Akira
A double-extortion ransomware operation that mainly gets in through VPNs without MFA, often moving from access to encryption in hours. It mostly hits small and medium-sized businesses, and also reaches larger ones.
Threat actor profile. Last reviewed 3 November 2026.
Why It Matters
Speed is the main problem. The FBI and CISA report data theft in just over two hours from initial access in some incidents.2 Arctic Wolf saw a SonicWall campaign go from credential access to encryption in under four hours in dozens of intrusions, with the fastest taking 55 minutes.5 A team that only reviews alerts in the morning could be too late.
Patching alone may not be enough. Arctic Wolf saw logins with credentials likely stolen earlier through CVE-2024-40766, including on fully patched devices and on accounts with OTP MFA. It advises resetting SSL VPN passwords and OTP secrets.5
The advisory says the group has claimed about US$244 million in proceeds as of late September 2025, and that Akira mainly targets small and medium-sized businesses.2 The sources we opened do not establish a specific UK link beyond listing Europe among affected regions.2
If you run an SSL VPN, treat a past exposure as a credentials problem as well as a patching problem. A fix applied after a compromise does not undo the theft.
How It Attacks
Based on the FBI and CISA advisory as updated in November 2025.2 Other routes are reported too: Unit 42 described a fake CAPTCHA that led to an intrusion lasting weeks.6
- 1
Get In
Uses VPN services without MFA, often through Cisco flaws. Also spearphishing, valid credentials, RDP, password spraying and SSH through a router's IP address.
- 2
Map the Network
Runs discovery tools such as AdFind, Advanced IP Scanner and NetScan.
- 3
Take Credentials
Uses Mimikatz, LaZagne and NetExec.
- 4
Blind the Defences
Uses vulnerable or malicious drivers to tamper with security tools. Arete also reports vulnerable driver use since the third quarter of 2025.3
- 5
Steal Data
Archives with WinRAR or 7-Zip, then sends data out using tools such as WinSCP, FileZilla, Rclone and MEGA.
- 6
Encrypt
Deletes shadow copies and encrypts Windows, VMware ESXi and Hyper-V. In June 2025 it encrypted Nutanix AHV VM disk files for the first time.
Key Techniques
Selected from the group's ATT&CK v20 entry and the Akira software entry.1 ATT&CK lists more.
| ID | Technique | Tactic | What It Looks Like |
|---|---|---|---|
| T1133 | External Remote Services | Initial Access | Compromised VPN accounts. |
| T1078 | Valid Accounts | Initial Access | VPN credentials and other stolen accounts. |
| T1021.001 | Remote Desktop Protocol | Lateral Movement | Moves between hosts over RDP. |
| T1558 | Steal or Forge Kerberos Tickets | Credential Access | Scripts dump Kerberos credentials. |
| T1685 | Disable or Modify Tools | Defense Impairment | Disables or alters security tools. |
| T1560.001 | Archive via Utility | Collection | Uses utilities such as WinRAR. |
| T1567.002 | Exfiltration to Cloud Storage | Exfiltration | Uses applications such as Rclone. |
| T1531 | Account Access Removal | Impact | Deletes administrator accounts before encryption. |
| T1490 | Inhibit System Recovery | Impact | Deletes volume shadow copies. |
| T1486 | Data Encrypted for Impact | Impact | Encrypts files across the environment. |
Tools Observed
Discovery
Credentials
Remote Access and Tunnelling
Defence Evasion
Data Theft
From the joint advisory.2 Many are legitimate products. Finding one does not prove compromise, so check whether it is approved.
Vulnerabilities
All named in the advisory as updated in November 2025.2 Some give initial access, and others help after entry.
Check VPN appliances and backup servers first. Those are where this list concentrates.
Key Events
Active from this month.2
Linux variant targeting VMware ESXi first deployed.2
FBI, CISA and partners publish the first joint advisory.2
Encrypts Nutanix AHV VM disk files for the first time.2
Arctic Wolf tracks a campaign against SonicWall SSL VPN, with new infrastructure as late as 20 September.5
Advisory updated with Europol EC3, French, German and Dutch partners.2
Arete says it lost the top spot to Qilin but stayed close behind, and links it to Microsoft Teams help desk impersonation.3
Warning Signs
Drawn from the joint advisory and Arctic Wolf.2,5 None of these proves an attack alone.
- SSL VPN logins from VPS hosting providers and not your normal broadband or SD-WAN ranges
- VPN logins against LDAP sync accounts not meant for VPN access
- Unapproved tunnelling tools such as Ngrok or Cloudflare Tunnel
- Rclone, WinSCP, FileZilla or MEGA activity on servers
- Shadow copy deletion using vssadmin or PowerShell
Defences That Matter
Lock Down Remote Access
- Use phishing-resistant MFA for VPNs, webmail and critical accounts.2
- Reset SSL VPN passwords and OTP secrets after any exposure to CVE-2024-40766.5
- Block untrusted access to remote services and disable unused ports.2
Patch the Edge and Backups
- Patch known exploited vulnerabilities first, especially on internet-facing systems.2
- Keep Cisco, SonicWall and Veeam products on your priority list.2
Detect in Minutes
- Monitor for lateral movement with EDR.2
- Make sure alert rules actually fire. Unit 42 found two EDR tools logged the activity but raised few alerts.6
- Cover out-of-hours periods, given how quickly this group can move.
Protect Recovery
- Keep offline, encrypted, immutable backups and test restores.2
- Include ESXi, Hyper-V and Nutanix in recovery tests.
Could Your VPN Hold Against Akira?
We can review your remote access and detection against the methods in this profile, and then help you close the gaps.
Sources
- MITRE ATT&CK: Akira (G1024), ATT&CK v20
- FBI, CISA, DC3, HHS and European partners: #StopRansomware: Akira Ransomware, AA24-109A, updated 13 November 2025
- Arete: Ransomware Trends and Data Insights, April 2026, 4 May 2026
- Check Point Research: The State of Ransomware Q2 2026, covering April to June 2026
- Arctic Wolf: September 2025 Update on Aggressive Ongoing Akira Ransomware Campaign, 26 September 2025
- eSecurity Planet on Unit 42 research: Fake CAPTCHA Triggers 42-Day Akira Ransomware Attack, 19 November 2025
- CISA Known Exploited Vulnerabilities catalogue, version 2026.10.30
MITRE ATT&CK® and ATT&CK® are registered trademarks of The MITRE Corporation. © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. ATT&CK terms of use.