CISA, the FBI and partner agencies describe Akira as a ransomware actor that gets in through VPNs without multifactor authentication or through known vulnerabilities, steals data, then encrypts systems and threatens to leak the data. This note reads advisory AA24-109A, first published April 18, 2024 and updated November 13, 2025, and reports only what that text says.
Who published the advisory and when?
The advisory is titled “#StopRansomware: Akira Ransomware”. It says it was originally published April 18, 2024 and updated Nov. 13, 2025. The update was released by the FBI, CISA, the Department of Defense Cyber Crime Center (DC3) and the Department of Health and Human Services (HHS). Partners are Europol’s European Cybercrime Centre, France’s OFAC, two German authorities in Baden-Württemberg, and the Netherlands’ NCSC-NL.
The advisory states that its information comes from FBI investigations and trusted third-party reporting. We did not check it against other sources. Method: we read the full advisory text and kept its wording, its MITRE ATT&CK ids and its dates.
- April 18, 2024Initial versionThe advisory is first published.
- November 13, 2025Updated versionAdds recent TTPs and IOCs, labeled “Update Nov. 13, 2025”.
How does the advisory say Akira works, stage by stage?
The advisory lays out the activity in stages and gives a MITRE id for most steps. The flow below follows its own ids.
- Initial accessVPN without MFA, or a known CVETechnique T1190 (MITRE ATT&CK, opens in a new tab)
- PersistenceNew domain accounts, including one named itadmTechnique T1136.002 (MITRE ATT&CK, opens in a new tab)
- Credential accessCredentials taken from LSASS memoryTechnique T1003.001 (MITRE ATT&CK, opens in a new tab)
- DiscoveryNetwork scanners and domain trust queriesTechnique T1482 (MITRE ATT&CK, opens in a new tab)
- ExfiltrationData sent out with file transfer toolsTechnique T1048 (MITRE ATT&CK, opens in a new tab)
- ImpactDouble extortion and encryptionTechnique T1486 (MITRE ATT&CK, opens in a new tab)
The advisory also lists spearphishing (T1566.001, T1566.002), valid credentials (T1078) and external remote services such as RDP (T1133) as initial access routes. For execution it names Visual Basic scripts (T1059.005).
What are the entry points?
The advisory says FBI and cybersecurity researchers observed initial access “through a virtual private network (VPN) service without multifactor authentication (MFA) configured”, mostly using known CVEs (T1190). It lists these:
- CVE-2020-3259, CVE-2023-20269, and, in the update, CVE-2020-3580, CVE-2023-28252 and CVE-2024-37085.
- CVE-2023-27532, CVE-2024-40711 and CVE-2024-40766, described as exploits the authoring organizations observed for initial access.
The advisory says Akira actors “likely abused” CVE-2024-40766, a SonicWall vulnerability. It also says they gain VPN access by stealing login credentials, and possibly by using initial access brokers or brute-forcing VPN endpoints (T1110). It names password spraying with SharpDomainSpray (T1110.003).
In other cases the advisory says indicators suggest access through SSH by exploiting a router’s IP address (T1021.004). After tunneling through the router, actors exploited the Veeam Backup and Replication component of unpatched servers (T1068, CVE-2023-27532 and CVE-2024-40711). For a wider view of which exploited CVEs carry a ransomware flag, see our KEV ransomware analysis. For another CISA advisory on a different actor, see our Volt Typhoon advisory note. The technique behind most of these entries is exploiting a public-facing application.
Which tools does the advisory name?
The advisory has a table of “publicly available tools and applications”, and warns that they “should not be attributed as malicious without analytical evidence”. Among those named:
- Credentials: Mimikatz and LaZagne (T1003). The advisory also mentions Kerberoasting and LSASS memory (T1003.001).
- Discovery: SoftPerfect, Advanced IP Scanner and NetScan (T1016, T1046), plus AdFind (T1087.002). It cites nltest commands for domain controllers and trusts (T1018, T1482).
- Remote access and movement: AnyDesk, LogMeIn, MobaXterm, RDP (T1021.001) and SSH. Ngrok is named for tunnels (T1572). Impacket is named for the remote command wmiexec.py.
- Data collection and exfiltration: WinRAR, FileZilla, WinSCP and RClone (T1560.001, T1048), with the cloud service Mega as a destination (T1537).
It also lists SystemBC, described as both a remote access trojan and a proxy bot (T1090, T1219).
What does it say about Linux, ESXi and other hypervisors?
The advisory says that in April 2023, “following an initial focus on Windows systems”, Akira actors deployed a Linux variant targeting VMware ESXi virtual machines. In the update, it says payloads targeted Nutanix Acropolis Hypervisor (AHV) systems in a June 2025 incident, the first observed case of Akira encrypting Nutanix AHV VM disk files.
It describes an Akira_v2 variant of the ESXi encryptor, written in Rust, that can deploy against only VMs (vmonly) and stop running VMs (stopvm). After encryption the Linux ESXi variant may add the extension akiranew or a ransom note named akiranew.txt. The advisory says Megazord, a Rust-based Windows encryptor using the .powerranges extension, “has likely fallen out of use since 2024”.
How do encryption and extortion work?
The advisory describes a double-extortion model (T1657): actors encrypt systems (T1486) and threaten to leak data. It says the encryption combines a ChaCha20 stream cipher with an RSA public-key system, and can be full or partial. On Windows, the encryptor uses PowerShell to delete Volume Shadow Copy Service copies (T1490).
The ransom note gives each company a unique code and a .onion address on Tor (T1090.003, T1573.002). The advisory says actors leave no initial demand and do not relay payment instructions until the victim makes contact. Victims pay in Bitcoin to wallet addresses the actors provide. The actors threaten to publish data on Tor and, per FBI reporting, “in some instances have called victimized companies”. The data encrypted for impact technique page covers the encryption step in general.
What figures does the advisory give?
The advisory says: “As of late September 2025, Akira ransomware has claimed approximately $244.17 million (USD) in ransomware proceeds.” It also says actors exfiltrated data “in just over two hours from initial access” in some incidents. It says Akira has impacted businesses “since March 2023” in North America, Europe and Australia. It gives no victim count in the text we read. Our profile of the actor is on the Akira page.
Limits: the advisory words the proceeds figure as claimed and approximate. It is not a count of victims, and we cannot confirm it.
What the advisory recommends
The authoring organizations list these mitigations:
- Prioritize remediating known exploited vulnerabilities, especially in internet-facing systems, and keep systems up to date.
- Require MFA for all services to the extent possible, particularly webmail, VPNs and accounts that access critical systems.
- Use passwords of at least 15 characters, avoid reuse, and set account lockouts after failed logins.
- Keep offline, encrypted and immutable backups, and test restoration regularly.
- Segment networks and monitor for lateral movement.
- Review domain controllers, servers and workstations for new or unrecognized accounts, and audit administrator accounts.
- Disable unused ports, and disable command-line and scripting activity and permissions where possible.
The advisory also asks organizations to test their security controls against the ATT&CK techniques it maps, and notes that IOCs were observed between June 2023 and August 2025 and should be vetted before blocking.
Another joint advisory read the same way: AA25-141A on GRU targeting of logistics firms.