# Akira Ransomware

Ransomware-as-a-Service (RaaS) · Double extortion · First seen March 2023 · Windows, Linux, VMware ESXi, Hyper-V, Nutanix AHV · Last updated June 2, 2026

## Overview

Akira is a ransomware-as-a-service operation that emerged in March 2023 and rapidly became one of the most financially consequential ransomware groups operating globally. A joint advisory from the FBI, CISA, DC3, HHS, Europol, and national agencies in France, Germany, and the Netherlands designates Akira as an imminent threat to critical infrastructure. The FBI classifies it among its top five most investigated ransomware variants out of 130 actively tracked.

The group is tracked under multiple aliases: Storm-1567, Howling Scorpius, Punk Spider, and Gold Sahara. Its operational lineage likely connects to the defunct Conti syndicate. As of late September 2025, Akira had claimed approximately $244.17 million in ransomware proceeds since its emergence, a more than fivefold increase over its April 2024 total.

Akira operates a double-extortion model: it exfiltrates sensitive data before encrypting, then demands payment under threat of publishing the stolen data on its Tor-hosted leak site. Ransom demands typically fall in the hundreds of thousands to multi-million-dollar range, and the group has been observed calling victim organizations directly to apply additional pressure. The group has also been observed exfiltrating data in just over two hours from initial access.

What makes Akira technically distinctive is its multi-platform encryptor portfolio and its systematic approach to dismantling defenses before encryption. It maintains separate payloads for Windows, Linux/VMware ESXi, Hyper-V, and, as of June 2025, Nutanix AHV virtual machines. It uses Bring Your Own Vulnerable Driver (BYOVD) techniques to disable endpoint security at the kernel level before deploying the encryptor. It targets backup infrastructure specifically, exploiting Veeam vulnerabilities to corrupt recovery options and remove the victim's ability to restore without paying.

### Threat profile

| Field | Value |
|---|---|
| Type | Ransomware (RaaS) |
| First seen | Mar 2023 |
| Tracked as | Storm-1567 |
| Status | Actively operating |
| Aliases | Howling Scorpius, Punk Spider, Gold Sahara, Storm-1567 |
| Extortion | Double extortion (encrypt + leak threat) |
| Platforms | Windows · Linux · VMware ESXi · Hyper-V · Nutanix AHV |
| Initial access | VPN credential abuse · CVE exploitation · phishing · IAB purchase |
| Key CVEs | CVE-\2024-40766 · CVE-2024-40711 · CVE-\2023-20269 · CVE-2023-27532 |
| Encryptors | Akira (C++) · Akira_v2 (Rust) · Megazord (Rust, deprecated) |
| File extensions | .akira · .akiranew · .aki · .powerranges |
| Conti ties | Assessed likely; code overlap, personnel overlap |

## Operational attack chain · Akira intrusion lifecycle

1. **Unpatched VPN or credential abuse**  
   CVE-\2024-40766, CVE-\2023-20269, stolen credentials without MFA

2. **Credential harvesting**  
   LSASS dump, NTDS.dit extraction, Veeam credentials

3. **EDR dismantlement via BYOVD**  
   STONESTOP loads POORTRY kernel driver, endpoints go silent

4. **Data exfiltration and encryption**  
   RClone to MEGA, `vssadmin delete shadows`, ChaCha20 + RSA

5. **Double extortion demand**  
   Ransom note, Tor leak site, direct victim contact

Full attack cycle can compress to under four hours from initial access to encryption onset. [Detection](https://www.manageengine.com/malware-protection/malware-detection.html) must focus on the credential theft (Stage 1) and EDR dismantlement (Stage 2) window before defenses are actively removed.

Mapped to the CISA/FBI joint advisory AA24-109A (updated November 2025)

## How Malware Protection Plus responds

A walkthrough showing detection of the LOLBin execution chain, automated containment of the affected endpoint, and forensic capture of the command artifacts.

## Tactics, techniques, and procedures

Akira's attack chain spans nine MITRE ATT&CK tactics, with the highest technique density in Privilege Escalation, Defense Evasion, and Credential Access. The coverage below reflects the November 2025 CISA/FBI joint advisory plus documented campaign behaviors through mid-2025.

### MITRE ATT&CK coverage

| Tactic | Technique Count |
|---|---|
| Recon | 0 |
| Resource Development | 2 |
| Initial Access | 5 |
| Execution | 3 |
| Persistence | 3 |
| Privilege Escalation | 4 |
| Defense Evasion | 5 |
| Credential Access | 5 |
| Discovery | 4 |
| Lateral Movement | 3 |
| Collection | 2 |
| Command and Control | 3 |
| Exfiltration | 3 |
| Impact | 3 |

