Akira gets in through remote access that trusts a password alone, usually an SSL VPN without multi-factor authentication, and can move from first login to encrypted hypervisors in a matter of hours. This profile draws on the joint #StopRansomware advisory AA24-109A (updated November 2025), MITRE ATT&CK v20, Cisco, Cisco Talos, Arctic Wolf and the Canadian Centre for Cyber Security. It covers names and aliases, targeting, techniques mapped to ATT&CK, how the group abuses identities and credentials, and the detections and controls that break its playbook. It is written for network, identity and security operations teams; attribution follows each source's wording and the page contains no leak-site material.
Key takeaways
- Single-factor VPN access is the main door. The joint advisory names VPN services without MFA as the primary initial access route, often on Cisco ASA and FTD appliances, with SonicWall SSL VPN (CVE-2024-40766) prominent from 2024.
- Speed removes the margin for slow triage. The advisory records data exfiltration "in just over two hours from initial access" in some incidents, and Arctic Wolf saw encryption under four hours from login in almost all intrusions of its 2025 SonicWall campaign.
- Backup and hypervisor credentials are a priority target. Akira affiliates have extracted Veeam credentials, exploited Veeam Backup and Replication flaws, and encrypted VMware ESXi, Hyper-V and, from June 2025, Nutanix AHV virtual machine disks.
- New accounts are a reliable signal. Sources describe new domain administrator accounts (the advisory names one called itadm), new local admins such as sqlbackup, and additions to an ESX Admins group, each detectable within minutes.
- The fixes are known. MFA on every remote access path, rotating credentials on any appliance that ever ran a vulnerable build, patching KEV-listed edge flaws, isolating backup identities and alerting on account creation address most of the documented chain.
Who they are (names and aliases)
MITRE ATT&CK tracks the operators as group G1024 and describes Akira as a ransomware variant and deployment entity active since at least March 2023, running double extortion and showing multiple code overlaps with Conti ransomware. The encryptor families are tracked separately, so record which ID a detection or report refers to.
| Name or ID | Source | What it refers to |
|---|---|---|
| Akira (G1024) | MITRE ATT&CK | The group; ATT&CK lists GOLD SAHARA, PUNK SPIDER and Howling Scorpius as associated names |
| Akira (S1129) | MITRE ATT&CK | Original C++ encryptor for Windows, hybrid encryption using ChaCha20 with RSA |
| Megazord (S1191) | MITRE ATT&CK, AA24-109A | Rust-based Windows variant seen from August 2023, appends .powerranges; the 2025 advisory update assesses it as likely out of use since 2024 |
| Akira _v2 (S1194) | MITRE ATT&CK, Cisco Talos | Rust-based ESXi encryptor targeting /vmfs/volumes/ by default; Talos reports the .akiranew extension |
| Storm-1567 | Microsoft naming table | Microsoft lists Storm-1567 as financially motivated with the other name PUNK SPIDER, which ATT&CK associates with Akira |
In September 2024 Cisco Talos reported a return to C++ encryptors using ChaCha8 and the .akira extension, after a period in early 2024 when the group appeared to rely on data theft alone. For an operation that later dropped encryption entirely, see the Hunters International Threat Actor Profile. No sources read for this profile name individual Akira members; this page names none. See the Threat Actor Groups Guide for how vendor naming schemes relate to each other.
Targeting and motivation
- Motivation: financial. MITRE maps the double extortion model to T1657 Financial Theft; the joint advisory says Akira had claimed about USD 244.17 million in ransomware proceeds as of late September 2025.
- Size of victim: the advisory says Akira primarily targets small and medium-sized businesses but also affects larger organisations. Smaller firms are more likely to run an edge VPN with local accounts and no MFA, which matches the access pattern.
- Sectors: the advisory notes a focus on manufacturing, education, IT, healthcare and public health, financial services, and food and agriculture, across North America, Europe and Australia.
