Home

Akira Ransomware

Ransomware-as-a-Service (RaaS) · Double extortion · First seen March 2023 · Windows, Linux, VMware ESXi, Hyper-V, Nutanix AHV · Last updated June 2, 2026

Overview

Akira is a ransomware-as-a-service operation that emerged in March 2023 and rapidly became one of the most financially consequential ransomware groups operating globally. A joint advisory from the FBI, CISA, DC3, HHS, Europol, and national agencies in France, Germany, and the Netherlands designates Akira as an imminent threat to critical infrastructure. The FBI classifies it among its top five most investigated ransomware variants out of 130 actively tracked.

The group is tracked under multiple aliases: Storm-1567, Howling Scorpius, Punk Spider, and Gold Sahara. Its operational lineage likely connects to the defunct Conti syndicate. As of late September 2025, Akira had claimed approximately $244.17 million in ransomware proceeds since its emergence, a more than fivefold increase over its April 2024 total.

Akira operates a double-extortion model: it exfiltrates sensitive data before encrypting, then demands payment under threat of publishing the stolen data on its Tor-hosted leak site. Ransom demands typically fall in the hundreds of thousands to multi-million-dollar range, and the group has been observed calling victim organizations directly to apply additional pressure. The group has also been observed exfiltrating data in just over two hours from initial access.

What makes Akira technically distinctive is its multi-platform encryptor portfolio and its systematic approach to dismantling defenses before encryption. It maintains separate payloads for Windows, Linux/VMware ESXi, Hyper-V, and, as of June 2025, Nutanix AHV virtual machines. It uses Bring Your Own Vulnerable Driver (BYOVD) techniques to disable endpoint security at the kernel level before deploying the encryptor. It targets backup infrastructure specifically, exploiting Veeam vulnerabilities to corrupt recovery options and remove the victim's ability to restore without paying.

Operational attack chain · Akira intrusion lifecycle
  1. Start

    Unpatched VPN or credential abuse

    CVE-2024-40766, CVE-2023-20269, stolen credentials without MFA

  2. Stage 1

    Credential harvesting

    LSASS dump, NTDS.dit extraction, Veeam credentials

  3. Stage 2

    EDR dismantlement via BYOVD

    STONESTOP loads POORTRY kernel driver, endpoints go silent

    STONESTOPPOORTRYBYOVD
  4. Stage 3

    Data exfiltration and encryption

    RClone to MEGA, vssadmin delete shadows, ChaCha20 + RSA

  5. Impact

    Double extortion demand

    Ransom note, Tor leak site, direct victim contact

Full attack cycle can compress to under four hours from initial access to encryption onset. Detection must focus on the credential theft (Stage 1) and EDR dismantlement (Stage 2) window before defenses are actively removed.

Mapped to the CISA/FBI joint advisory AA24-109A (updated November 2025)

How Malware Protection Plus responds

A walkthrough showing detection of the LOLBin execution chain, automated containment of the affected endpoint, and forensic capture of the command artifacts.

Tactics, techniques, and procedures

Akira's attack chain spans nine MITRE ATT&CK tactics, with the highest technique density in Privilege Escalation, Defense Evasion, and Credential Access. The coverage below reflects the November 2025 CISA/FBI joint advisory plus documented campaign behaviors through mid-2025.

