Notifications
Clear all
Topic starter
02/08/2026 12:17 pm
TL;DR: Akira ransomware continues to evolve across VPN compromise, valid credential abuse, lateral movement, data exfiltration, and rapid double-extortion impact, according to SafeBreach’s coverage of CISA Alert AA24-109A, with some incidents exfiltrating data in just over two hours and proceeds estimated at $244.17 million by late September 2025. The lesson is clear: control validation now has to track attack paths, not just isolated indicators.
NHIMG editorial — based on content published by SafeBreach: Updated CISA Alert AA24-109A coverage for Akira ransomware
By the numbers:
- As of late September 2025, it’s believed that Akira ransomware has claimed approximately $244.17 million in ransomware proceeds.
- In a June 2025 incident, Akira threat actors encrypted Nutanix AHV VM disk files for the first time, expanding their capabilities beyond VMware ESXi and Hyper-V by abusing CVE-2024-40766 and CWE-284: Improper Access Control.
Questions worth separating out
Q: What breaks when VPN access is exposed without MFA in ransomware scenarios?
A: Attackers can turn a single compromised or brute-forced VPN login into a trusted foothold, then escalate through credential theft, discovery, and lateral movement.
Q: Why do valid accounts make ransomware attacks harder to detect?
A: Valid accounts blend into normal access patterns, especially when they are purchased or stolen through initial access brokers.
Q: What do organisations get wrong about ransomware recovery?
A: Many organisations treat recovery as a storage or backup problem and underweight identity control.
Practitioner guidance
- Validate VPN and remote access exposure paths Test every externally reachable VPN, RDP, SSH, and remote admin path for MFA gaps, weak authentication, and known exploitable versions.
- Harden privileged account creation and trust discovery Restrict who can create admin accounts, monitor net, nltest, LDAP, and similar discovery activity, and alert on trust-mapping behaviour that reveals escalation routes.
- Correlate credential theft with lateral movement telemetry Link LSASS access, Mimikatz-style behaviour, remote PowerShell, WMI, RDP, and SMB execution into a single detection model so credential abuse cannot hide as ordinary administration.
What's in the full article
SafeBreach's full coverage covers the operational detail this post intentionally leaves for the source:
- The full updated CISA alert mapping for Akira TTPs across initial access, privilege escalation, lateral movement, exfiltration, and encryption.
- The complete SafeBreach attack coverage list, including IOC-based and behavioural simulations for Windows, Linux, and virtualised environments.
- Specific playbook identifiers for validating exposure against the newer Akira, Megazord, and Akira_v2 variants.
- Guidance on how SafeBreach customers can run the alert scenario from the homepage, scenario page, or Known Threats Series report.
👉 Read SafeBreach’s coverage of the updated CISA Akira ransomware alert →
Akira ransomware updates: what exposure validation teams need to know?
Explore further
02/08/2026 1:19 pm
Akira reinforces the exposure-validation gap: organisations still tend to test isolated detections instead of the full attacker path. The article shows why that is insufficient. A VPN compromise, a stolen credential, or a remote tool abuse event only becomes decisive when it can be chained into privilege escalation, exfiltration, and encryption. Practitioners should treat attack-path validation as a control requirement, not a nice-to-have.
A few things that frame the scale:
- 70% of organisations grant AI systems more access than they would give a human employee performing the exact same job, according to The 2026 Infrastructure Identity Survey.
- Only 44% of organisations have implemented any policies to manage their AI agents, despite 92% agreeing that governing AI agents is critical to enterprise security.
A question worth separating out:
Q: Who is accountable when ransomware operators move from access to extortion?
A: Accountability spans identity owners, infrastructure teams, endpoint defenders, and incident response leadership because the failure is usually cross-control. Frameworks such as NIST CSF and NIST SP 800-53 expect governance over access, monitoring, and recovery. If no team owns the full attack path, the attacker effectively does.
👉 Read our full editorial: Akira ransomware’s updated tradecraft raises exposure validation stakes