- Selection: Arctic Wolf describes the 2025 SonicWall campaign as opportunistic mass exploitation across sectors and organisation sizes, which means exposure, not industry, decides who is hit.
- Extortion model: the advisory says the ransom note carries no demand; victims receive a unique code and contact the group through a Tor site, pay in Bitcoin, and in some cases have been telephoned to add pressure.
See the Ransomware Groups Guide for how Akira compares with LockBit, Black Basta, Play and other active operations.
Tactics and techniques (MITRE ATT&CK)
All IDs below are ATT&CK v20 entries recorded against G1024 or its software, or techniques the joint advisory describes. Defence impairment techniques now sit under tactic TA0112 Defense Impairment.
| Tactic | Technique | What sources describe | Primary defence |
|---|---|---|---|
| Initial access | T1133 External Remote Services; T1078 Valid Accounts | Compromised VPN accounts, chiefly on appliances without MFA | MFA on all remote access, preferably phishing-resistant or SAML to the IdP |
| Credential access | T1110.003 Password Spraying | Brute force and spraying against VPN endpoints; the advisory names SharpDomainSpray | Lockout thresholds, alerting on failed VPN logons |
| Initial access | T1190 Exploit Public-Facing Application | Cisco ASA/FTD CVE-2020-3259 and CVE-2023-20269; SonicWall CVE-2024-40766; Veeam CVE-2023-27532 and CVE-2024-40711 | Patch KEV-listed edge flaws first; restrict management interfaces |
| Credential access | T1558.003 Kerberoasting; T1003.001 LSASS Memory; T1003.003 NTDS | Kerberoasting, Mimikatz and LaZagne; NTDS.dit and the SYSTEM hive taken by copying a domain controller's VMDK into a new VM | gMSAs with long secrets; Credential Guard; hypervisor access control |
| Credential access | T1555 Credentials from Password Stores | Veeam stored credentials extracted with scripts such as Veeam-GetCreds.ps1 | Isolate backup servers and their service accounts |
| Persistence | T1136.002 Domain Account; T1136.001 Local Account | New domain admin itadm; local admins added | Alert on account creation and privileged group changes |
| Command and control | T1219.002 Remote Desktop Software; T1572 Protocol Tunneling | AnyDesk, LogMeIn, RustDesk; Ngrok and Cloudflare tunnels; SSH reverse tunnels | Allowlist approved remote tools; block unapproved tunnel endpoints |
| Lateral movement | T1021.001 RDP; T1021.004 SSH | RDP as the main lateral tool; SSH to ESXi and other hosts | Restrict RDP between workstations; disable ESXi SSH by default |
| Defence impairment | T1685 Disable or Modify Tools | Security tools disabled, including through vulnerable signed drivers (POORTRY, Zemana via PowerTool) | Tamper protection; Microsoft vulnerable driver blocklist |
| Exfiltration | T1560.001 Archive via Utility; T1567.002 Exfiltration to Cloud Storage | WinRAR staging; Rclone, WinSCP, FileZilla, MEGA | Egress controls; alert on Rclone and bulk uploads from servers |
| Impact | T1486 Data Encrypted for Impact; T1490 Inhibit System Recovery; T1531 Account Access Removal | Encryption of Windows, ESXi, Hyper-V and Nutanix AHV; shadow copies deleted; administrator accounts deleted before encryption | Immutable, offline backups with separate credentials |
How they abuse identities and credentials
Remote access accounts
- VPN logons with valid passwords: Cisco reported in August 2023 that Akira targeted organisations that had not configured MFA for VPN users, using brute force and spraying, and noted that purchased credentials would leave little trace in VPN logs. Cisco could not determine the route in because logging was not enabled on the affected ASAs. See the VPN Security Guide.
- Credentials outliving the patch: SonicWall linked the 2025 activity to CVE-2024-40766 and to accounts carried over from Gen 6 to Gen 7 firewalls. The Canadian Centre for Cyber Security advised resetting passwords for all local SSL VPN users, removing inactive accounts and enforcing MFA, because patching alone does not invalidate credentials already taken.