MITRE ATT&CK coverageHeavyActiveNot observed
Recon0Resource Dev2Initial Access5Execution3Persistence3Priv. Esc4Defense Evasion5Credential Access5Discovery4Lateral3Collection2C23Exfiltration3Impact3
Technique detailKey techniques · Akira Ransomware · with defender telemetry
TacticTechniquesWhat Akira doesDefender telemetry
Initial Access
Exploit Public-Facing App T1190Valid Accounts T1078External Remote Services T1133Spearphishing Attachment T1566.001Brute Force T1110
Primary entry is through unpatched internet-facing VPN appliances (SonicWall CVE-2024-40766, Cisco CVE-2023-20269, CVE-2020-3259) and through stolen or brute-forced VPN credentials where MFA is absent. Initial access brokers supply compromised credentials in some cases. RDP is also observed as a direct entry path.VPN appliance auth logs, failed/successful logon ratios, new geo or ASN for VPN sessions, edge device version inventory against the CISA KEV catalog, RDP logon type 10 events.
Execution
PowerShell T1059.001VBScript T1059.005Service Execution T1569.002
PowerShell deletes shadow copies, disables services, and executes malicious scripts. VBScript is used for autonomous task execution. PsExec (PSEXESVC.exe) handles remote execution and payload deployment across the network.Process creation events (4688) with command line, PowerShell script block logging (4104), PSEXESVC service install events (7045), parent-child process pairs.
Persistence
Domain Account Creation T1136.002Local Account Creation T1136.001Remote Access Tools T1219
New domain accounts are created with names like itadm and added to the administrator group. Legitimate remote access tools (AnyDesk, LogMeIn, MobaXterm) are installed to maintain access and blend with administrator activity, making detection harder.Account creation (4720) and group membership change (4728/4732) events, new service installs, software inventory deltas for remote access tools outside the approved baseline.
Privilege Escalation
Exploit for Priv Esc T1068SAM / SYSTEM hive T1003.002NTDS.dit T1003.003Domain Policy Modification T1484
Veeam CVE-2024-40711 is exploited directly for privilege escalation. A notable technique documented by CISA: actors power down a domain controller VM, copy its VMDK file to a newly created VM, then extract NTDS.dit and the SYSTEM hive offline to recover domain admin password hashes. POORTRY/STONESTOP is used for kernel-level privilege to terminate protected security processes.Hypervisor logs for unexpected DC VM power-off and VMDK copy, file access to ntds.dit outside the AD DS service, ntdsutil process events, kernel driver load events (7045).
Defense Evasion
Impair Defenses T1562.001BYOVD T1068Obfuscated Files T1027Archive Obfuscation T1027.015Masquerading T1036
STONESTOP (user-mode loader) deploys the POORTRY kernel-mode driver, signed by Microsoft, to terminate or wipe EDR processes and their critical files at the kernel level. PowerTool exploits the Zemana AntiMalware driver to terminate AV processes. HeartCrypt (packer-as-a-service) obfuscates payloads. 7-zip is used to compress data with obfuscation. Legitimate remote access tools (AnyDesk, LogMeIn) masquerade as normal administrative activity.Driver load / service install events (7045), EDR agent health and unexpected process termination, writes to rwdrv.sys / hlpdrv.sys, registry edits to DisableAntiSpyware, gaps in expected telemetry.
Credential Access
LSASS Memory T1003.001Kerberoasting T1558.003Credentials from Password Stores T1555Password Spraying T1110.003Pass the Hash T1550.002
LSASS is dumped via comsvcs.dll MiniDump to recover plaintext credentials and Kerberos material without dropping Mimikatz (though Mimikatz and LaZagne are also used). Kerberoasting targets service account tickets over VPN sessions. NTDS.dit and SYSTEM hive extraction enables offline hash cracking of the full Active Directory. Veeam credential dumper scripts (open-source Veeam-Get-Creds) extract backup service credentials in plaintext from the Veeam database.LSASS process access events (10) with PROCESS_VM_READ, rundll32 comsvcs.dll MiniDump command lines, Kerberos TGS requests with RC4 (4769), PowerShell access to the Veeam database.
