AKIRA

Akira is a Ransomware-as-a-Service (RaaS) operation first observed in March 2023, notable both for its distinctive 1980s "green-screen" leak-site aesthetic and for becoming — in under three years — one of the most prolific ransomware operations currently tracked, with joint US/EU law enforcement reporting approximately $244.17 million in claimed ransom proceeds and a cumulative leak-site victim count that had reached 1,584 organizations by late August 2026 (CISA/FBI/Europol Joint Advisory AA24-109A, updated Nov 13, 2025; leak-site tracking via TRM Labs and Comparitech). It matters right now because Akira has filled market share left vacant by law-enforcement disruptions of peer operations (LockBit, BlackCat/ALPHV, Hive) without suffering a comparable takedown itself, and because its operational tempo has been accelerating rather than plateauing — a July–August 2025 surge tied to a critical SonicWall SonicOS vulnerability (CVE-2024-40766, CVSS 9.3) saw encryption completed in as little as 55 minutes from initial access in some incidents (Arctic Wolf Labs, Aug 2025).

Technically, Akira sits at the intersection of two notable trends in contemporary ransomware operations: near-total reliance on living-off-the-land tooling (commercial remote-access software, open-source credential dumpers, and legitimate cloud-sync utilities rather than bespoke C2 infrastructure) and aggressive, opportunistic exploitation of internet-facing edge devices — VPN concentrators and backup appliances specifically — that lack phishing-resistant multifactor authentication. The joint advisory names eight distinct CVEs across Cisco ASA/FTD, SonicWall SonicOS, and Veeam Backup & Replication that Akira affiliates have weaponized for initial access, several of them years-old and already patched, underscoring that unpatched edge infrastructure — not novel zero-day tradecraft — remains the group's primary way in.

Akira is widely assessed, with a meaningful evidentiary basis rather than mere reputation, to include personnel from the dissolved Conti syndicate: beyond well-documented code and behavioral overlap (itself weak evidence on its own, since Conti's source code leaked publicly in March 2022), Arctic Wolf Labs traced three separate Bitcoin transactions totaling over $600,000 from Akira-controlled ransom wallets directly to addresses previously associated with Conti leadership. This places Akira within a broader "Conti diaspora" ecosystem that also appears to include the Fog and Frag ransomware operations, which share infrastructure and on-chain financial patterns with Akira and with each other.

Where this profile's compiling organization's operational context is concerned, Akira's sector targeting is broad but shows a documented preference for educational institutions alongside critical manufacturing, healthcare, IT, financial services, and food and agriculture — the group is opportunistic and CVE-driven rather than a strategic, hand-picked-target operation, meaning any organization running unpatched or MFA-less edge infrastructure in these sectors sits within its realistic targeting envelope regardless of size, though CISA notes a continuing preference for small- and medium-sized businesses even as larger organizations and critical infrastructure entities are increasingly affected.

Entry vectors center overwhelmingly on internet-facing VPN and backup appliances lacking phishing-resistant MFA. CISA's advisory names eight specific CVEs Akira affiliates have weaponized — CVE-2020-3259 and CVE-2023-20269 (Cisco ASA/FTD), CVE-2020-3580, CVE-2023-28252, and CVE-2024-37085 (added in the Nov 2025 update), CVE-2023-27532 and CVE-2024-40711 (Veeam Backup & Replication), and CVE-2024-40766 (SonicWall SonicOS, CVSS 9.3, the current primary vector) — alongside straightforward credential theft, password spraying via the tool SharpDomainSpray, spearphishing, and abuse of exposed SSH on routers as a tunneling foothold into internal networks (CISA AA24-109A).

Toolchain is overwhelmingly living-off-the-land: AdFind, SoftPerfect NetScan, Advanced IP Scanner, and PCHunter64 for reconnaissance; nltest /dclist and nltest /DOMAIN_TRUSTS for domain-trust mapping; Mimikatz and LaZagne for credential dumping, with Kerberoasting used to extract credentials from LSASS process memory; and Impacket's wmiexec.py for remote command execution via WMI rather than disk-resident payloads. Defense evasion layers two distinct driver-abuse techniques: PowerTool exploiting the legitimate, signed Zemana AntiMalware driver to terminate AV processes, and the POORTRY/STONESTOP pairing — POORTRY is malware written as a signed vulnerable Windows driver, loaded via the STONESTOP installer, giving Akira operators kernel-level (Ring 0) EDR/AV termination through a genuine Bring-Your-Own-Vulnerable-Driver (BYOVD) technique.

