AkiraMalware
- megazord
Akira ransomware, written in C++, is most prominently (but not exclusively) associated with the ransomware-as-a-service entity Akira. Akira ransomware has been used in attacks across North America, Europe, and Australia, with a focus on critical infrastructure sectors including manufacturing, education, and IT services.From MITRE ATT&CK
Last reported 3 days ago, by Infosecurity Magazine59 reports
ATT&CK techniques
6 of 105 · each with the sentence it comes from- T1021.001Remote Desktop Protocol
“…er 2026 Akira ransomware attack undertaken by Huntress found that "the threat actor behind the attack accessed the endpoint via Remote Desktop Protocol (RDP), disabled antivirus, and deployed Rclone for data exfiltration, before deploying the ransomware.”
- T1110Brute Force
“We observed infrastructure overlap between recent Cisco ASA scanning, Palo login attempts, and Fortinet brute force attempts:”
- T1543.003Windows Service
“Shortly after, the threat actor accessed the BitDefender console, and several Windows services associated with the antivirus application were stopped:”
- T1684Social Engineering
“Passkey-themed campaign: Microsoft has spotted a pretty complex phishing and social engineering campaign hitting corporate environments using "fix your passkey" type of lures.”
- T1036Masquerading
“Inside this image lay a shortcut (.lnk) masquerading as a PDF document.”
- T1053.005Scheduled Task
“This process established a scheduled task, deceptively named to appear like a system error to ensure persistence, and beaconed to a remote server.”
Reports per month
last 12 monthsOctober so far (hatched). Counted by report, not by story.
What the reports say
59 reports · the newest 20, newest first · the exact sentence from each-
Ransomware Attacks Rise as Rival Gangs Vie For Market Supremacy“Other groups which showed significant activity during the quarter with almost 100 ransomware attacks each include Krybit, Akira, Deadlock and Clop Leaks.”
-
⚡ Weekly Recap: Helpdesk 0-Days, Rogue Certs, ShinyHunters Arrest, AI-Fooling Malware and More“An investigation into a September 2026 Akira ransomware attack undertaken by Huntress found that "the threat actor behind the attack accessed the endpoint via Remote Desktop Protocol (RDP), disabled antivirus, and deployed Rclone for data exfiltration, before deploying the ransom…”
-
September 2026 Threat Trend Report on Ransomware“They were followed by Akira with 47 incidents, Rhysidaarchive with 45, Metaencryptor with 40, KillSecurity with 37, KryBit with 34, IncRansom with 31, SafePay with 29, and DarkProject with 27.”
-
hxxps://www.huntress.com/blog/mapping-akira-ransomware-attack“Up a Creek Without a Command Line: Mapping an Akira Ransomware Attack”
-
The First 24 Hours: What Happens When Ransomware Lands“CISA's Akira advisory records cases where exfiltration was complete two hours after the attacker got in.”
-
Risky Bulletin: Authorities dismantle KillSec group, arrest members across Europe“…o-day—CVE-2025-31161 in CrushFTP—but has been recently going under the radar, compared to more famous groups like Qilin, DragonForce, or Akira.”
-
Panorama de ciberamenazas en América Latina: balance del primer semestre de 2026“Presencia de células selectivas: Operaciones vinculadas a BlackMatter, Conti, Phobos, Akira, DragonForce y muestras residuales de LockBit o WannaCry se manifestaron mediante incidentes puntuales.”
-
August 2026 Threat Trend Report on Ransomware“Orova (43 cases of damage), DarkProject (41 incidents), Akira (40 incidents), IncRansom (39 incidents), KryBit (36 incidents), DireWolf (35 incidents), EVEREST (34 incidents), and CmdOrganization (30 incidents) followed.”
-
Network Segmentation Failures Are Expanding the Corporate Attack Surface“…eviously demonstrated how poorly segmented IP cameras could be used by ransomware gangs; something that happened in early 2025 after the Akira group used the technique to bypass EDR.”
-
Risky Bulletin: Anthropic agents went hacking again“Akira's love for SonicWall: ThreatDown researchers look at how the Akira ransomware gang has continued to exploit a 2024 SonicWall vulnerability just because people are so bad at patching.”
-
Risky Bulletin: Russia starts blocking DoH and DoT“Paylogix ransomware attack: And speaking of old ransomware attacks, employee benefits platform Paylogix has disclosed its Akira ransomware incident from last year.”
-
July 2026 Ransomware Trend Report“DragonForce and WorldLeaks each had 44 incidents, IncRansom had 41, Nova had 35, SafePay had 33, and Akira had 30.”
-
Akira Affiliate Crashes Ransomware After Attempting EDR Evasion“Akira Affiliate Crashes Ransomware After Attempting EDR Evasion”
-
AI Accounts for Over Half of Cybercrime in Africa, Says Interpol“AI-driven ransomware (eg Qilin and Akira) is targeting healthcare systems, power utilities, and educational institutions in the region”
-
Ransomware Groups Increasingly Deploy EDR Kill Techniques“The leading ransomware groups were Qilin (293 attack claims), The Gentlemen (214 attack claims, DragonForce (143 attack claims), Akira (119 attack claims) and Lockbit 5.0 (102 attack claims).”
-
Ransomware in 2026: Same Business, New Rules“Akira”
-
A New Ransomware Threat Actor Emerges Every Week, Warns Report“This period was dominated by Qilin, which claimed 1358 victims, followed by Akira (749) INC Ransom (436), Play (422) and SafePay (324).”
-
How Hastalamuerte Operates: Group-IB’s Analysis of The Gentlemen’s Attack Methods“…task. However, despite the number of groups conducting extortion attacks, the TTPs do not change much, unless we are talking about Cl0p, Akira, and other groups that pose a high risk.”
-
Active Reconnaissance Campaign Targets SonicWall Firewalls Through Commercial Proxy Infrastructure“Akira and Fog ransomware groups have repeatedly demonstrated that compromised SonicWall VPN credentials lead to full encryption in under four hours — with dwell times as short as 55 minutes.”
-
25,000 IPs Scanned Cisco ASA Devices — New Vulnerability Potentially Incoming“Ransomware: The Akira and LockBit ransomware groups have historically targeted Cisco ASA systems.”
Indicators in its reports
named in the reports above- fbijobs[.]govin 1 report
- collusion[.]wikiin 1 report
Copy these 2 indicators · defanged
Thanks — we review every report.