Discovery
Network Config Discovery T1016Network Service Scan T1046Remote System Discovery T1018AD Account Discovery T1087.002
SoftPerfect, Advanced IP Scanner, and NetScan map the network. AdFind queries Active Directory for accounts, groups, and structure. nltest /dclist: and nltest /DOMAIN_TRUSTS enumerate domain controllers and trust relationships. fsutil fsinfo drives enumerates drive layout to prepare encryption target lists.Process events for nltest, fsutil, AdFind, and scanner binaries, sudden spikes in internal port-scan and SMB enumeration traffic, LDAP query volume from a single host.
Lateral Movement
RDP T1021.001SSH T1021.004Remote Access Tools T1219
Lateral movement uses RDP with harvested credentials, SSH, SMB administrative shares, WMI remote execution (Impacket wmiexec.py), and PsExec for payload staging. AnyDesk, LogMeIn, RustDesk, and MobaXterm provide persistent footholds across the network.Logon type 3 and 10 events (4624), SMB admin share access (5140), WMI remote process creation, PSEXESVC installs, internal RDP/SSH connection patterns between non-administrative hosts.
Collection
Archive via Utility T1560.001Local System Data T1005
Data is staged locally using WinRAR (split into .rar segments) and 7-zip before exfiltration. FileZilla is used for FTP-based staging. The group prioritizes sensitive business files, credential stores, backup configuration data, and Active Directory exports.Process events for WinRAR / 7z with archive arguments, creation of large multi-part archives in staging directories, bulk file-read activity from a single process across many shares.
Command and Control
Protocol Tunneling T1572Proxy T1090Multi-hop Proxy T1090.003
Ngrok creates encrypted tunnels that bypass perimeter monitoring. SystemBC (Go-based RAT) functions as both a remote access trojan and SOCKS5 proxy for C2 sessions. Cloudflare Tunnel (CLOUDFLARED) is also observed. STONETOP deploys Akira payloads. Ransom negotiation occurs exclusively over a Tor .onion address.Outbound connections to Ngrok and Cloudflare Tunnel infrastructure, long-lived low-bandwidth sessions from servers, SOCKS proxy traffic, Tor connectivity from endpoints, DNS for tunneling service domains.
Exfiltration
Exfil Over Alt Protocol T1048Transfer to Cloud Account T1537Exfil to Cloud Storage T1567.002
RClone exfiltrates directly to cloud storage (MEGA) with attacker-controlled accounts. WinSCP handles SFTP-based exfiltration. FileZilla handles FTP. In documented incidents, data was exfiltrated in just over two hours from initial access. Akira does not leave a ransom amount in the note; victims must contact the group via Tor to receive the demand.Process events for rclone with sync/copy, outbound transfers to mega.nz, FTP/SFTP from non-user processes, large outbound volume in a short window, NetFlow byte-count anomalies.
Impact
Data Encrypted for Impact T1486Inhibit System Recovery T1490Financial Theft / Extortion T1657
ChaCha20 stream cipher combined with RSA public-key encryption. Partial encryption used for large files (top/bottom 10-50% of files above 4MB) to maximize speed while inhibiting recovery. VSS copies deleted via vssadmin delete shadows /all /quiet and wmic shadowcopy delete. Double extortion: encrypted files plus threatened public data leak on the Tor-based leak site.High-volume file rename/write to .akira / .akiranew / .aki, vssadmin and wmic shadowcopy delete command lines, ransom note (akira_readme.txt) file creation, ESXi syslog config changes.
Reconnaissance / Resource Development—Not itemized with individual technique detail in the source advisory; Reconnaissance is not observed as a distinct stage, and Resource Development activity is limited to acquiring encryptor builds and infrastructure ahead of intrusions.
How the attack startsT1190 · T1078 · T1133 · T1110.003

