# Akira Ransomware

Ransomware-as-a-Service (RaaS) · Double extortion · First seen March 2023 · Windows, Linux, VMware ESXi, Hyper-V, Nutanix AHV · Last updated June 2, 2026

## Overview

Akira is a ransomware-as-a-service operation that emerged in March 2023 and rapidly became one of the most financially consequential ransomware groups operating globally. A joint advisory from the FBI, CISA, DC3, HHS, Europol, and national agencies in France, Germany, and the Netherlands designates Akira as an imminent threat to critical infrastructure. The FBI classifies it among its top five most investigated ransomware variants out of 130 actively tracked.

The group is tracked under multiple aliases: Storm-1567, Howling Scorpius, Punk Spider, and Gold Sahara. Its operational lineage likely connects to the defunct Conti syndicate. As of late September 2025, Akira had claimed approximately $244.17 million in ransomware proceeds since its emergence, a more than fivefold increase over its April 2024 total.

Akira operates a double-extortion model: it exfiltrates sensitive data before encrypting, then demands payment under threat of publishing the stolen data on its Tor-hosted leak site. Ransom demands typically fall in the hundreds of thousands to multi-million-dollar range, and the group has been observed calling victim organizations directly to apply additional pressure. The group has also been observed exfiltrating data in just over two hours from initial access.

What makes Akira technically distinctive is its multi-platform encryptor portfolio and its systematic approach to dismantling defenses before encryption. It maintains separate payloads for Windows, Linux/VMware ESXi, Hyper-V, and, as of June 2025, Nutanix AHV virtual machines. It uses Bring Your Own Vulnerable Driver (BYOVD) techniques to disable endpoint security at the kernel level before deploying the encryptor. It targets backup infrastructure specifically, exploiting Veeam vulnerabilities to corrupt recovery options and remove the victim's ability to restore without paying.

### Threat profile

Updated June 2, 2026

| Field | Value |
|---|---|
| Type | Ransomware (RaaS) |
| First seen | Mar 2023 |
| Tracked as | Storm-1567 |
| Status | Actively operating |
| Aliases | Howling Scorpius, Punk Spider, Gold Sahara, Storm-1567 |
| Extortion | Double extortion (encrypt + leak threat) |
| Platforms | Windows · Linux · VMware ESXi · Hyper-V · Nutanix AHV |
| Initial access | VPN credential abuse · CVE exploitation · phishing · IAB purchase |
| Key CVEs | CVE-2024-40766 · CVE-2024-40711 · CVE-2023-20269 · CVE-2023-27532 |
| Encryptors | Akira (C++) · Akira_v2 (Rust) · Megazord (Rust, deprecated) |
| File extensions | .akira · .akiranew · .aki · .powerranges |
| Conti ties | Assessed likely; code overlap, personnel overlap |

## Operational attack chain · Akira intrusion lifecycle

1. **Unpatched VPN or credential abuse**  
   CVE-2024-40766, CVE-2023-20269, stolen credentials without MFA

2. **Credential harvesting**  
   LSASS dump, NTDS.dit extraction, Veeam credentials

3. **EDR dismantlement via BYOVD**  
   STONESTOP loads POORTRY kernel driver, endpoints go silent

4. **Data exfiltration and encryption**  
   RClone to MEGA, `vssadmin delete shadows`, ChaCha20 + RSA

5. **Double extortion demand**  
   Ransom note, Tor leak site, direct victim contact

Full attack cycle can compress to under four hours from initial access to encryption onset. [Detection](https://www.manageengine.com/malware-protection/malware-detection.html) must focus on the credential theft (Stage 1) and EDR dismantlement (Stage 2) window before defenses are actively removed.

Mapped to the CISA/FBI joint advisory AA24-109A (updated November 2025)

## Tactics, techniques, and procedures

Akira's attack chain spans nine MITRE ATT&CK tactics, with the highest technique density in Privilege Escalation, Defense Evasion, and Credential Access. The coverage below reflects the November 2025 CISA/FBI joint advisory plus documented campaign behaviors through mid-2025.

### MITRE ATT&CK coverage

| Tactic | Count |
|---|---|
| Recon | 0 |
| Resource Dev | 2 |
| Initial Access | 5 |
| Execution | 3 |
| Persistence | 3 |
| Priv. Esc | 4 |
| Defense Evasion | 5 |
| Credential Access | 5 |
| Discovery | 4 |
| Lateral | 3 |
| Collection | 2 |
| C2 | 3 |
| Exfiltration | 3 |
| Impact | 3 |

### Representative credential dumping patterns

#### LSASS dump via comsvcs.dll (representative pattern)

```bash
rundll32.exe C:\Windows\System32\comsvcs.dll MiniDump [LSASS_PID] C:\ProgramData\lsass.dmp full
```

Pattern documented in CISA/FBI joint advisory AA24-109A

#### NTDS.dit offline capture via ntdsutil IFM

```bash
ntdsutil "ac i ntds" "ifm" "create full c:\Programdata\temp\Crashpad\Temp\abc" q q
```

Technique documented in MITRE ATT&CK T1003.003; Akira ntdsutil use noted in CISA advisory AA24-109A

## Indicators of compromise

Durable behavioral indicators are separated from volatile artifacts. Durable indicators survive variant rotation and remain relevant across campaigns. Volatile indicators (hashes, IPs, domains) expire quickly and should be treated as time-limited signals.

