Akira — Malware Profile
Akira ransomware, written in C++, is most prominently (but not exclusively) associated with the ransomware-as-a-service entity Akira. Akira ransomware has been used in attacks across North America, Europe, and Australia, with a focus on critical infrastructure sectors including manufacturing, education, and IT services. Akira ransomware employs hybrid encryption and threading to increase the speed and efficiency of encryption and runtime arguments for tailored attacks. Notable variants include Rust-based Megazord for targeting Windows and Akira _v2 for targeting VMware ESXi servers.
MITRE ATT&CK techniques (10)
- T1047 Windows Management Instrumentation
- T1057 Process Discovery
- T1059.001 PowerShell
- T1059.003 Windows Command Shell
- T1082 System Information Discovery
- T1083 File and Directory Discovery
- T1106 Native API
- T1135 Network Share Discovery
- T1486 Data Encrypted for Impact
- T1490 Inhibit System Recovery
IntelFusions coverage
- From Conti Code to ESXi Servers: SentinelOne Decodes Akira's Cross-Platform Ransomware Evolution 2026-02-16
- Akira Ransomware Targets Cisco VPNs Without MFA: Sophos Documents Over a Dozen Incidents 2026-02-16
- Akira Topped Sophos Ransomware Cases in 2024, Peaked at 17% of August Detections Amid Veeam Exploits 2026-02-16
- New ransomware crew The Gentlemen claims 20 victims in one week 2026-06-12
- Newer ransomware crews claim diagnostics maker Hologic and an Australian fire service 2026-06-28
- Ransomware gang claims to hit German submarine builder Thyssenkrupp 2026-06-28
- Hackers poison Bing search results to drop Akira ransomware on companies 2026-06-29
- Ransomware crews can hide their tracks in ESX logs 2026-08-07