- MFA that did not hold: Arctic Wolf saw successful logins against SonicWall accounts with the OTP feature enabled and could not explain how MFA was passed; it saw no malicious logins through SSO or SAML VPN authentication and suggests separating identity management from the firewall.
Non-human identities
- Directory sync and LDAP bind accounts: Arctic Wolf observed an Active Directory synchronisation account log in over SSL VPN even though it was not configured for VPN use. Service accounts that the firewall can authenticate should be denied VPN access by group, not by convention. See the Remote Access Identity Guide.
- Backup service credentials: the advisory and Talos describe Veeam credentials taken from the configuration database and Veeam flaws used to create local accounts. A backup server joined to the production domain with a domain admin service account hands the attacker both the data and the means to destroy recovery. See the Backup Identity Isolation Guide.
- Hypervisor administration: CVE-2024-37085, an ESXi authentication bypass listed by the advisory, is tied to domain-joined hosts trusting a group called ESX Admins; Arctic Wolf saw accounts added to that group. See the ESXi Ransomware Playbook.
- Kerberos service tickets: Kerberoasting targets user-based service accounts with weak passwords. Replacing them with group managed service accounts removes the crackable secret. See the Credential Dumping Guide.
Notable incidents
| When | Incident or campaign | What sources describe |
|---|---|---|
| March 2023 onward | First activity | MITRE and the advisory date Akira activity to March 2023; a Linux variant for ESXi followed in April 2023 |
| Mid 2023 | Cisco VPN campaign | Cisco and Rapid7 investigated Akira access to Cisco ASA VPNs that lacked MFA (Cisco blog, 24 August 2023) |
| January 2024 | Tietoevry, Sweden | Tietoevry confirmed an attack "based on Akira ransomware" on part of one Swedish datacentre on the night of 19 to 20 January; customers including the Primula payroll service, retailers and municipalities reported outages (BleepingComputer) |
| June 2025 | Nutanix AHV encryption | The advisory update records the first encryption of Nutanix AHV VM disk files, with initial access via CVE-2024-40766 |
| July to September 2025 | SonicWall SSL VPN campaign | Arctic Wolf tracked malicious SSL VPN logins from VPS hosting providers from 21 July 2025, with internal scanning within five minutes and encryption in as little as 55 minutes |
The same weakness appears in incidents not attributed to Akira. The Colonial Pipeline attack began with an unused VPN account protected only by a leaked password, and the unattributed SonicWall SSL VPN account compromises of October 2025 show valid credentials opening more than 100 VPN accounts.
Detection and defence
Phased response for a defender
- First week: inventory every internet-facing VPN, firewall and remote access portal; confirm MFA is enforced for every account, including local appliance accounts and LDAP-synchronised users. Where MFA cannot be enforced, restrict access by source and plan replacement.
- Rotate exposed credentials: reset all SSL VPN and appliance passwords on any device that ever ran a build affected by CVE-2024-40766, CVE-2020-3259 or CVE-2023-20269, plus the AD accounts used for VPN and LDAP binding. Remove inactive accounts.
- Patch in KEV order: edge devices, then Veeam Backup and Replication, then ESXi and Windows privilege escalation flaws such as CVE-2023-28252. Test on a pilot appliance and keep the prior firmware image for rollback.
- Isolate recovery: move backup servers out of the production domain, give them dedicated credentials and MFA, and keep at least one immutable or offline copy. Restore test quarterly.
- Control tools: use WDAC or AppLocker in audit mode to measure, then enforce, blocks on unapproved RMM and tunnelling tools and on execution from user-writable paths.
- Tune detections: deploy the alerts below, run a tabletop against the two-hour exfiltration timeline, and confirm someone can isolate a host and disable a VPN account out of hours.
