Since it appeared in March 2023, Akira has become one of the most consistent and profitable ransomware operations in the world. It does not chase headlines with exotic techniques. Instead, its affiliates do the basics very well: log in through a VPN without multi-factor authentication, move quickly, steal data, and encrypt the virtual servers that run the business.
By late 2025, international law enforcement agencies estimated Akira had collected around $244 million in ransom payments. In 2026 it remains one of the three most active ransomware groups alongside Qilin and The Gentlemen. This guide explains how Akira operates, who it targets, and which dark web signals give defenders an early warning.
What Is Akira Ransomware?
Akira is a ransomware-as-a-service (RaaS) operation. Its developers build the ransomware, run the negotiation portal and leak site, and split ransom payments with affiliates who carry out the intrusions. It uses double extortion: data is stolen before systems are encrypted, and victims are threatened with publication even if they can restore from backups.
Akira emerged less than a year after the Conti ransomware gang shut down in 2022. A February 2024 report from the US Department of Health and Human Services pointed to research suggesting links between the two, based on overlapping tactics, encryption methods and ransom payment addresses. That history helps explain why Akira's affiliates looked experienced from the start.
The group started with a Windows encryptor, added a Linux version in June 2023 to hit VMware ESXi servers, and in 2025 expanded to Nutanix AHV virtual machines. Encrypted files typically get the .akira extension, with newer variants using extensions such as .akiranew and .aki.
Akira by the Numbers
In total, trackers count well over 1,400 organisations claimed by Akira since 2023. Ransom demands typically range from about $200,000 to several million dollars, and the group has been known to lower its price if a victim only wants the stolen data kept off the leak site.
How Akira Gets In
1. VPNs without multi-factor authentication
Akira's signature entry point is the remote access VPN. Affiliates log in with valid usernames and passwords, often bought from access brokers or taken from infostealer logs, or they brute-force and password-spray VPN portals. Where multi-factor authentication is missing, a single correct password is enough.
2. Exploiting edge devices and backup software
The November 2025 advisory lists several vulnerabilities Akira affiliates have exploited, including:
- CVE-2024-40766 in SonicWall firewalls and SSL VPNs, along with stolen SonicWall credentials
- CVE-2020-3580 in Cisco ASA and Firepower Threat Defense
- CVE-2024-37085 in VMware ESXi
- CVE-2023-27532 and CVE-2024-40711 in Veeam Backup & Replication
The Veeam flaws matter because they give attackers access to backups, the one thing that would let a victim recover without paying.
3. Access brokers
Akira affiliates also buy ready-made access from initial access brokers on criminal forums. These listings describe a company's country, sector and revenue without naming it, and they usually appear before the ransomware does.
A valid VPN credential plus no MFA. Watching for your VPN and SSO logins in stealer logs and broker listings is one of the most direct ways to get ahead of Akira.
How Fast Akira Moves
Akira is known for speed. The 2025 advisory notes that in some attacks, data was exfiltrated within two hours of initial access, and researchers have documented full encryption within a few hours. That leaves very little time for a security team to notice and respond once an attacker is inside.
Inside the network, affiliates typically:
- Run discovery with built-in tools such as nltest to map domains and trusts.
- Install remote access tools such as AnyDesk or LogMeIn, and tunnel traffic with Ngrok.
- Move laterally using RDP, SSH and Impacket's wmiexec.
- Uninstall or disable endpoint detection and response (EDR) products.
- Steal credentials, in one documented case by shutting down a domain controller virtual machine, copying its disk, and extracting the Active Directory database from it.
- Exfiltrate data, then encrypt Windows systems and hypervisors.
Why Akira Targets Virtual Machines
Most businesses now run their servers as virtual machines on hypervisors such as VMware ESXi and Nutanix AHV. Encrypting the hypervisor's disk files takes down every server running on it at once: file servers, databases, email and business applications.
That is why Akira invested early in a Linux encryptor for ESXi and later expanded to Nutanix. It also explains the focus on backup servers. If both production systems and backups are encrypted, the pressure to pay is enormous.
