Overview
The Akira ransomware group is said to have emerged in March 2023, and there's much speculation about its ties to the former CONTI ransomware group. It's worth noting that with the end of CONTI's operation, several affiliates migrated to independent campaigns such as Royal, BlackBasta, and others. According to some reports, Akira affiliates also work with other ransomware operations, such as Snatch and BlackByte, as an open directory of tools used by an Akira operator was identified, which also had connections to the Snatch ransomware. The first version of the Akira ransomware was written in C++ and appended files with the '.akira' extension, creating a ransom note named 'akira_readme.txt,' partially based on the Conti V2 source code. However, on June 29, 2023, a decryptor for this version was reportedly released by Avast. Subsequently, a version was released that fixed the decryption flaw on July 2, 2023. Since then, the new version is said to be written in Rust, this time called 'megazord.exe,' and it changes the extension to '.powerranges' for encrypted files. Most of Akira's initial access vectors use brute-force attempts on Cisco VPN devices (which use single-factor authentication only). Additionally, exploitation of CVEs: CVE-2019-6693 and CVE-2022-40684 for initial access has been identified.
What public reporting says
- Assessed with high confidence to be run by people tied to the dissolved Conti operation. Blockchain analysis showed Akira wallets paying Conti-linked wallets, and the binary refuses to run on Russian keyboard layouts.
TRM Labs · CybelAngel · Industrial Cyber
Geography: origin and targets
Assessed origin: Russian Federation. Assessed with high confidence as run by people tied to the former Conti group; the binary refuses to run on Russian keyboard layouts. Attribution is uncertain: read it as an assessment, not proof.
United States of America879
Canada82
Germany73
United Kingdom44
Italy35
Switzerland27
Brazil22
Spain22
Australia21
France12
Exploited vulnerabilities
| Vendor | Product | CVE | Category | Source |
|---|---|---|---|---|
| Veeam | Backup & Replication | CVE-2024-40711 | Applications | @SophosXOps |
| Veeam | Backup & Replication | CVE-2023-27532 | Applications | labs.withsecure.com, blogs.blackberry.com, welivesecurity.com, sophos.com, news.sophos.com, security.com, group-ib.com |
| Fortinet | FortiOS | CVE-2022-40684 | Network edge | stairwell.com |
| Fortinet | FortiOS | CVE-2019-6693 | Network edge | stairwell.com |
| SonicWall | SonicOS SSL-VPN | CVE-2024-40766 | Network edge | arcticwolf.com, arcticwolf.com, ccb.belgium.be |
| Cisco | ASA & FTD | CVE-2023-20269 | Network edge | cisco.com |
| Cisco | ASA & FTD | CVE-2020-3259 | Network edge | cisa.gov |
| VMware | ESXi | CVE-2024-37085 | Virtualization | microsoft.com, blog.talosintelligence.com |
| VMware | vSphere Client | CVE-2021-21972 | Virtualization | crowdstrike.com, qualys.com |
| Cisco | ASA & FTD | CVE-2023-20263 | Other | blog.talosintelligence.com |
| Fortinet | FortiClient | CVE-2023-48788 | Other | blog.talosintelligence.com |
ATT&CK techniques
Columns are ATT&CK tactics; each cell is a technique reported for this group in public sources. A technique appearing here means it has been reported for the group, not that it was used in any particular incident, and an empty cell is not evidence that the group does not use it.
Technique details
Initial Access (TA0001)
- T1078 · Valid Accounts: Utilizes compromised VPN credentials.
- T1078.002 · Valid Accounts: Domain Accounts: Operators use obtained domain accounts for access.
- T1133 · External Remote Services: Actors exploit CVE-2023-20269 remote service vulnerabilities.
- T1190 · Exploit Public-Facing Application: Targets vulnerable CISCO devices via CVE-2023-20269.
Execution (TA0002)
- T1047 · Windows Management Instrumentation: Actors may use WMI to continue the attack.
- T1059 · Command and Scripting Interpreter: Accepts parameters for its routines such as "-n 10" (for encryption percentage) or "-s (filename)" (for shared folder encryption).
- T1059.001 · Command and Scripting Interpreter: PowerShell: Operators use PowerShell to launch commands to continue operations.
- T1059.002 · System Services: Service Execution: Akira ransomware uses service execution for persistence.
- T1059.003 · Command and Scripting Interpreter: Windows Command Shell: Operators use CMD to launch commands to continue operations.
Persistence (TA0003)
- T1136.001 · Create Account: Local Account: Upon initial access, Akira operators create a local account on the compromised system.
- T1136.002 · Create Account: Domain Account: Upon initial access, Akira operators create a domain account on the compromised system.
Privilege Escalation (TA0004)
- T1078.002 · Valid Accounts: Domain Accounts: Utilizes valid domain accounts for privilege escalation.
- TA0004 · Privilege Escalation: Utilizes local domain accounts for privilege escalation.
Stealth (TA0005)
- T1027.001 · Obfuscated Files or Information: Binary Padding: Akira has used binary padding to obfuscate payloads.