Exploiting the perimeter: VPN appliances and credential abuse

Akira consistently enters through the same category of target: internet-facing VPN appliances and remote access services with known vulnerabilities or weak credential hygiene. The group has exploited vulnerabilities in Cisco ASA (CVE-2020-3259, CVE-2023-20269), SonicWall SSL VPN (CVE-2024-40766), VMware ESXi (CVE-2024-37085), and Veeam Backup and Replication (CVE-2023-27532, CVE-2024-40711).

Where exploitation is not needed, Akira uses stolen credentials directly. These are obtained through phishing campaigns, brute-force and password spraying with tools like SharpDomainSpray, or purchased from initial access brokers. The consistent thread is the absence of MFA on VPN endpoints: a large portion of Akira's confirmed intrusions trace to VPN accounts without a second factor.

In documented incidents, Akira has also pivoted through SSH by exploiting a router's IP address to tunnel into the internal network before exploiting additional vulnerabilities on backup servers behind the perimeter.

What runs on the endpointT1003.001 · T1003.003 · T1558.003 · T1555

Credential harvesting: LSASS, NTDS.dit, and Veeam

After establishing initial access, Akira operators move quickly to harvest credentials that enable domain-level control. Three techniques are consistently documented.

LSASS memory dumping. LSASS is dumped using the comsvcs.dll MiniDump function rather than dropping well-known tools like Mimikatz directly. This API-level approach is quieter. Mimikatz and LaZagne are also used in cases where the operator chooses speed over stealth.

LSASS dump via comsvcs.dll (representative pattern)
rundll32.exe C:\Windows\System32\comsvcs.dll MiniDump [LSASS_PID] C:\ProgramData\lsass.dmp full

Pattern documented in CISA/FBI joint advisory AA24-109A

NTDS.dit extraction. In high-priority incidents, operators power down a domain controller VM, copy its VMDK file, attach it to a new VM, then extract NTDS.dit and the SYSTEM hive. This gives them the full Active Directory credential database for offline cracking. The ntdsutil tool is also used directly for offline image capture.

NTDS.dit offline capture via ntdsutil IFM
ntdsutil "ac i ntds" "ifm" "create full c:\Programdata\temp\Crashpad\Temp\abc" q q

Technique documented in MITRE ATT&CK T1003.003; Akira ntdsutil use noted in CISA advisory AA24-109A

Veeam credential dumping. Akira operators frequently target Veeam Backup credentials using the open-source Veeam-Get-Creds PowerShell script via an interactive PowerShell ISE session. This extracts backup service credentials in plaintext from the Veeam database. In at least one documented case, CVE-2023-27532 was exploited directly to access the Veeam configuration database. Compromising backup credentials simultaneously gives the operator access to backup infrastructure and eliminates it as a recovery path.

How the malware evades detectionT1562.001 · T1068 · T1027

Dismantling defenses: BYOVD at the kernel level

Before deploying the encryptor, Akira systematically removes endpoint security software. This is not attempted through software uninstallation alone. The group uses BYOVD techniques to operate at kernel level, where EDR tools cannot protect themselves.

STONESTOP and POORTRY. STONESTOP is a user-mode loader that installs POORTRY, a kernel-mode driver signed by Microsoft through the attestation signing process. Once loaded, POORTRY can terminate protected EDR processes, delete EDR executables and DLLs from disk, and prevent security software from restarting. In more recent variants, POORTRY functions as a full EDR wiper, not merely a process killer, which makes restoration of endpoint security harder during the response.

PowerTool and the Zemana driver. Akira also uses PowerTool to abuse the Zemana AntiMalware driver, exploiting it to terminate antivirus-related processes. This technique does not require a Microsoft-signed driver but achieves similar results against software that lacks self-protection.

Additional evasion behaviors. HeartCrypt, a packer-as-a-service tool, obfuscates payloads before delivery. Legitimate remote access tools blend C2 activity with normal administrative traffic. Data is compressed with 7-zip before exfiltration to reduce detection triggers on outbound transfers.

The practical consequence for defenders: by the time the encryptor runs, endpoint telemetry collection is already degraded or stopped. Detection in this stage requires visibility into driver load events, kernel-mode activity, and process termination patterns, not just behavioral rules on the encryptor itself.

What it tries to access or modifyT1486 · T1490 · T1657

Encryption: ChaCha20 + RSA across Windows, ESXi, and Nutanix

Akira's encryptor uses a hybrid scheme: ChaCha20 stream cipher for file encryption, combined with RSA public-key cryptography for the key exchange. This combination is fast and, without the attacker's private RSA key, not decryptable. For large files above approximately 4MB, partial encryption is applied (top and bottom 10-50% of the file), which reduces encryption time while still rendering the file unrecoverable.

