akira

Akira is a ransomware group first observed in March 2023, targeting both Windows and Linux environments, with a particular focus on corporate networks and VMware ESXi servers. The group employs a double extortion model, stealing sensitive data before encrypting systems and threatening to leak it on a Tor-based leak site if ransom demands are not met. Akira typically gains initial access through exploitation of unpatched VPN services, compromised RDP credentials, phishing, or abuse of legitimate remote administration tools. Its Windows variant uses the Windows CryptoAPI to encrypt files, appending the “.akira” extension while skipping critical system folders to maintain system stability. Ransom demands have ranged from $200,000 to over $4 million, typically requested in Bitcoin, and the group has been linked to high-profile incidents affecting education, manufacturing, and healthcare sectors. Akira appears to operate independently rather than as a Ransomware-as-a-Service, and continues to evolve, with recent variants improving encryption speed and evasion techniques.

11claims, 7 days
36claims, 30 days
104claims, 90 days
2026-04-01first seen
2026-11-04last seen

These are claims posted by the group on its leak site, counted when we first see them. They are not confirmed incidents, and we never name a victim.

Activity, last 26 weeks

New leak-site claims per week.

Claims per week, oldest to newest. Each bar is a full Monday-to-Sunday week; the newest bar is the current week so far.

In the news

Recent stories in the security press that name akira, newest first.

Akira Affiliate Crashes Ransomware After Attempting EDR Evasion
Infosecurity MagazineAug 13, 2026

Headlines are shown as the publisher wrote them and link to the original story. They are third-party reporting, not SecuritySnares findings. How stories are picked

Sectors claimed, last 90 days

Countries claimed, last 90 days

United States 56
Unknown 17
Germany 7
United Kingdom 6
Brazil 3
Canada 3
Switzerland 2
United Arab Emirates 1
Spain 1
Ireland 1
Italy 1
South Korea 1
Mexico 1
Netherlands 1
Norway 1

Vulnerabilities akira exploits

CVEs attributed to akira by Ransomware.live, most severe first. Patch these first if this group is in your threat model.

CVE	Vendor / product	CVSS	CISA KEV
CVE-2024-40766	SonicWall SonicOS SSL-VPN	9.8 Critical	Listed 2024-09-09, ransomware use
CVE-2024-40711	Veeam Backup & Replication	9.8 Critical	Listed 2024-10-17, ransomware use
CVE-2023-48788	Fortinet FortiClient	9.8 Critical	Listed 2024-03-25, ransomware use
CVE-2022-40684	Fortinet FortiOS	9.8 Critical	Listed 2022-10-11, ransomware use
CVE-2021-21972	VMware vSphere Client	9.8 Critical	Listed 2021-11-03, ransomware use
CVE-2023-27532	Veeam Backup & Replication	7.5 High	Listed 2023-08-22, ransomware use
CVE-2020-3259	Cisco ASA & FTD	7.5 High	Listed 2024-02-15, ransomware use
CVE-2024-37085	VMware ESXi	6.8 Medium	Listed 2024-07-30, ransomware use
CVE-2019-6693	Fortinet FortiOS	6.5 Medium	Listed 2025-06-25, ransomware use
CVE-2023-20269	Cisco ASA & FTD	5.0 Medium	Listed 2023-09-13, ransomware use
CVE-2023-20263	Cisco ASA & FTD	4.7 Medium	Not listed

70% of successful ransomware attacks use remote encryption (Microsoft, 2024): files on protected servers are encrypted over the network from a device the attacker controls. Read our remote encryption briefing →

Newest vulnerabilities used by any ransomware group (CISA KEV)

Added	CVE	Vendor / product	Vulnerability
2026-08-18	CVE-2026-59310	Broadcom VMware vCenter	Broadcom VMware vCenter Path Traversal Vulnerability
2026-08-05	CVE-2026-63077	JetBrains TeamCity	JetBrains TeamCity Deserialization of Untrusted Data Vulnerability
2026-07-29	CVE-2026-20316	Cisco Secure Firewall Management Center (FMC)	Cisco Secure Firewall Management Center Use of Hard-coded Password Vulnerability
2026-07-14	CVE-2026-15410	SonicWall SMA1000 Appliances	SonicWall SMA1000 Appliances Code Injection Vulnerability
2026-07-14	CVE-2026-15409	SonicWall SMA1000 Appliances	SonicWall SMA1000 Appliances Server-Side Request Forgery Vulnerability
2026-07-01	CVE-2026-45659	Microsoft SharePoint Server	Microsoft SharePoint Server Deserialization of Untrusted Data Vulnerability
2026-06-25	CVE-2026-12569	PTC Windchill and FlexPLM	PTC Windchill and FlexPLM Improper Input Validation Vulnerability
2026-06-12	CVE-2026-35273	Oracle PeopleSoft Enterprise PeopleTools	Oracle PeopleSoft Enterprise PeopleTools Missing Authentication for Critical Function Vulnerability

Tactics and techniques

MITRE ATT&CK techniques reported for akira by Ransomware.live, in attack order.

Initial Access

Execution

Persistence

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Defense Impairment

Disable or Modify Tools

Stealth

Ransom demands

Opening demands in 61 leaked negotiation chats from 2023–2026.

$100k–$10Mrange
$400kmedian opening demand
61chats
2023–2026years

In the 40 chats that record a lowest offer, the demand typically came down to about 42% of the opening demand.

From 193 leaked negotiation chats (Ransomchats, MIT license). Leaked and contributed chats are not a representative sample: a few groups and years dominate, and big cases are over-represented. Amounts are the group's first stated total demand in US dollars. 11 of these demands were made in bitcoin and are converted at the bitcoin price on the day of the chat. Crypto demands from chats with no known date are not included. How these figures are extracted.

Data sources: CISA KEV, Ransomchats, RansomLook, Ransomware.live, security news outlets · updated 12 hours ago

Sector, country and ransom-demand figures are SecuritySnares estimates made with a language model. Leak-site listings are claims by threat actors and are not independently verified; leak-site victims are never named unless they have disclosed the incident themselves. News headlines are the publishers' own reporting, shown as written and linked to the original. Methodology