- T1036.005 · Masquerading: Match Legitimate Resource Name or Location: Akira has used legitimate names and locations for files to evade defenses.
Defense Evasion (TA0005)
- T1112 · Modify Registry: Uses commands in its operation to modify registries.
- T1562.001 · Impair Defenses: Disable or Modify Tools: Usage of PowerTool or a KillAV tool abusing the Zemana AntiMalware driver to terminate AV-related processes was observed.
Credential Access (TA0006)
- T1003.001 · OS Credential Dumping: LSASS Memory: Uses Mimikatz, LaZagne, or a command line to dump LSASS from memory.
- T1558 · Steal or Forge Kerberos Tickets: Akira have used scripts to dump Kerberos authentication credentials.
Discovery (TA0007)
- T1018 · Remote System Discovery: Uses Advanced IP Scanner and MASSCAN to discover remote systems.
- T1082 · System Information Discovery: Uses PCHunter and SharpHound to collect system information.
- T1482 · Domain Trust Discovery: Akira uses the built-in Nltest utility or tools such as AdFind to enumerate Active Directory trusts in victim environments.
- TA0007 · Discovery: Uses AdFind, Windows net command, and nltest to collect domain information.
Lateral Movement (TA0008)
- T1021.001 · Remote Services: Remote Desktop Protocol: Utilizes remote services for accessing accounts and machines through remote services.
- T1570 · Lateral Tool Transfer: Uses RDP to move laterally within the victim's network.
Collection (TA0009)
- T1213.002 · Data from Information Repositories: Sharepoint: Akira has accessed and downloaded information stored in SharePoint instances as part of data gathering and exfiltration activity.
- T1560.001 · Archive Collected Data: Archive via Utility: Utilizes discovery to gather information for exfiltration.
Exfiltration (TA0010)
- T1048.003 · Exfiltration Over Alternative Protocol: Exfiltration Over Unencrypted Non-C2 Protocol: Utilizes FileZilla or WinSCP to exfiltrate stolen information via FTP.
- T1567.002 · Exfiltration Over Web Service: Exfiltration to Cloud Storage: Uses RClone to exfiltrate stolen information via a web service.
Command and Control (TA0011)
- T1219 · Remote Access Tools: Akira uses legitimate utilities such as AnyDesk and PuTTy for maintaining remote access to victim environments.
- T1229 · Remote Access Software: Utilizes AnyDesk, Radmin, Cloudflare Tunnel, MobaXterm, RustDesk, or Ngrok to gain remote access on targeted systems.
Impact (TA0040)
- T1486 · Data Encrypted for Impact: Akira ransomware is used to encrypt files.
- T1490 · Inhibit System Recovery: Deletes shadow copies to inhibit recovery.
- T1531 · Account Access Removal: Akira deletes administrator accounts in victim networks prior to encryption.
- T1657 · Financial Theft: Akira engages in double-extortion ransomware, exfiltrating files then encrypting them, in order to prompt victims to pay a ransom.
Defense Impairment (TA0112)
- T1685 · Disable or Modify Tools: Akira has disabled or modified security tools for defense evasion.
Tools
- DonPAPI
- LaZagne
- Mimikatz
- PowerTool
- ThrottleStop driver
- Zemana Anti-Rootkit driver
- churchill_driver.sys / fidget.sys
- consent.exe (msimg32.dll / wmsgapi.dll)
- icardagt.exe (version.dll DLL sideload)
- mfpmp.exe (rtworkq.dll DLL sideload)
- Advanced IP Scanner
- Advanced Port Scanner
- Bloodhound
- Masscan
- ReconFTW
- ShareFinder
- SharpHound
- SharpShares
- SoftPerfect NetScan
- ldapdomaindump
- FileZilla
- MEGA
- RClone
- Temp[.]sh
- WinRAR
- WinSCP
- net
- netsh
- nltest
- vssadmin
- Cloudflared
- Ngrok
- OpenSSH
- CrackMapExec
- Impacket
- NetExec
- AnyDesk
- MeshAgent
- MobaXterm
- Radmin
- RustDesk
- TeamViewer
Leak-site infrastructure
| Title | Type | Address (defanged) | Seen online at snapshot |
|---|---|---|---|
| / | Chat | akiralkzxzq2dsrzsrvbr2xgbbu2wgsmxryd4csgfameg52n7efvr2id[.]onion | Yes |
| — | DLS | akiral2iz6a7qgd3ayp3l6yub7xx2uep76idk3u2kollpj5z3z636bad[.]onion | Yes |
Sources and caveats
Group descriptions, ATT&CK mappings, tools and leak-site locations come from public ransomware tracking projects, including ransomware.live and Crocodyli. Exploited vulnerabilities come from the Ransomware-Vulnerability-Matrix by BushidoUK (licensed CC BY 4.0), supplemented where a group profile there is newer than the data we hold. Each CVE links to its original research source. Technical text is shown in English as published. Leak-site addresses are defanged and shown for blocking and detection; do not visit them. Nothing here is verified by ClairSec_ against a specific incident.
Data snapshot: 2026-10-11