Windows payload (Akira / Akira_v2). The Windows encryptor (historically w.exe) appends .akira, .akiranew, or .aki extensions. The ransom note (akira_readme.txt or fn.txt) is dropped in the root directory (C:\) and each user home directory. Shadow copies are deleted before encryption using both vssadmin and wmic.

Akira_v2 (Rust-based ESXi encryptor). The Rust-based variant targets VMware ESXi virtual machine disk files. It can accept runtime arguments to specify encryption targets (-p), target network drives (-s), control encryption percentage (-n), use specific CPU core counts for threading, and limit execution to VMs only (vmonly) or stop running VMs before encryption (stopvm). The encryptor requires a specific Build ID to execute, which hinders dynamic analysis. Akira_v2 also expanded to target Nutanix AHV virtual machine disk files in a June 2025 incident, the first documented case of that platform being targeted.

The encryptor includes esxcli system syslog config set --logdir=/tmp to disable ESXi logging on Linux targets. The ransom note (akiranew.txt) is dropped in each encrypted directory.

  • Windows: .akira, .akiranew, .aki extensions
  • Megazord (deprecated): .powerranges extension
  • Ransom notes: akira_readme.txt, fn.txt, akiranew.txt
  • No ransom amount in note: victims contact the group via Tor .onion address with a unique victim code
Process tree

What the Akira kill chain looks like in EDR telemetry

How Malware Protection Plus responds

Detection of the credential dumping and BYOVD chain, automated endpoint containment, and forensic capture of the attacker's tooling before the encryptor runs.

Indicators of compromise

Durable behavioral indicators are separated from volatile artifacts. Durable indicators survive variant rotation and remain relevant across campaigns. Volatile indicators (hashes, IPs, domains) expire quickly and should be treated as time-limited signals.

Ransom artifacts

4 indicators

File names and extensions dropped by all known Akira encryptor variants.

  • akira_readme.txtWindows ransom note; dropped in C:\ and each user home directory
  • fn.txtAlternate Windows ransom note filename
  • akiranew.txtESXi / Akira_v2 ransom note; dropped per-directory
  • .akira / .akiranew / .aki / .powerrangesEncrypted file extensions (.powerranges deprecated; Megazord only)

Registry and domain artifacts

4 indicators

Registry and Active Directory artifacts left by persistence and credential operations.

  • HKLM\...\TaskCache\Tasks (new tasks)Scheduled task persistence (affiliate-configured)
  • New domain account: itadmDocumented CISA-reported account name; others may vary
  • HKLM\...\Services\[driver name] (new service)STONESTOP registers POORTRY driver as a service
  • HKLM\SOFTWARE\Policies\...\DisableAntiSpyware=1hlpdrv.sys write via regedit; disables Windows Defender

Process and command-line patterns

6 patterns

Execution behaviors and parent-child chains that signal an active Akira compromise.

  • rundll32.exe comsvcs.dll MiniDump [PID]LSASS dump via comsvcs.dll
  • ntdsutil.exe "ac i ntds" "ifm" "create full …"NTDS.dit offline image capture
  • vssadmin delete shadows /all /quietShadow copy deletion; also via wmic shadowcopy delete
  • rclone.exe sync … remote:* (non-user context)RClone exfiltration to MEGA cloud storage
  • nltest /dclist: / nltest /DOMAIN_TRUSTSDomain controller and trust enumeration
  • new kernel driver loaded as service [signed, unexpected]BYOVD indicator; POORTRY loaded by STONESTOP

Network behavior

5 patterns

Outbound traffic and DNS patterns observable at firewall, proxy, or NDR.

  • Ngrok tunnels: long-lived low-bandwidth sessionsC2 encrypted sessions bypassing perimeter monitoring
  • mega.nz / Rclone uploadsPrimary data exfiltration destination
  • Cloudflare Tunnel (CLOUDFLARED) outboundSecondary C2 channel; legitimate-looking traffic
  • Tor .onion connectivity from endpointsRansom negotiation and leak site communication
  • FTP/SFTP outbound: WinSCP / FileZillaFTP-based data staging and exfiltration

Volatile — file hashes (time-limited)

Pull fresh

Hashes from CISA advisory AA24-109A (IOCs observed June 2023 through August 2025). Vet before blocking; these rotate with new builds.