### Technique detail

| Tactic | Techniques | What Akira does | Defender telemetry |
|---|---|---|---|
| Initial Access | [Exploit Public-Facing App T1190](https://attack.mitre.org/techniques/T1190/) · [Valid Accounts T1078](https://attack.mitre.org/techniques/T1078/) · [External Remote Services T1133](https://attack.mitre.org/techniques/T1133/) · [Spearphishing Attachment T1566.001](https://attack.mitre.org/techniques/T1566/001/) · [Brute Force T1110](https://attack.mitre.org/techniques/T1110/) | Primary entry via unpatched VPN appliances and stolen or brute-forced credentials without MFA. RDP also observed. | VPN auth logs, geo anomalies, RDP logon type 10 events |
| Execution | [PowerShell T1059.001](https://attack.mitre.org/techniques/T1059/001/) · [VBScript T1059.005](https://attack.mitre.org/techniques/T1059/005/) · [Service Execution T1569.002](https://attack.mitre.org/techniques/T1569/002/) | PowerShell deletes shadows and executes scripts; PsExec for remote deployment. | Event 4688, 4104, 7045 |
| Persistence | [Domain Account Creation T1136.002](https://attack.mitre.org/techniques/T1136/002/) · [Local Account Creation T1136.001](https://attack.mitre.org/techniques/T1136/001/) · [Remote Access Tools T1219](https://attack.mitre.org/techniques/T1219/) | New domain accounts (e.g., itadm), remote access tools installed. | 4720, 4728/4732 events |
| Privilege Escalation | [Exploit for Priv Esc T1068](https://attack.mitre.org/techniques/T1068/) · [SAM/SYSTEM T1003.002](https://attack.mitre.org/techniques/T1003/002/) · [NTDS.dit T1003.003](https://attack.mitre.org/techniques/T1003/003/) · [Domain Policy Modification T1484](https://attack.mitre.org/techniques/T1484/) | Veeam CVE exploitation, offline NTDS.dit extraction, BYOVD for kernel privilege. | Hypervisor logs, ntdsutil events, driver load events |
| Defense Evasion | [Impair Defenses T1562.001](https://attack.mitre.org/techniques/T1562/001/) · [BYOVD T1068](https://attack.mitre.org/techniques/T1068/) · [Obfuscated Files T1027](https://attack.mitre.org/techniques/T1027/) · [Archive Obfuscation T1027.015](https://attack.mitre.org/techniques/T1027/015/) · [Masquerading T1036](https://attack.mitre.org/techniques/T1036/) | STONESTOP loads POORTRY driver to terminate EDR; PowerTool abuses Zemana driver; HeartCrypt obfuscation. | Driver load 7045, EDR health gaps |
| Credential Access | [LSASS Memory T1003.001](https://attack.mitre.org/techniques/T1003/001/) · [Kerberoasting T1558.003](https://attack.mitre.org/techniques/T1558/003/) · [Credentials from Password Stores T1555](https://attack.mitre.org/techniques/T1555/) · [Password Spraying T1110.003](https://attack.mitre.org/techniques/T1110/003/) · [Pass the Hash T1550.002](https://attack.mitre.org/techniques/T1550/002/) | LSASS dump via comsvcs.dll; NTDS.dit extraction; Veeam credential dumping. | LSASS access events, 4769 TGS RC4 |
| Discovery | [Network Config Discovery T1016](https://attack.mitre.org/techniques/T1016/) · [Network Service Scan T1046](https://attack.mitre.org/techniques/T1046/) · [Remote System Discovery T1018](https://attack.mitre.org/techniques/T1018/) · [AD Account Discovery T1087.002](https://attack.mitre.org/techniques/T1087/002/) | Network scanners, AdFind, nltest enumeration. | Process and LDAP query spikes |
| Lateral Movement | [RDP T1021.001](https://attack.mitre.org/techniques/T1021/001/) · [SSH T1021.004](https://attack.mitre.org/techniques/T1021/004/) · [Remote Access Tools T1219](https://attack.mitre.org/techniques/T1219/) | RDP, SSH, SMB, PsExec, remote tools. | 4624 logon type 3/10 |
| Collection | [Archive via Utility T1560.001](https://attack.mitre.org/techniques/T1560/001/) · [Local System Data T1005](https://attack.mitre.org/techniques/T1005/) | WinRAR, 7-zip staging. | Archive creation events |
| Command and Control | [Protocol Tunneling T1572](https://attack.mitre.org/techniques/T1572/) · [Proxy T1090](https://attack.mitre.org/techniques/T1090/) · [Multi-hop Proxy T1090.003](https://attack.mitre.org/techniques/T1090/003/) | Ngrok, SystemBC, Cloudflare Tunnel, Tor negotiation. | Tunnel traffic, Tor connectivity |
| Exfiltration | [Exfil Over Alt Protocol T1048](https://attack.mitre.org/techniques/T1048/) · [Transfer to Cloud Account T1537](https://attack.mitre.org/techniques/T1537/) · [Exfil to Cloud Storage T1567.002](https://attack.mitre.org/techniques/T1567/002/) | RClone to MEGA, WinSCP, FTP. | Outbound mega.nz transfers |
| Impact | [Data Encrypted for Impact T1486](https://attack.mitre.org/techniques/T1486/) · [Inhibit System Recovery T1490](https://attack.mitre.org/techniques/T1490/) · [Financial Theft/Extortion T1657](https://attack.mitre.org/techniques/T1657/) | ChaCha20 + RSA, partial encryption, VSS deletion, double extortion. | File rename spikes, ransom note drops |

## Credential harvesting: representative commands

### LSASS dump via comsvcs.dll

```cmd
rundll32.exe C:\Windows\System32\comsvcs.dll MiniDump [LSASS_PID] C:\ProgramData\lsass.dmp full
```

Pattern documented in CISA/FBI joint advisory AA24-109A.

