Akira

Introduction

Akira is a ransomware variant and ransomware deployment entity active since at least March 2023. Arctic Wolf Akira 2023 Akira uses compromised credentials to access single-factor external access mechanisms such as VPNs for initial access, then various publicly-available tools and techniques for lateral movement. Arctic Wolf Akira 2023 Secureworks GOLD SAHARA Akira operations are associated with “double extortion” ransomware activity, where data is exfiltrated from victim environments prior to encryption, with threats to publish files if a ransom is not paid. Technical analysis of Akira ransomware indicates variants capable of targeting Windows or VMWare ESXi hypervisors and multiple overlaps with Conti ransomware. BushidoToken Akira 2023 CISA Akira Ransomware APR 2024 Cisco Akira Ransomware OCT 2024

Activities and Tactics

Targeted Sectors: Healthcare, Education, Government, Technology

Country of Origin: 🏳️ Unknown

Risk Level: High

First Seen: 2023

Last Activity: 2025

Notable Campaigns

• Nissan Australia (December 2023; Akira (Ransomware))
• BHI Energy (October 2023; Akira (Ransomware))
• Community-reported ransomware incident: June 2025, Construction, Canada (source: CR-001-AKIRA-JUN-2025.md)
• Community-reported ransomware incident: April 2025, Food and Agriculture, Canada (source: CR-002-AKIRA-APR-2025.md)
• Community-reported ransomware incident: June 2025, Manufacturing, Canada (source: CR-003-AKIRA-JUN-2025.md)
• Community-reported ransomware incident: August 2025, Construction, USA (source: CR-009-AKIRA-AUG-2025.md)
• Community-reported ransomware incident: August 2025, Engineering, USA (source: CR-010-AKIRA-AUG-2025.md)
• Community-reported ransomware incident: September 2025, Professional Services, Canada (source: CR-017-AKIRA-SEP-2025.md)
• Community-reported ransomware incident: November 2025, Manufacturing, Canada (source: CR-018-AKIRA-NOV-2025.md)

Tactics, Techniques, and Procedures (TTPs)

• T1567.002 Exfiltration to Cloud Storage
• T1213.002 Sharepoint
• T1531 Account Access Removal
• T1482 Domain Trust Discovery
• T1036.005 Match Legitimate Resource Name or Location
• T1078 Valid Accounts
• T1558 Steal or Forge Kerberos Tickets
• T1018 Remote System Discovery
• T1021.001 Remote Desktop Protocol
• T1059.001 PowerShell
• T1657 Financial Theft
• T1486 Data Encrypted for Impact
• T1133 External Remote Services
• T1027.001 Binary Padding
• T1685 Disable or Modify Tools
• T1219 Remote Access Tools
• T1560.001 Archive via Utility

Ransomware Vulnerability Matrix observations

ATT&CK technique IDs (denormalized)

• T1018
• T1021.001
• T1027.001
• T1036.005
• T1059.001
• T1078
• T1133
• T1213.002
• T1219
• T1482
• T1486
• T1531
• T1558
• T1560.001
• T1567.002
• T1657
• T1685

Notable Indicators of Compromise (IOCs)

No separately curated network indicators or file hashes are listed for this actor. Known exploited vulnerabilities appear in the CISA Known Exploited Vulnerabilities (KEV) section below.

Malware and Tools

MITRE ATT&CK Software

• Mimikatz (S0002) — tool
• PsExec (S0029) — tool
• AdFind (S0552) — tool
• Akira _v2 (S1194) — malware
• Akira (S1129) — malware
• Megazord (S1191) — malware
• LaZagne (S0349) — tool
• Rclone (S1040) — tool

Ransomware Tool Matrix observations

Attribution and Evidence

Country of Origin: Unknown Additional attribution information pending cataloguing.

References

[1] mitre-attack [5] CISA Akira Ransomware APR 2024 CISA et al. (2024, April 18). #StopRansomware: Akira Ransomware. Retrieved December 10, 2024. [6] CrowdStrike PUNK SPIDER CrowdStrike. (n.d.). Punk Spider. Retrieved February 20, 2024. [7] Cisco Akira Ransomware OCT 2024 Nutland, J. and Szeliga, M. (2024, October 21). Akira ransomware continues to evolve. Retrieved December 10, 2024. [8] Secureworks GOLD SAHARA Secureworks. (n.d.). GOLD SAHARA. Retrieved February 20, 2024. [9] Arctic Wolf Akira 2023 Steven Campbell, Akshay Suthar, & Connor Belfiorre. (2023, July 26). Conti and Akira: Chained Together. Retrieved February 20, 2024. [10] BushidoToken Akira 2023 Will Thomas. (2023, September 15). Tracking Adversaries: Akira, another descendent of Conti. Retrieved February 21, 2024. [11] Palo Alto Howling Scorpius DEC 2024 Zemah, Y. (2024, December 2). Threat Assessment: Howling Scorpius (Akira Ransomware). Retrieved January 8, 2025.

[12] BushidoToken Breach Report Collection - Nissan Australia breach report (December 2023) via nissan.com.au Source index: https://github.com/BushidoUK/Breach-Report-Collection; adversary label: Akira (Ransomware). [13] BushidoToken Breach Report Collection - BHI Energy breach report (October 2023) via documentcloud.org Source index: https://github.com/BushidoUK/Breach-Report-Collection; adversary label: Akira (Ransomware).

CISA Known Exploited Vulnerabilities (KEV)

The following CVEs are known to be exploited by this actor, listed in the CISA KEV catalog.