Akira Ransomware: Detection, Prevention, and Recovery

Akira is a financially motivated ransomware operation that was first observed in March 2023. By November 2025, officials from the FBI Cyber Division identified Akira as one of the top five most active ransomware variants among over 130 ransomware types currently under investigation for targeting U.S. organizations.

This operation functions as a Ransomware-as-a-Service (RaaS) program. It is known for conducting rapid credential-based intrusions with multi-platform encryption. Akira employs a double extortion strategy, combining data theft with disruptive encryption to increase pressure on its victims.

Group profile and impact

Akira is tracked under multiple threat intelligence designations, including Storm-1567, Howling Scorpius, Punk Spider, and Gold Sahara. The group is unrelated to the Akira ransomware strain active in 2017, despite sharing the same name and encrypted file extension. Blockchain and code analysis suggest the operation may have connections to the defunct Conti ransomware group.

Akira maintains a Tor-based data leak site styled as a retro 1980s green-screen terminal with command-line navigation, where stolen data is published to pressure non-paying victims.

Sector and geographic distribution

Akira targets organizations across multiple industries and geographies, with a concentration in education, manufacturing, IT, healthcare, financial services, and food and agriculture. Government advisories identify victims across North America, Europe, and Australia, spanning businesses and critical infrastructure.

Financial impact

As of January 1, 2024, joint FBI/CISA reporting indicated Akira had impacted over 250 organizations and claimed approximately $42 million in ransomware proceeds. By late September 2025, claimed proceeds had grown to approximately $244 million. Individual ransom demands often fall in the hundreds of thousands to multi-million-dollar range, forcing difficult decisions about whether to pay the ransom.

Technical profile

Understanding Akira's technical profile is essential for accurate detection, scoping, and recovery planning.

Payload variants and platform coverage

Akira uses multiple ransomware payloads and platform-specific encryptors supported by common tooling for discovery, credential theft, remote execution, and exfiltration.

Akira operators have been observed using multiple Windows and Linux/ESXi payload lines, including the Megazord encryptor and the Akira_v2 Linux/ESXi variant, sometimes deploying them together within the same incident. Available reporting suggests Megazord has likely fallen out of use since 2024, with Akira_v2 now the primary encryptor for Linux and ESXi environments. Recent development trends include increased use of Rust in Linux/ESXi variants and expanded hypervisor coverage to include Nutanix AHV, in addition to VMware ESXi and Hyper-V.

Encrypted files commonly use the .akira or .powerranges extensions on Windows systems. Linux/ESXi variants have used extensions such as .akiranew or .aki. Ransom notes include fn.txt, akira_readme.txt, and powerranges.txt on Windows, and akiranew.txt in some Linux/ESXi cases. The powerranges.txt note is associated with the Megazord variant.

Encryption, recovery inhibition, and extortion

Akira uses hybrid encryption: a stream cipher (commonly ChaCha20; some Linux/ESXi variants implement ChaCha8 and KCipher2) combined with RSA for key protection.

Encryption behavior can vary by file type and size, enabling either full or partial encryption in large storage environments. On Windows, operators commonly delete Volume Shadow Copy Service (VSS) snapshots via PowerShell to limit local rollback options.

Ransom notes (typically akira_readme.txt or fn.txt) are dropped in every encrypted directory. Each note provides instructions and a unique victim login code for Tor-based negotiation.

Crucially, initial notes omit the ransom amount; the fee is disclosed only after contact, allowing demands to be tailored to the target's financials. Notes threaten to sell exfiltrated data to multiple buyers and publish it on the group's leak site if payment is refused.

Attack lifecycle

The following stages reflect patterns documented across multiple DFIR investigations and government advisories.

Initial access

A common initial access vector for Akira is VPN access without multi-factor authentication (MFA), often using compromised credentials. Campaign waves have exploited known vulnerabilities in perimeter technologies, including CVE-2020-3259 and CVE-2023-20269 in Cisco ASA/VPN services, CVE-2024-40766 in SonicWall SSL VPN ecosystems, and CVE-2024-40711 in Veeam Backup & Replication (deserialization of untrusted data). In some incidents, indicators suggest initial access through SSH by exploiting router IP addresses, or via spearphishing and valid credential abuse.

Persistence and foothold establishment

Immediately after gaining access, Akira operators establish persistence to retain access even if the initial entry point is discovered. DFIR investigations document the creation of new local and domain administrator accounts, often using naming conventions designed to blend with legitimate accounts.