### NTDS.dit offline capture via ntdsutil

```cmd
ntdsutil "ac i ntds" "ifm" "create full c:\Programdata\temp\Crashpad\Temp\abc" q q
```

Technique documented in MITRE ATT&CK T1003.003 and CISA advisory AA24-109A.

## Indicators of compromise

### Ransom artifacts

- `akira_readme.txt`
- `fn.txt`
- `akiranew.txt`
- `.akira / .akiranew / .aki / .powerranges`

### Registry and domain artifacts

- `HKLM\...\TaskCache\Tasks`
- New domain account: `itadm`
- `HKLM\...\Services\[driver name]`
- `HKLM\SOFTWARE\Policies\...\DisableAntiSpyware=1`

### Process and command-line patterns

- `rundll32.exe comsvcs.dll MiniDump`
- `ntdsutil.exe "ac i ntds" "ifm"`
- `vssadmin delete shadows /all /quiet`
- `rclone.exe sync`
- `nltest /dclist:`
- New unexpected signed kernel driver service load

### Network behavior

- Ngrok long-lived tunnels
- `mega.nz` uploads via RClone
- Cloudflare Tunnel outbound
- Tor `.onion` connectivity
- FTP/SFTP via WinSCP or FileZilla

### Volatile file hashes (time-limited)

- `d2fd0654710c27dcf37b6c1437880020824e161dd0bf28e3a133ed777242a0ca`
- `3298d203c2acb68c474e5fdad8379181890b4403d6491c523c13730129be3f75`

## Detection guidance

1. **New domain admin account creation**  
   Monitor 4720/4728 events for unexpected privileged accounts.

2. **LSASS access via comsvcs.dll**  
   Alert on `rundll32.exe` invoking `comsvcs.dll MiniDump`.

3. **NTDS.dit extraction**  
   Alert on `ntdsutil.exe` IFM usage and DC VMDK copies.

4. **Unexpected kernel driver loads (BYOVD)**  
   Monitor Event ID 7045 and driver loads from user-writable paths.

5. **Shadow copy deletion**  
   Alert on `vssadmin delete shadows` and `wmic shadowcopy delete`.

6. **Veeam credential dumping**  
   Monitor PowerShell access to Veeam configuration database.

7. **RClone/WinSCP bulk transfers**  
   Detect large outbound transfers to `mega.nz`.

8. **Ngrok/Cloudflare tunnels**  
   Alert on tunneled outbound sessions from servers.

## Response recommendations

1. Isolate affected endpoints immediately.
2. Preserve forensic artifacts before remediation.
3. Disable attacker-controlled accounts.
4. Rotate all domain credentials (including krbtgt twice).
5. Validate backup integrity before restore.
6. Scope exfiltrated data.
7. Hunt for persistence.
8. Restore and verify endpoint security tools.
9. Patch exploited entry points before reconnecting.

## Hardening recommendations

1. **Enforce phishing-resistant MFA on VPN and remote access (Critical)**  
   Apply to all VPN, RDP, SSH, and admin interfaces.

2. **Patch known exploited VPN, firewall, and backup CVEs (Critical)**  
   Prioritize CVE-\2024-40766, CVE-\2023-20269, CVE-2024-40711, CVE-2023-27532, CVE-2024-37085.  
   Review CISA KEV catalog: https://www.cisa.gov/known-exploited-vulnerabilities-catalog

3. **Enable LSASS protection and Credential Guard (Standard)**  
   Requires TPM 2.0 and Secure Boot.

4. **Enable Microsoft Vulnerable Driver Blocklist (HVCI) (Standard)**  
   Blocks known vulnerable drivers used in BYOVD chains.

5. **Isolate backup infrastructure (Standard)**  
   Follow 3-2-1 rule and use immutable backups.

6. **Restrict and monitor RDP (Quick win)**  
   Disable where unnecessary; enforce MFA and NLA.

7. **Block or alert on unapproved remote access tools (Quick win)**  
   Use AppLocker or WDAC to enforce baseline.

Controls addressing initial access, credential protection, BYOVD blocking, and backup isolation significantly reduce Akira’s success rate but must be combined with behavioral detection coverage across all stages.

## Primary references

- [CISA/FBI Joint Advisory AA24-109A — #StopRansomware: Akira Ransomware (updated November 2025)](https://www.cisa.gov/news-events/cybersecurity-advisories/aa24-109a) — Nov 2025  
- [CISA Advisory Alert — Akira presents imminent threat to critical infrastructure](https://www.cisa.gov/news-events) — Nov 2025  
- [MITRE ATT&CK — Enterprise framework reference](https://attack.mitre.org/) — Current