Akira

Introduction

Akira is a ransomware variant and ransomware deployment entity active since at least March 2023. Arctic Wolf Akira 2023 Akira uses compromised credentials to access single-factor external access mechanisms such as VPNs for initial access, then various publicly-available tools and techniques for lateral movement. Arctic Wolf Akira 2023 Secureworks GOLD SAHARA Akira operations are associated with “double extortion” ransomware activity, where data is exfiltrated from victim environments prior to encryption, with threats to publish files if a ransom is not paid. Technical analysis of Akira ransomware indicates variants capable of targeting Windows or VMWare ESXi hypervisors and multiple overlaps with Conti ransomware. BushidoToken Akira 2023 CISA Akira Ransomware APR 2024 Cisco Akira Ransomware OCT 2024

Activities and Tactics

Targeted Sectors: Healthcare, Education, Government, Technology

Country of Origin: 🏳️ Unknown

Risk Level: High

First Seen: 2023

Last Activity: 2025

Notable Campaigns

• Nissan Australia (December 2023; Akira (Ransomware))
• BHI Energy (October 2023; Akira (Ransomware))
• Community-reported ransomware incident: June 2025, Construction, Canada (source: CR-001-AKIRA-JUN-2025.md)
• Community-reported ransomware incident: April 2025, Food and Agriculture, Canada (source: CR-002-AKIRA-APR-2025.md)
• Community-reported ransomware incident: June 2025, Manufacturing, Canada (source: CR-003-AKIRA-JUN-2025.md)
• Community-reported ransomware incident: August 2025, Construction, USA (source: CR-009-AKIRA-AUG-2025.md)
• Community-reported ransomware incident: August 2025, Engineering, USA (source: CR-010-AKIRA-AUG-2025.md)
• Community-reported ransomware incident: September 2025, Professional Services, Canada (source: CR-017-AKIRA-SEP-2025.md)
• Community-reported ransomware incident: November 2025, Manufacturing, Canada (source: CR-018-AKIRA-NOV-2025.md)

Tactics, Techniques, and Procedures (TTPs)

Ransomware Vulnerability Matrix observations

Notable Indicators of Compromise (IOCs)

No separately curated network indicators or file hashes are listed for this actor. Known exploited vulnerabilities appear in the CISA Known Exploited Vulnerabilities (KEV) section below.

Malware and Tools

Ransomware Tool Matrix observations

Attribution and Evidence

Country of Origin: Unknown Additional attribution information pending cataloguing.

References

[1] MITRE ATT&CK MITRE ATT&CK entry [2] Arctic Wolf Akira 2023 [3] Secureworks GOLD SAHARA [4] BushidoToken Akira 2023 [5] CISA Akira Ransomware APR 2024 [6] Cisco Akira Ransomware OCT 2024

CISA Known Exploited Vulnerabilities (KEV)

The following CVEs are known to be exploited by this actor, listed in the CISA KEV catalog.