What to log and alert on
| Signal | Source | Why it matters |
|---|---|---|
| %ASA-6-113015, %ASA-4-113019, %ASA-4-722041, %ASA-7-734003 | Cisco ASA syslog, sent to a remote collector | Cisco's cited messages for failed logons and VPN session creation; spikes indicate spraying |
| SSL VPN logons from hosting or VPS ASNs and unusual countries | Firewall or VPN logs enriched with ASN data | Arctic Wolf's defining hallmark of the 2025 campaign |
| Events 4720, 4728, 4732, 4756 (account creation, group additions) | Domain controller Security log | New admins such as itadm or additions to ESX Admins |
| Event 4769 with RC4 encryption for service accounts | Domain controller Security log | Common Kerberoasting signal |
| Rclone, WinSCP, FileZilla or cloudflared on servers | EDR process telemetry | Exfiltration and tunnelling tools named in the advisory |
| vssadmin or PowerShell deleting shadow copies; vulnerable driver loads | EDR, Sysmon | Late-stage impact and defence impairment |
Metrics that show it is working
- MFA coverage: percentage of remote access accounts (human and service) with enforced MFA; target 100 per cent.
- Edge patch latency: days from KEV listing to patch on internet-facing devices.
- Dormant VPN accounts: count of VPN-enabled accounts unused for 30 days or more.
- Time to alert on new privileged accounts: minutes from 4720 or 4728 to analyst triage.
- Restore success: share of quarterly backup restore tests completed within the recovery time objective.
Decision guidance
Small organisations with one firewall and no SOC gain most from MFA on the VPN, dropping VPN access for service accounts, managed detection that covers the firewall logs, and an offline backup copy. Larger estates should move remote access behind the corporate identity provider with SAML and conditional access, treat hypervisor and backup administration as tier 0, and test detections against the advisory's ATT&CK list. See the Secure Remote Access Beyond VPN Guide.
Framework mapping
| Control area | NIST SP 800-53 Rev. 5 | NIST CSF 2.0 |
|---|---|---|
| MFA on remote and privileged access | AC-17, IA-2(1) | PR.AA-03 |
| Disable inactive accounts | AC-2(3) | PR.AA-03 |
| Patch edge devices | SI-2, RA-5 | ID.RA-01, PR.PS-02 |
| Allowlist remote tools | CM-7(5) | PR.PS-02 |
| Monitoring and log review | SI-4, AU-6 | DE.CM-01 |
| Protected backups | CP-9 | PR.DS-11 |
Practitioner checklist
- Enforce MFA on every VPN and remote access path, including local appliance accounts.
- Reset VPN, appliance and LDAP bind credentials on any device that ever ran a vulnerable build.
- Deny VPN access to service and directory sync accounts by group policy on the appliance.
- Patch KEV-listed Cisco, SonicWall, Veeam and ESXi flaws first, with a tested rollback image.
- Forward VPN and firewall logs to a remote collector and alert on hosting-provider source ASNs.
- Alert within minutes on new domain or local administrators and ESX Admins changes.
- Take backup servers out of the production domain and keep an immutable or offline copy.
- Block unapproved RMM, tunnelling and file transfer tools with application control.
- Replace user-based service accounts with gMSAs and enable Credential Guard.
Standards and references
- FBI, CISA and partners: #StopRansomware: Akira Ransomware (AA24-109A, updated)
- MITRE ATT&CK: Akira (G1024)
- CISA: Known Exploited Vulnerabilities Catalog
- Canadian Centre for Cyber Security: SSL VPN vulnerability impacting Gen 7 SonicWall Firewalls (CVE-2024-40766)
- Cisco: Akira Ransomware Targeting VPNs without Multi-Factor Authentication
- Cisco Talos: Akira ransomware continues to evolve
- Arctic Wolf: Aggressive Akira Campaign Targets SonicWall VPNs
- NIST: SP 800-53 Rev. 5
Related NHI Mgmt Group resources: Ransomware Groups Guide · Threat Actor Groups Guide · Black Basta Threat Actor Profile · Top 10 Ransomware Initial Access Vectors · Ransomware Prevention Guide