Akira's Leak Site and Extortion
Akira runs a leak site on Tor with a distinctive retro, terminal-style design. Victims who do not pay are listed and their data is published, sometimes in large batches. In November 2024 the group posted more than 30 victims in a single day.
Negotiations happen through a Tor chat portal linked in the ransom note. Akira offers separate prices for a decryptor and for deleting stolen data, which lets it extract payments even from companies that restored their systems from backups.
Who Akira Targets
Akira focuses heavily on small and medium-sized businesses, though it has also hit large organisations. The most affected sectors include:
- Manufacturing, where downtime is costly. See dark web monitoring for manufacturing.
- Professional services such as legal, accounting and consulting firms. See dark web monitoring for professional services.
- Education, including universities. See dark web monitoring for education.
- Healthcare, financial services, IT and food production.
The United States accounts for about half of victims, with Canada, Germany, Australia and Brazil also frequently hit.
Dark Web Warning Signs Before an Akira Attack
DarkThreat monitors stealer logs, criminal forums, Telegram channels and ransomware leak sites, and alerts your team when your domains, credentials or suppliers appear. See DarkThreat plans.
How to Defend Against Akira
- Enforce MFA on every VPN and remote access path. This single step blocks Akira's most common entry method.
- Patch edge devices and backup software first. Prioritise SonicWall, Cisco ASA/FTD, VMware ESXi and Veeam, especially vulnerabilities listed in the CISA Known Exploited Vulnerabilities catalogue.
- Stop password guessing. Use long passwords of at least 15 characters and lock accounts after repeated failed logins.
- Isolate hypervisor and backup management from the general network and from domain admin accounts.
- Keep offline, immutable backups and test restoring them regularly.
- Alert on remote access tools such as AnyDesk, LogMeIn and Ngrok appearing where they are not approved.
- Monitor for leaked credentials and reset any VPN or SSO account that shows up in stealer logs.
Key Takeaways
- Akira has been active since March 2023 and had collected an estimated $244 million by late 2025.
- It remains one of the top three ransomware groups in 2026, with nearly 200 victims in Q1 alone.
- Its favourite entry point is a VPN without MFA, using stolen, bought or guessed credentials.
- It moves fast, sometimes stealing data within two hours, and targets ESXi, Nutanix and backup systems.
- Leaked VPN credentials and broker listings are early warning signs that dark web monitoring can catch.
Frequently Asked Questions
Is Akira connected to Conti?
Researchers cited by the US Department of Health and Human Services have pointed to overlaps in tactics, encryption and ransom payment addresses, suggesting former Conti members may be involved. It is not officially confirmed.
Is there a free Akira decryptor?
A decryptor was released for an early 2023 version, but it does not work on current variants. Recovery today depends on clean, offline backups.
Does MFA stop Akira?
MFA on VPNs blocks the most common way Akira gets in, but affiliates also exploit unpatched devices and use access bought from brokers. MFA should be combined with patching, monitoring and backups.
Why does Akira target small businesses?
Smaller organisations are more likely to have VPNs without MFA, unpatched firewalls and limited security monitoring, which makes them faster and cheaper to attack.
How can dark web monitoring help against Akira?
It alerts you when your VPN or SSO credentials appear in stealer logs, when access to your network is for sale, or when a supplier or your own company is listed on Akira's leak site, giving you time to act.
Related Resources
- Qilin Ransomware: Dark Web Activity and Business Risks
- The Gentlemen Ransomware: A New Group to Watch
- Leaked VPN Credentials on the Dark Web: Monitoring and Response
- How RDP Credentials Fuel Ransomware: The Dark Web Connection
- How to Protect Your Backups from Ransomware
Sources
- SecurityWeek: Akira ransomware group made $244 million in ransom proceeds
- FBI IC3 / CISA: #StopRansomware Akira ransomware advisory update (November 2025)
- ESET WeLiveSecurity: Akira ransomware in 2026 (Portuguese)
- CybelAngel: Akira ransomware attack methods, IOCs and defence 2026
- The Register: CISA flags imminent threat as Akira starts hitting Nutanix AHV
