Akira
Also known as: Akira_v2
Akira is a ransomware family first seen in 2023 that targets Windows systems and, through a separate variant, Linux and VMware ESXi hosts. The joint #StopRansomware advisory on Akira describes frequent initial access through VPNs that lacked multi-factor authentication.
- Public attribution and associated actors
- MITRE ATT&CK lists the Akira software as used by the Akira group.As publicly reported:Akira
- First seen
- Around 2023
- Platforms
- Windows, Linux, VMware ESXi
- MITRE ATT&CK software entries
- S1129 AkiraS1194 Akira _v2
How it spreads or gets in
- Initial access through VPN services without MFA, often exploiting known VPN vulnerabilities, and through valid stolen credentials (CISA AA24-109A).
Key behaviours
- Stole data before encryption for double extortion.
- Used PowerShell and WMI during the intrusion.
- Encrypted network shares and deleted shadow copies.
ATT&CK techniques
- T1133External Remote Services
- T1078Valid Accounts
- T1047Windows Management Instrumentation
- T1059.001Command and Scripting Interpreter: PowerShell
- T1135Network Share Discovery
- T1486Data Encrypted for Impact
- T1490Inhibit System Recovery
Selected from the family's MITRE ATT&CK software entry, plus initial-access techniques named in the cited advisories.
Detection ideas
- Alert on VPN logons from new locations or devices, especially for dormant accounts.
- Detect shadow-copy deletion via WMI or PowerShell.
- Monitor hypervisor hosts for unexpected SSH access.
Defences that work
- Require phishing-resistant MFA on every VPN and remote access service.
- Patch VPN appliances promptly; they are a favoured entry point.
- Disable unused and dormant accounts.
- Keep offline, tested backups, including VM images.