Analysis Summary

Akira ransomware is a sophisticated cyber threat that first emerged in March 2023 and operates under a Ransomware-as-a-Service (RaaS) model. It allows affiliates to conduct ransomware attacks by encrypting and stealing data from victim organizations. The group behind Akira is believed to have ties to the defunct Conti ransomware gang, based on overlapping techniques, infrastructure, and ransom payment patterns. Akira initially targeted Windows systems with its original C++ variant, but it quickly evolved, releasing a Linux variant in April 2023 aimed at VMware ESXi systems, followed by a Rust-based version called “Megazord” and a more advanced variant known as Akira_v2.

The ransomware has been used to target various sectors including healthcare, education, manufacturing, finance, construction, and legal services. It has been particularly active in North America, Europe, and Australia. Akira’s attack methodology involves exploiting VPN vulnerabilities—particularly those lacking multi-factor authentication—and using tools like Mimikatz, LaZagne, and Advanced IP Scanner for lateral movement and credential harvesting. Once inside a network, it exfiltrates sensitive data before encrypting files using strong encryption methods like ChaCha20 and RSA. Victims are then extorted under the threat of public data leaks unless a ransom—ranging from $200,000 to several million—is paid.

As of early 2024, Akira has affected over 250 organizations and is estimated to have earned more than $42 million in ransom payments. Notable victims include Stanford University, Nissan Australia, Tietoevry, and the Toronto Zoo. Akira’s consistent evolution and aggressive targeting make it a major concern for cybersecurity professionals, emphasizing the need for strong defenses such as multi-factor authentication, timely patching, and comprehensive incident response strategies.