{"id":442,"count":0,"description":"
\n
\n Year Established<\/span>\n
2023<\/div>\n <\/div>\n
\n Attribution<\/span>\n
Unknown (Eastern European Suspected)<\/div>\n <\/div>\n
\n Motivation<\/span>\n
Financial<\/div>\n <\/div>\n
\n Modus Operandi (MO)<\/span>\n
Double-extortion RaaS, Cisco VPN exploitation, retro-aesthetic branding<\/div>\n <\/div>\n
\n Primary Aliases<\/span>\n
Akira<\/div>\n <\/div>\n<\/div>\n

Akira Ransomware is a double-extortion ransomware operation that emerged in March 2023 and rapidly established itself as a significant player in the ransomware ecosystem, distinguished by its distinctive retro-terminal aesthetic on its data leak website , a stylistic choice that generated considerable media attention and helped differentiate the group within the saturated ransomware market.<\/p>\n

Akira's primary initial access vector has been the exploitation of vulnerabilities in Cisco VPN and ASA products , particularly targeting accounts without multi-factor authentication configured , enabling the group to gain direct authenticated access to corporate networks through legitimate remote access infrastructure. This targeting of network perimeter devices reflects a sophisticated understanding of enterprise security architecture and the high value of VPN-level access for subsequent lateral movement.<\/p>\n

The group has claimed attacks against hundreds of organisations across healthcare, education, financial services, and manufacturing globally, with a notable concentration of victims in North America and Europe. Akira's ransom demands typically range from $200,000 to millions of dollars, calibrated based on the victim's revenue and the sensitivity of exfiltrated data.<\/p>\n

Security researchers identified code similarities between Akira's early encryptor and the Conti ransomware family , including shared code patterns suggesting either former Conti developers or access to Conti source code. A Linux variant targeting VMware ESXi environments was subsequently released, extending the group's capability to encrypt virtualised infrastructure. CISA, the FBI, and international partners issued a joint advisory about Akira in April 2024, having observed the group compromising over 250 organisations and collecting over $42 million in ransom payments.<\/p>\n\n

Tactical Telemetry and Extortion Framework:<\/strong> In confirmed intrusions, Akira Ransomware<\/strong> employs double-extortion tactics, combining high-speed asymmetric encryption with automated data exfiltration pipelines. Initial access is routinely obtained via compromised Remote Desktop Protocol (RDP) credentials, initial access broker (IAB) marketplaces, and spear-phishing campaigns delivering infostealer payloads. Organizations operating critical IT infrastructure are advised to enforce strict network segmentation, deploy hardware-backed multi-factor authentication across all external access points, and maintain immutable offline backups to mitigate operational disruption.<\/p>","link":"https:\/\/cyberasia.io\/actor\/akira-ransomware\/","name":"Akira Ransomware","slug":"akira-ransomware","taxonomy":"threat_actor","parent":0,"meta":[],"_links":{"self":[{"href":"https:\/\/cyberasia.io\/people\/wp-json\/wp\/v2\/threat_actors\/442","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/cyberasia.io\/people\/wp-json\/wp\/v2\/threat_actors"}],"about":[{"href":"https:\/\/cyberasia.io\/people\/wp-json\/wp\/v2\/taxonomies\/threat_actor"}],"wp:post_type":[{"href":"https:\/\/cyberasia.io\/people\/wp-json\/wp\/v2\/posts?threat_actors=442"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}