  • d2fd0654710c27dcf37b6c1437880020824e161dd0bf28e3a133ed777242a0caw.exe: Akira Windows encryptor (CISA AA24-109A)
  • 3298d203c2acb68c474e5fdad8379181890b4403d6491c523c13730129be3f75Akira_v2 ESXi encryptor (CISA AA24-109A)

Detection guidance

Akira's most detectable window is between initial persistence and the BYOVD phase. Once STONESTOP loads POORTRY, endpoint telemetry is actively suppressed. Detection strategies must cover the pre-encryption stages, not only the encryptor itself, because by the time encryption begins, defensive options are severely limited.

  1. 01

    New domain admin account creation

    Active Directory / endpoint telemetry

    Alert on new domain accounts being created and immediately added to domain or local administrator groups, particularly outside of provisioning workflows. Watch specifically for accounts with IT-plausible names (itadm, support, admin-*) created during off-hours.

    Why it works: Akira consistently creates a high-privilege foothold account early in the intrusion. This is not subtle. It is an AD event that generates 4720/4728 logs and should trigger immediate investigation unless your provisioning process created it.

  2. 02

    LSASS memory access via comsvcs.dll MiniDump

    EDR / process telemetry

    Monitor for rundll32.exe invocations with comsvcs.dll and MiniDump in the command line, particularly when the target process is LSASS. Also monitor for any process opening LSASS with PROCESS_VM_READ access that is not a security tool.

    Why it works: the comsvcs.dll MiniDump path is used specifically to avoid dropping Mimikatz on disk. The command pattern is distinctive and almost never appears in legitimate administrative workflows.

  3. 03

    NTDS.dit access and extraction

    File system / process telemetry

    Alert on ntdsutil.exe executed with IFM arguments. Monitor for file copy or read access to C:\Windows\NTDS\ntds.dit from any process other than the AD DS service. Also alert on unusual VMDK file copies from domain controller virtual machines.

    Why it works: NTDS.dit access is the most reliable high-fidelity signal for domain-wide credential compromise. Legitimate ntdsutil IFM use is rare and should be scheduled maintenance with a change ticket, not an ad-hoc process.

  4. 04

    Unsigned or unexpected kernel driver loads (BYOVD)

    Kernel telemetry / driver event logs

    Monitor for new kernel driver load events (Event ID 7045, new service installed). Alert on drivers loaded from user-writable paths, drivers not in a baseline of approved kernel modules, and service creation immediately followed by EDR process termination events. Watch specifically for rwdrv.sys and hlpdrv.sys.

    Why it works: BYOVD is the mechanism Akira uses to remove endpoint security before encryption. Detecting the driver load before the EDR is killed is the last moment at which a fully instrumented response is possible.

  5. 05

    Shadow copy deletion

    Process / command-line telemetry

    Alert on vssadmin delete shadows with any flags, and on wmic shadowcopy delete, from any process other than a scheduled backup job. These commands should not appear in interactive sessions or in processes spawned by PowerShell running in a non-backup context.

    Why it works: shadow copy deletion is the final preparation step before encryption. Detecting it provides a last-resort containment signal. By this point the attack is well advanced, but containment can still prevent encryption from completing across all systems.

  6. 06

    Veeam credential dumping

    Process / PowerShell telemetry

    Monitor for PowerShell execution accessing the Veeam configuration database (VeeamBackup SQL database), Veeam-specific credential export scripts, or any process reading Veeam service account material. Alert on PowerShell ISE launched in service context.

    Why it works: backup credential theft both provides lateral movement material and destroys recovery options. Defenders who detect this before exfiltration completes have a chance to rotate backup credentials and preserve restore capability.