Operators also deploy commercial remote access tools such as AnyDesk and LogMeIn, as well as alternatives like RustDesk, MobaXterm, and OpenSSH. In some incidents, attackers modify the Windows SpecialAccounts registry key to reduce account visibility while retaining privileged access, and use scheduled tasks or service creation (including nssm.exe) to maintain recurring access. Password spraying has also been observed, with reporting indicating use of SharpDomainSpray against domain credentials. Remediation must address persistence mechanisms, not only initial access.

Credential theft and privilege escalation

Post-compromise activity typically includes credential harvesting. Documented techniques include Local Security Authority Subsystem Service (LSASS) dumping via comsvcs.dll MiniDump, NTDS.dit, and SYSTEM hive extraction from domain controllers, and Kerberoasting. DCSync, which allows attackers to impersonate a domain controller and replicate credential data, has been observed in select incidents. Operators also target backup credentials, including attempts to extract Veeam credentials through CVE-2023-27532. This focus accelerates domain-level spread and increases the likelihood that containment begins only after multiple footholds are established.

Lateral movement and infrastructure targeting

Armed with harvested credentials, Akira operators move laterally using RDP, SMB administrative shares, WMI, and PsExec for remote execution and staging. Domain controllers, backup infrastructure, and virtualization management systems are priority targets for credential access and ransomware deployment, including via Group Policy Objects.

For VMware ESXi environments, operators typically gain access via SSH using credentials harvested earlier in the intrusion. In domain-joined deployments, CVE-2024-37085 can be abused by creating an Active Directory group named "ESX Admins," which grants elevated privileges on affected ESXi hosts. If direct host access is unavailable, operators may pivot through vCenter to enable SSH or reset host credentials, thereby encrypting large VM estates in a single operation.

Data staging and exfiltration

Akira operators use legitimate tools for exfiltration, including WinSCP, FileZilla, RClone, and tunneling utilities such as Ngrok and Cloudflare Tunnel. Documented intrusions show compressed timelines: in some cases, data exfiltration began just over two hours after initial access, reducing defender reaction time and increasing the likelihood that theft is completed before detection.

Encryption and extortion

Akira_v2 adds virtualization-focused controls such as "vmonly" and "stopvm" to target virtual machines and stop running VMs before encryption. For ESXi, operators deploy the Linux variant via SSH, encrypting VMDK files and hypervisor file systems to prevent access to hosted virtual machines.

On Windows, encryption typically propagates through SMB administrative shares, with scripts executing the encryptor across multiple network paths. The encryptor uses Windows Restart Manager APIs to terminate processes that hold file handles and to increase file access for encryption. An anti-analysis mechanism requires a specific Build ID to execute successfully. Akira operators have also been observed deploying POORTRY, a signed but vulnerable Windows driver loaded via the STONESTOP installer, to neutralize endpoint detection at the kernel level before encryption begins.

How to detect Akira ransomware

Early detection depends on knowing what to look for and where to look. Akira intrusions leave artifacts and behavioral patterns at each stage of the attack lifecycle.

Indicators and artifacts

Behavioral detections (TTP-based)

High-signal observables

Detection opportunities peak at transition moments: persistence establishment, credential dumping, lateral movement bursts, bulk data movement, and encryption. Lateral movement often produces patterns such as:

• RDP sessions from unexpected source systems
• SMB to administrative shares from non-admin workstations
• WMI execution across multiple hosts
• PsExec service creation (PSEXESVC.exe)

Concurrent service creation across multiple hosts strongly suggests coordinated staging. VPN authentication anomalies deserve attention: impossible travel, unusual geolocations, and new device associations for privileged accounts.

Instrumentation priorities

Centralize telemetry across VPN, endpoint, identity, and network sources. PowerShell logging (module, script block, transcription) is essential. Prioritize alerts for LSASS access/dumping, VSS deletion, tunneling and bulk outbound transfers, scheduled tasks (4698), log clearing (1102), and ESXi/vCenter management changes. Log retention must support incident scoping given compressed dwell times.

ProvenData Senior DFIR Engineer Amr Fathy on kernel-level EDR evasion observed in active incidents: "Attackers load a signed but vulnerable driver into kernel mode. Once there, they exploit it to terminate EDR processes and remove kernel callbacks. The driver loads, EDR goes blind, and encryption begins within seconds. Detection requires kernel-level telemetry that most standard EDR configurations don't capture by default."

How to prevent and mitigate an attack

The following priorities address the most common entry points and escalation paths seen in documented Akira incidents.

Harden remote access and perimeter services

A strong defensive posture relies on implementing phishing-resistant multi-factor authentication (MFA) for all remote access, promptly patching perimeter vulnerabilities, and validating remediation through regular vulnerability assessments. This involves ensuring that previously exposed devices have had their credentials and secrets updated (such as VPN credentials, service accounts, and MFA-related secrets) rather than just applying patches.

