deploying Linux/ESXi variants against virtualized infrastructure to maximize impact.
Aliases
Motivations
Target sectors
Target countries
Diamond Model
Caltagirone / Pendergast / Betz 2013 — four-vertex attribution framework.
MITRE ATT&CK techniques
Timeline
5 events- AdvisoryCritical2025-11-13·CISA
Updated joint advisory: Akira tied to ~$244M in proceeds, now hitting Nutanix AHV
The 13 Nov 2025 update to AA24-109A — co-signed by FBI, CISA, DC3, HHS, Europol EC3, French OFAC, German LKA Baden-Württemberg, and NCSC-NL — reports that Akira has claimed approximately $244.17M (USD) in ransom proceeds as of late September 2025 and, in a June 2025 incident, encrypted Nutanix AHV virtual-machine disk files for the first time, abusing SonicWall CVE-2024-40766 for initial access.
advisorystopransomwarenutanixsonicwallcve-2024-40766 - AdvisoryHigh2024-04-18·CISA
FBI, CISA, Europol, NCSC-NL issue joint #StopRansomware advisory on Akira
FBI, CISA, the Europol European Cybercrime Centre, and the Netherlands' National Cyber Security Centre published the first joint #StopRansomware advisory on Akira (AA24-109A), detailing initial-access TTPs against Cisco VPN appliances without MFA (CVE-2020-3259, CVE-2023-20269), Megazord and Akira_v2 tradecraft, and a multi-page IOC table covering encryptor hashes and supporting tooling.
advisorystopransomwarecisco-vpn - ReportHigh2023-08-01·CISA
Akira begins deploying Rust-based 'Megazord' encryptor
Beginning in August 2023, Akira intrusions started deploying a secondary encryptor written in Rust and tracked as Megazord, which appends a .powerranges extension. Akira affiliates have continued to use the original C++ Akira encryptor, Megazord, and Akira_v2 interchangeably across campaigns.
ransomwarerustmegazord - ReportHigh2023-04-01·CISA
Akira deploys Linux variant targeting VMware ESXi
Within a month of emergence, Akira threat actors deployed a Linux variant targeting VMware ESXi virtual machines, allowing the operation to encrypt entire virtualisation estates from a single foothold. The pivot to ESXi is documented in the joint FBI/CISA #StopRansomware advisory AA24-109A.
ransomwareesxilinux - ReportHigh2023-03-01·MITRE ATT&CK
Akira ransomware operation emerges, targeting Windows environments
Akira ransomware activity first observed in March 2023, initially targeting Windows systems with a C++ encryptor that appends a .akira extension. Akira operates as a double-extortion crew and is tracked by industry as Storm-1567, Howling Scorpius, Punk Spider, and Gold Sahara, with code overlap suggesting links to the defunct Conti operation.
ransomwaredouble-extortionconti-lineage
Indicators of compromise
3 indicators| Type | Value | First seen | Source |
|---|---|---|---|
| SHA-256 | family · Akira_v2 SHA-256 of Akira_v2, a Rust-based variant of the Akira ransomware that targets VMware ESXi servers. Published in Table 2 of CISA AA24-109A. | Dec 31, 2023 | CISA |
| SHA-256 | family · Megazord SHA-256 of the Megazord encryptor — the Rust-based Akira variant that appends a `.powerranges` extension. Listed in the Megazord row of Table 2 of CISA AA24-109A. | Jul 31, 2023 | CISA |
| SHA-256 | family · Akira SHA-256 of the Akira ransomware encryptor `w.exe`. Listed in Table 2 of CISA AA24-109A as the canonical C++ Akira encryptor observed in early intrusions. | Feb 28, 2023 | CISA |
Leak-site activity (unverified)
full feed →Recent victim disclosures posted by this group on its leak site, via ransomware.live. These are unverified attacker claims — ransomware crews routinely fabricate, double-post, or inflate victims. Surface only.
Related actors
shared ATT&CK techniques- RU · Russia8Base4 shared techniques
- ?? · UnknownHive4 shared techniques
- ?? · UnknownQilin4 shared techniques
- ?? · UnknownRansomHub4 shared techniques
- ?? · UnknownALPHV/BlackCat3 shared techniques
- RU · RussiaDarkSide3 shared techniques
References
cite this page
Threat Intel Tracker. (2026-05-19). Akira — actor profile. Retrieved from https://threatintel.local/actors/akira