  7. 07

    RClone, WinSCP, or FileZilla bulk outbound transfers

    Network / DLP telemetry

    Alert on rclone.exe or rclone processes executing with sync or copy arguments pointing to remote cloud storage. Monitor for large outbound transfers to mega.nz from non-user processes, or transfers at unusual hours. WinSCP and FileZilla in service context are similarly anomalous.

    Why it works: Akira exfiltrates data before encryption begins. Detecting the exfiltration gives an opportunity to block the transfer before the data leaves the network, even if encryption cannot be prevented.

  8. 08

    Ngrok and Cloudflare tunnel connections

    Network / firewall telemetry

    Block or alert on outbound connections to Ngrok relay infrastructure. Monitor for long-lived, low-bandwidth tunneled sessions to Cloudflare Tunnel endpoints from server-class machines. These represent C2 channels designed to bypass perimeter inspection.

    Why it works: legitimate use of Ngrok or CLOUDFLARED on servers is rare and should be change-controlled. Unexpected presence of these tools is a strong indicator of attacker tooling.

Response recommendations

Akira typically exfiltrates data and disables defenses before encryption starts. The response sequence needs to address both dimensions: stopping active encryption, recovering operational capability, and preventing the second-stage extortion from succeeding.

  1. Isolate affected endpoints immediately

    Network-isolate any host showing encryption activity or exhibiting the behavioral indicators above. Prioritize isolation of domain controllers. Do not power off before isolating, since memory forensics can still recover tooling and credentials from a running system.

    Note: Malware Protection Plus supports automated endpoint isolation triggered by behavioral detection.

  2. Preserve forensic artifacts before remediation

    Capture memory images from affected endpoints, particularly from domain controllers and the machine used for initial access. Preserve PowerShell script block logs, Windows Event logs (4624, 4625, 4720, 4728, 7045, 4698), and Veeam logs. These are essential for understanding the full scope and entry point.

  3. Identify and disable all attacker-controlled accounts

    Hunt for newly created domain and local accounts, accounts added to privileged groups outside provisioning workflows, and accounts with unusual login patterns (off-hours, new source IPs). Disable before deleting to preserve audit trails. The documented itadm account name is a starting point, but other names will also be used.

  4. Rotate all domain credentials

    Reset krbtgt twice (to invalidate all Kerberos tickets), followed by all domain admin accounts, then all privileged service accounts. If NTDS.dit was accessed or copied, assume all domain password hashes are compromised and treat this as a full domain reset. Rotate Veeam service account credentials regardless of confirmed access.

  5. Validate backup integrity before attempting restore

    Akira specifically targets Veeam infrastructure. Verify backup integrity before assuming restoration is possible. Test restores from isolated backup copies. If Veeam credentials were compromised or CVE-2023-27532 / CVE-2024-40711 are present and unpatched, treat backup data as potentially corrupted until verified.

  6. Scope the exfiltrated data

    Identify what data was accessible from the compromised accounts and from the hosts that ran RClone, WinSCP, or FileZilla. Review outbound transfer logs for volume and destination. This scope determines whether the double-extortion threat involves genuinely sensitive material and informs the legal and regulatory response timeline.

  7. Hunt for persistence across the environment

    Search all systems for scheduled tasks created around the intrusion timeline, new services matching BYOVD driver patterns, AnyDesk / LogMeIn / MobaXterm installations outside the approved baseline, and registry Run key modifications. Akira operators may retain multiple footholds.

  8. Restore and verify endpoint security tools

    If POORTRY/STONESTOP was used, EDR components may have been wiped rather than suspended. Verify that endpoint security is fully operational on all systems before returning them to production, and confirm kernel driver baselines match expected state. Re-enrollment may be required on affected systems.

  9. Patch the exploited entry point before reconnecting

    Identify the confirmed entry CVE or credential path and remediate it before any affected system returns to production. If the entry was a Cisco or SonicWall VPN appliance, apply available patches, rotate all VPN credentials, and enforce MFA before re-enabling remote access.

Hardening recommendations

These controls target the specific attack stages that Akira depends on: unprotected VPN access, credential harvesting, kernel-level EDR bypass, and backup destruction. Most can be deployed without new tooling. Items are tagged by deployment difficulty.