Additionally, monitor VPN authentication for anomalies, including impossible travel, unusual geolocations, and new device associations for privileged accounts.

Protect backup infrastructure

Backup compromise turns ransomware from a simple restore event into a complex ransomware recovery scenario with extended downtime. Treat backup systems as tier-0 assets with separate administrative accounts, strong segmentation, restricted inbound management access, immutable or offline copies, and monitoring for credential dumping and suspicious service execution.

Reduce credential theft impact

Reduce the blast radius by enforcing least privilege, implementing tiered administration, turning off legacy authentication paths, enforcing strong privileged credential policies, and hardening credential stores.

Instrument administrative tooling

Instead of trying to ban legitimate management tools, utilize them. Limit PowerShell access to authorized users, keep it updated, enable enhanced logging, and retain logs for a sufficient duration to facilitate incident scoping.

Harden virtualization infrastructure

ESXi, vCenter, and other hypervisor environments (including Nutanix AHV, which Akira was first observed targeting in June 2025) require dedicated controls. Prefer local ESXi accounts over domain-joined authentication; if domain integration is required, monitor for the creation of "ESX Admins" (or similar) groups as a potential indicator of CVE-2024-37085 abuse. Disable SSH unless actively required and use lockdown mode to restrict management access paths.

Isolate virtualization management interfaces on dedicated administrative networks with strict access control. Enforce signed-code execution (VMkernel.Boot.execInstalledOnly) to prevent unsigned VIB installation, forward ESXi logs to a centralized SIEM, and alert on root logins, SSH enablement, and host credential changes.

Incident response and recovery

Akira intrusions typically require a coordinated response across identity, endpoint, and network layers.

Response principles for Akira intrusions

Treat Akira incidents as enterprise compromises, not isolated malware events. The workflow commonly includes credential theft, domain-level persistence, and data staging, which may continue even if encryption is contained.

Assume credential compromise and domain-wide exposure until proven otherwise. Prioritize credential containment: disable or rotate privileged credentials, invalidate VPN sessions, rotate service account secrets, and review identity provider logs for new devices or tokens. Contain the incident at both the perimeter and endpoints: temporarily restrict or deactivate remote access, apply emergency ACL allowlists, and force password resets for remote users as needed. For a structured approach to initial actions, ProvenData's ransomware incident response steps guide covers prioritization and sequencing in detail.

Preserve evidence immediately, following established ransomware evidence-preservation protocols to avoid losing key indicators during rapid intrusions.

Recovery pathways and constraints

Backups remain the primary recovery mechanism, but only if they are properly isolated and uncompromised. Local snapshot recovery is often impaired by VSS deletion, which increases downtime and puts pressure on ransom negotiations. Preserve encrypted samples and ransom notes to assess decryption options for the specific variant encountered.

Public decryptors are limited. The Avast decryptors for 64-bit and 32-bit systems (June 2023) apply only to early variants and were patched quickly. In contrast, a GPU-assisted key-recovery method (March 2025) applies to certain Linux/ESXi variants and requires substantial compute resources. There is currently no publicly available decryptor for newer variants (including Akira_v2). To help determine which recovery pathway is viable, ProvenData's Ransomware ID Tool can assist in confirming the specific Akira variant from an encrypted file sample.

ESXi environments present a distinct recovery profile. ProvenData Head of DFIR Magdy Abdelaziz describes the dynamic from active incident investigations: "When Akira's Linux encryptor hits VMware ESXi, recovery inverts compared to a Windows-only environment: instead of restoring server-by-server, you rebuild the platform before any workload, because each encrypted datastore is a container holding dozens of servers and the failure is total per datastore rather than granular per machine. The sequencing runs identity first if Active Directory was touched, then storage assessment, which finding decides everything, then hypervisor rebuild from clean media. The storage assessment in the first hours tells you whether you're running a restore exercise or a salvage-and-negotiation exercise."

Given the rapid progression of attacks, establish pre-approved containment playbooks, run ransomware tabletop exercises, and rehearse credential rotation and VPN session invalidation procedures.

Key takeaways for defenders

Akira incidents often follow a predictable failure pattern: credential-based access through inadequately protected perimeter services, followed by rapid domain compromise that outpaces detection and response. The practical takeaway is that outcomes depend less on payload sophistication and more on operational fundamentals. Organizations that recover without paying typically have isolated backups that survive the attack, rehearsed response procedures, and sufficient logging to scope and contain the intrusion quickly. Teams that treat phishing-resistant MFA, backup isolation, and credential hygiene as checkbox compliance rather than operational priorities are far more likely to end up with limited recovery options. When an active intrusion is detected, engaging professional incident response early can significantly improve containment outcomes and reduce overall recovery time.