Ransomware operators are closing the gap between Windows and Linux payloads faster than ever — and Akira exemplifies how quickly a group can weaponise leaked code across platforms. SentinelOne published a detailed technical breakdown in April 2024 tracing Akira's Linux and VMware ESXi encryptors to their unmistakable roots in the leaked Conti ransomware source code.
Conti's Lineage
Akira's Linux variant, first observed in June 2023, uses the Crypto++ library for encryption, with code structure and configuration flags consistent with the Conti v2 codebase leaked after that group dissolved in 2022. The Windows variant applies ChaCha20 for file encryption with the key wrapped by a hard-coded RSA public key — the same hybrid scheme Conti used.
Unlike some ESXi ransomware that shuts down virtual machines pre-encryption, Akira's Linux encryptor offers no such step. Instead, the operator controls encryption depth via the -n parameter, governing what percentage of each file is encrypted — a deliberate trade-off between speed, stealth, and victim leverage.
Confirmed Linux Sample Hashes
The following Akira Linux encryptor samples were confirmed by SentinelOne from incident telemetry:
- SHA1:
9180ea8ba0cdfe0a769089977ed8396a68761b40 - SHA1:
f1c0054bc76e8753d4331a881cdf9156dd8b812a
A Broader Industry Shift
"Strategically dipping into code from well known ransomware families such as Conti, Babuk, or LockBit, ransomware operators are reusing and modifying codebases to create novel attack techniques," SentinelOne researchers observed. Akira's victim profile spans education, financial services, manufacturing, real estate, and healthcare globally. Defenders should network-segment ESXi hypervisors, ensure VPN access requires phishing-resistant MFA, and monitor for anomalous bulk encryption activity on Linux hosts.