Akira
Also known as: GOLD SAHARA, PUNK SPIDER, Howling Scorpius
Akira commonly gets in through VPNs that lack MFA, often by exploiting known VPN vulnerabilities or using stolen credentials, then steals data and encrypts Windows systems and VMware ESXi hypervisors. CISA's 2025 update reported about $244 million in ransom proceeds as of late September 2025.
- Public attribution
- A ransomware operation (MITRE ATT&CK); technical analysis cited by MITRE notes multiple overlaps with Conti ransomware.
- Active since
- Around 2023
- Targets
- Businesses and critical infrastructure in North America, Europe and Australia
- Manufacturing, education, IT, healthcare, finance and agriculture
Notable campaigns
2023Emergence
Active since March 2023; a Linux variant targeting VMware ESXi followed, and a Rust-based Megazord encryptor from August 2023.
2024, updated 2025CISA and FBI advisory
AA24-109A described VPN access without MFA as a common entry point; the November 2025 update added Nutanix AHV targeting.
Signature ATT&CK techniques
- T1133External Remote Services
- T1078Valid Accounts
- T1558Steal or Forge Kerberos Tickets
- T1219Remote Access Tools
- T1567.002Exfiltration Over Web Service: Exfiltration to Cloud Storage
- T1531Account Access Removal
- T1486Data Encrypted for Impact
Selected from the group's MITRE ATT&CK entry, plus initial-access techniques named in the cited advisories.
Defences that work against this actor
- Enforce phishing-resistant MFA on every VPN and remote access path, and patch VPN appliances promptly.
- Disable or rotate accounts of former staff and vendors; unused VPN accounts are a common way in.
- Isolate hypervisor management and back up virtual machines offline.
- Alert on uploads to cloud storage services from servers.