  1. Enforce phishing-resistant MFA on all VPN and remote access services

    Critical

    The single most consistent enabling condition for Akira intrusions is VPN access without MFA. Password-only VPN authentication allows credential-stuffing and brute-force attacks to succeed without any vulnerability being exploited. This is the highest-priority control to close before any other hardening work.

    Scope: All VPN endpoints, RDP gateways, SSH access points, and any internet-facing administrative interface. Phishing-resistant MFA (hardware keys or passkeys) provides stronger protection than TOTP where feasible.

  2. Patch known exploited VPN, firewall, and backup CVEs

    Critical

    Prioritize CVE-2024-40766 (SonicWall), CVE-2023-20269 and CVE-2020-3259 (Cisco ASA), CVE-2024-40711 and CVE-2023-27532 (Veeam), and CVE-2024-37085 (VMware ESXi). These are confirmed exploited in Akira incidents. All appear on CISA's Known Exploited Vulnerabilities catalog.

    Path: Check CISA's KEV catalog at cisa.gov/known-exploited-vulnerabilities-catalog for current status and patch timelines.

  3. Enable LSASS protection and Credential Guard

    Standard

    Windows Credential Guard virtualizes LSASS secrets so they are inaccessible even to processes running in kernel mode. Protected LSASS (RunAsPPL) blocks arbitrary handle opens to the LSASS process. Both significantly raise the cost of credential theft even when the attacker has admin access.

    Path: Computer Configuration → Administrative Templates → System → Device Guard. Credential Guard requires TPM 2.0 and Secure Boot. Test in audit mode first to identify compatibility issues.

  4. Enable Microsoft Vulnerable Driver Blocklist (HVCI)

    Standard

    Hypervisor-Protected Code Integrity (HVCI) prevents unauthorized and known-vulnerable kernel drivers from loading, directly blocking the STONESTOP/POORTRY BYOVD chain. The Microsoft Vulnerable Driver Blocklist is updated regularly and blocks drivers with known exploitable flaws, including those used in Akira and similar BYOVD campaigns.

    Path: System → Device Security → Core Isolation → Memory Integrity (in Windows Security) or via Group Policy: Computer Configuration → Administrative Templates → System → Device Guard. Requires compatible hardware and may require driver compatibility testing.

  5. Isolate backup infrastructure from the production domain

    Standard

    Akira specifically targets Veeam credentials and backup infrastructure to eliminate restore options before demanding payment. Backup systems should not be domain-joined or should use separate credentials from production. Backup data should be immutable and at least one copy should be air-gapped or offline.

    Verify: Ensure backup admin accounts use credentials not present in domain AD. Apply the 3-2-1 rule: three copies, two media types, one offsite. Test restoration from the most isolated backup copy quarterly.

  6. Restrict and monitor RDP access

    Quick win

    RDP is the most common lateral movement method observed in Akira incidents. Disable RDP on systems where it is not required. Where RDP is required, restrict access to jump hosts only and require MFA. Enable Network Level Authentication and monitor for unusual source IPs or off-hours sessions.

    Path: Computer Configuration → Administrative Templates → Windows Components → Remote Desktop Services. Log all RDP sessions (Event ID 4624 with logon type 10).

  7. Block or alert on unapproved remote access tools

    Quick win

    Akira uses AnyDesk, LogMeIn, MobaXterm, and RustDesk, all legitimate tools, to maintain persistence. If these are not part of your approved tool baseline, block their execution via AppLocker or WDAC. If they are approved, alert on installations outside the expected deployment mechanism.

    Path: Implement via AppLocker application control or WDAC policy. Maintain an approved remote access tool baseline and alert on deviations.

Detect Akira's pre-encryption kill chain before the encryptor runs.

Malware Protection Plus helps security teams detect credential theft behavior, identify BYOVD driver activity, contain affected endpoints, and preserve forensic artifacts for investigation.

Start free trial →