### Ransom artifacts

- `akira_readme.txt` — Windows ransom note; dropped in C:\ and each user home directory  
- `fn.txt` — Alternate Windows ransom note filename  
- `akiranew.txt` — ESXi / Akira_v2 ransom note; dropped per-directory  
- `.akira / .akiranew / .aki / .powerranges` — Encrypted file extensions (.powerranges deprecated; Megazord only)

### Registry and domain artifacts

- `HKLM\...\TaskCache\Tasks (new tasks)` — Scheduled task persistence (affiliate-configured)  
- `New domain account: itadm` — Documented CISA-reported account name; others may vary  
- `HKLM\...\Services\[driver name] (new service)` — STONESTOP registers POORTRY driver as a service  
- `HKLM\SOFTWARE\Policies\...\DisableAntiSpyware=1` — `hlpdrv.sys` write via regedit; disables Windows Defender  

### Process and command-line patterns

- `rundll32.exe comsvcs.dll MiniDump [PID]` — LSASS dump via comsvcs.dll  
- `ntdsutil.exe "ac i ntds" "ifm" "create full …"` — NTDS.dit offline image capture  
- `vssadmin delete shadows /all /quiet` — Shadow copy deletion; also via `wmic shadowcopy delete`  
- `rclone.exe sync … remote:* (non-user context)` — RClone exfiltration to MEGA cloud storage  
- `nltest /dclist: / nltest /DOMAIN_TRUSTS` — Domain controller and trust enumeration  
- `new kernel driver loaded as service [signed, unexpected]` — BYOVD indicator; POORTRY loaded by STONESTOP  

### Network behavior

- Ngrok tunnels: long-lived low-bandwidth sessions — C2 encrypted sessions bypassing perimeter monitoring  
- `mega.nz / Rclone uploads` — Primary data exfiltration destination  
- Cloudflare Tunnel (CLOUDFLARED) outbound — Secondary C2 channel; legitimate-looking traffic  
- Tor `.onion` connectivity from endpoints — Ransom negotiation and leak site communication  
- FTP/SFTP outbound: WinSCP / FileZilla — FTP-based data staging and exfiltration  

### Volatile — file hashes (time-limited)

Hashes from CISA advisory AA24-109A (IOCs observed June 2023 through August 2025). Vet before blocking; these rotate with new builds.

- `d2fd0654710c27dcf37b6c1437880020824e161dd0bf28e3a133ed777242a0ca` — w.exe: Akira Windows encryptor (CISA AA24-109A)  
- `3298d203c2acb68c474e5fdad8379181890b4403d6491c523c13730129be3f75` — Akira_v2 ESXi encryptor (CISA AA24-109A)  

## Detection guidance

Akira's most detectable window is between initial persistence and the BYOVD phase. Once STONESTOP loads POORTRY, endpoint telemetry is actively suppressed. Detection strategies must cover the pre-encryption stages, not only the encryptor itself, because by the time encryption begins, defensive options are severely limited.

1. **New domain admin account creation**  
   Alert on new domain accounts being created and immediately added to domain or local administrator groups, particularly outside of provisioning workflows.

2. **LSASS memory access via comsvcs.dll MiniDump**  
   Monitor for `rundll32.exe` with `comsvcs.dll` and `MiniDump` in the command line, especially targeting LSASS.

3. **NTDS.dit access and extraction**  
   Alert on `ntdsutil.exe` executed with IFM arguments and unusual access to `C:\Windows\NTDS\ntds.dit`.

4. **Unsigned or unexpected kernel driver loads (BYOVD)**  
   Monitor for new kernel driver load events (Event ID 7045) and drivers outside approved baselines.

5. **Shadow copy deletion**  
   Alert on `vssadmin delete shadows` or `wmic shadowcopy delete` outside backup workflows.

6. **Veeam credential dumping**  
   Monitor PowerShell access to the Veeam configuration database and credential export scripts.

7. **RClone, WinSCP, or FileZilla bulk outbound transfers**  
   Alert on large outbound transfers to `mega.nz` or cloud storage from non-user processes.

8. **Ngrok and Cloudflare tunnel connections**  
   Block or alert on outbound connections to Ngrok and unexpected Cloudflare Tunnel sessions from servers.

## Response recommendations

1. **Isolate affected endpoints immediately**  
2. **Preserve forensic artifacts before remediation**  
3. **Identify and disable all attacker-controlled accounts**  
4. **Rotate all domain credentials**  
5. **Validate backup integrity before attempting restore**  
6. **Scope the exfiltrated data**  
7. **Hunt for persistence across the environment**  
8. **Restore and verify endpoint security tools**  
9. **Patch the exploited entry point before reconnecting**

## Hardening recommendations

1. **Enforce phishing-resistant MFA on all VPN and remote access services**  
2. **Patch known exploited VPN, firewall, and backup CVEs**  
   Check CISA's KEV catalog: https://www.cisa.gov/known-exploited-vulnerabilities-catalog  
3. **Enable LSASS protection and Credential Guard**  
4. **Enable Microsoft Vulnerable Driver Blocklist (HVCI)**  
5. **Isolate backup infrastructure from the production domain**  
6. **Restrict and monitor RDP access**  
7. **Block or alert on unapproved remote access tools**

## Primary references

- [CISA/FBI Joint Advisory AA24-109A — #StopRansomware: Akira Ransomware (updated November 2025)](https://www.cisa.gov/news-events/cybersecurity-advisories/aa24-109a) — Nov 2025  
- [CISA Advisory Alert — Akira presents imminent threat to critical infrastructure](https://www.cisa.gov/news-events) — Nov 2025  
- [MITRE ATT&CK — Enterprise framework reference](https://attack.mitre.org/) — Current