C2 methodology relies almost entirely on legitimate third-party infrastructure rather than actor-registered domains or IPs: Ngrok and Cloudflare Tunnel (cloudflared) establish encrypted, outbound-only tunnels that bypass perimeter monitoring without requiring inbound firewall exceptions, while AnyDesk, LogMeIn, RustDesk, and MobaXterm provide remote-access channels deliberately chosen to blend with legitimate administrator activity rather than trigger malware-signature detection.

Lateral movement and persistence combine RDP, SSH, and WMIC with creation of a new domain administrative account — CISA's investigations repeatedly identified an account named itadm — and, in at least one documented intrusion, a distinctive privilege-escalation technique: temporarily powering down a domain controller's virtual machine, copying its VMDK disk file offline, attaching it to a newly created VM, and extracting the NTDS.dit database and SYSTEM registry hive from the dismounted disk to bypass live-host credential protections entirely.

Exfiltration and impact follow a double-extortion model: FileZilla and WinRAR (with 7-zip added per the Nov 2025 update) collect and compress data, which WinSCP and RClone then exfiltrate via FTP/SFTP or sync directly to MEGA cloud storage — in some 2025 incidents completed in just over two hours from initial access. Encryption itself uses a hybrid ChaCha20 stream cipher with RSA public-key exchange, customizable to full or partial encryption by file type and size, with the Windows-focused Megazord and the newer Rust-based, Linux/ESXi/Nutanix-AHV-capable Akira_v2 at times deployed simultaneously against different system architectures within a single intrusion. The encryptor (w.exe/Win.exe) deletes Volume Shadow Copy Service backups via PowerShell before completing encryption, and drops a ransom note (fn.txt or akira_readme.txt) in the C: root and every user directory — notably, the note contains no ransom figure; the amount is disclosed only after the victim initiates contact through a dedicated Tor negotiation portal.

Akira warrants a CRITICAL threat-level rating on the strength of scale and tempo alone: $244.17 million in claimed proceeds, 1,584 cumulative leak-site victims as of August 2026, and a documented ability to move from initial VPN compromise to completed encryption in under an hour in at least one campaign. What elevates this beyond a typical high-volume RaaS profile is the group's demonstrated adaptability — expanding from Windows-only encryption in March 2023 to ESXi (April 2023), to a Rust-rewritten Akira_v2 encryptor with anti-analysis build-gating, to Nutanix AHV hypervisors (June 2025) — each expansion arriving roughly in step with, rather than lagging, broader industry adoption of the underlying virtualization platforms being targeted.

The central competing hypothesis worth stating plainly is whether "Akira is a Conti successor" describes organizational continuity (the same people, reconstituted) or merely personnel/tooling continuity within a much looser criminal labor market (former Conti-affiliated individuals now working across Akira, Fog, and Frag interchangeably as RaaS affiliates, without any of the three being a formal successor organization to Conti as an entity). The blockchain evidence — wallet-to-wallet Bitcoin transfers to known Conti leadership addresses — is genuinely strong for personnel/financial continuity but does not, on its own, resolve which hypothesis is correct; both are consistent with the available public evidence, and this profile does not assert one over the other beyond what TRM Labs' and Arctic Wolf's underlying data supports.

Forward risk trajectory is upward: Akira has absorbed market share vacated by LockBit, BlackCat/ALPHV, and Hive's respective law-enforcement disruptions without experiencing a comparable takedown itself, and its edge-device exploitation model (patch-lag-driven, not zero-day-dependent) is durable against any single vendor's remediation efforts. What would change this assessment: a law-enforcement seizure or public indictment — comparable to the OFAC actions that formally anchored several Conti/TrickBot members to named individuals in 2023 — would sharply increase attribution confidence and could meaningfully disrupt operational tempo, as it has for peer RaaS brands; absent that, independent researcher-driven decryption breakthroughs (a GPU brute-force method for the Linux/ESXi variant was published in 2024, and Avast has released a free Windows decryptor) represent the only public counter-pressure currently observed, and neither appears to have measurably slowed the group's leak-site posting rate through mid-2026.