Article
Akira ransomware advisory AA24-109A: stages and tools
CISA and partners say Akira enters through VPNs without MFA and known CVEs, steals data, then encrypts. A read of advisory AA24-109A, updated Nov…
Read more
Malware profile
Akira
Also known as Akira_v2
Akira is ransomware that locks files on a victim network and is used to demand payment.
In short
Akira is ransomware that locks files on a victim network and is used to demand payment. CISA and its partners describe an operation that also steals data first and threatens to publish it. Versions exist for Windows and for VMware ESXi virtual machines.
- Names4names in public reportsAkira · Megazord · Akira_v2
- Techniques10ATT&CK techniques listedExecution · Discovery · Impact
- Infection Steps5in the delivery chainGetting in · Settling in
In one minute
- What it is
- Ransomware that encrypts files and is paired with data theft and a ransom demand.
- What it does
- Locks files, deletes Windows shadow copies so they cannot be restored, and threatens to publish stolen data unless the victim pays.
- Who uses it
- MITRE links it to the ransomware group Akira. CISA, the FBI, Europol and other partners, in advisory AA24-109A, call the people behind it Akira threat actors and say they may have connections to the defunct Conti group.
- How it gets in
- Mostly a VPN without multifactor authentication or a known vulnerability in an internet-facing product, as described by CISA and its partners.
- What to do first
- Turn on multifactor authentication for VPNs and patch known exploited vulnerabilities on internet-facing systems, as CISA advises.
What it does
Early Akira versions were written in C++ and added the .akira extension to locked files. From August 2023 some attacks used Megazord, a Rust-based encryptor that adds .powerranges. CISA says in its November 2025 update that Megazord has likely fallen out of use since 2024.
The ransom note gives each victim a unique code and a .onion address. CISA says the actors leave no payment demand on the network and wait for the victim to make contact. The advisory says payment is requested in Bitcoin.
Names
Public sources use several names for this malware.
| Name | Where it appears |
|---|---|
| Akira | MITRE ATT&CK software S1129 and CISA advisory AA24-109A[1, 2] |
| Megazord | Rust-based encryptor named in MITRE S1129 and AA24-109A[1, 2] |
| Akira_v2 | Variant for VMware ESXi named in MITRE S1129 and AA24-109A[1, 2] |
| w.exe | Name of the Akira encryptor file in AA24-109A[2] |
What it can do
What MITRE ATT&CK lists this malware as doing, by tactic. Each id opens our technique page where one exists, otherwise MITRE.
Execution
Command and Scripting Interpreter: PowerShell T1059.001
It runs PowerShell commands to delete the system's volume shadow copies.[1, 3]
Command and Scripting Interpreter: Windows Command Shell T1059.003
It starts from the Windows command line and accepts different arguments.[1]
Windows Management Instrumentation T1047
It uses COM objects reached through WMI while running, to avoid detection.[1]
Native API T1106
It calls built-in Windows functions such as GetFileAttributesW and GetSystemInfo.[1]
Discovery
File and Directory Discovery T1083
It checks files before encryption to see whether they meet the conditions to be encrypted.[1]
Network Share Discovery T1135
It can find remote file shares so they can be encrypted as well.[1]
Process Discovery T1057
It checks that the shadow copy deletion worked by looking for the related process ID.[1]
System Information Discovery T1082
It asks Windows how many processors the machine has.[1]
How it spreads
CISA and its partners say Akira actors often get in through a VPN service that has no multifactor authentication, using known vulnerabilities in internet-facing products. Other routes are spearphishing, valid or stolen credentials, and remote services such as RDP. The November 2025 update adds brute-forcing of VPN logins and password spraying, and says that in some incidents the actors got in through an exposed SSH service on a router. After entry the actors steal data and then run the encryptor on the network.
How an infection runs
The order of steps in a typical infection, as the sources describe it.
Getting in
The actors enter through a VPN without multifactor authentication, a known vulnerability, phishing, valid credentials or an exposed remote service.[2]
Settling in
Once inside, they try to create new domain accounts to stay on the network, and they scrape stored credentials.[2]
Switching off defenses
As they prepare to move sideways, they commonly disable security software.[2]
Stealing data
They copy data out to servers they control before any encryption starts.[2, 3]
Encrypting and demanding payment
They encrypt systems after the data theft, delete shadow copies and leave a ransom note with a unique code and a .onion address.[2, 3]
Timeline
- March 2023
Activity begins
CISA says Akira ransomware has affected businesses and critical infrastructure in North America, Europe and Australia since March 2023.[2]
- April 2023
Linux variant for ESXi
After an initial focus on Windows, the actors deployed a Linux variant aimed at VMware ESXi virtual machines.[2]
- August 2023
Megazord appears
Some attacks began deploying Megazord, a Rust-based encryptor that adds the .powerranges extension.[2]
- 18 April 2024
- 2024
Megazord falls out of use
The November 2025 update says Megazord has likely fallen out of use since 2024.[2]
- June 2025
First Nutanix AHV case
The advisory describes a June 2025 incident in which the actors used payloads aimed at Nutanix AHV systems.[2]
- Late September 2025
Proceeds figure
CISA says Akira had claimed about $244.17 million in ransom proceeds as of late September 2025.[2]
- 13 November 2025
Detection and defense
Questions
What is Akira ransomware?
Ransomware first described by MITRE as written in C++ and linked to a ransomware group of the same name. CISA says it has affected organizations in North America, Europe and Australia since March 2023.
How does Akira get into networks?
CISA and its partners say mostly through a VPN without multifactor authentication and known vulnerabilities in internet-facing products. They also list phishing, valid credentials and exposed remote services.
Does Akira only affect Windows?
No. MITRE lists Windows only for this software page, but CISA says a Linux variant aimed at VMware ESXi has been used since April 2023, and describes a June 2025 incident involving Nutanix AHV. Sources differ on the platform list.
How much money has Akira claimed?
CISA reported about $42 million as of 1 January 2024 and about $244.17 million as of late September 2025.
Does Akira steal data as well?
Yes. CISA says the actors use a double-extortion model, stealing data and then encrypting systems, and may threaten to publish the data on the Tor network.
In our research
- Akira ransomware advisory AA24-109A: stages and tools October 2026
- CISA Warns of Active Exploitation in SonicWall, Linux Kernel, and ImageMagick Vulnerabilities September 2024
- What Should You Know About Ransomware September 2022
- Ransomware Response Playbook and Checklist (Free DOCX) 101 guide
- Double extortion Glossary term
Sources
- Akira, Software S1129 MITRE ATT&CKSupports: Description, platform, techniques and variants listed for Akira.
- CISA and Partners Release Advisory on Akira Ransomware CISASupports: Release date of 18 April 2024 and who released it.
- CISA and Partners Release Advisory Update on Akira Ransomware CISASupports: Release of the update on 13 November 2025.
- CISA, FBI and Partners Unveil Critical Guidance to Protect Against Akira Ransomware Threat CISASupports: Press release of 13 November 2025 on targeted sectors and first steps.
- Akira, Group G1024 MITRE ATT&CKSupports: Group active since at least March 2023, with overlaps with Conti.
Browse the threat library
- APT groups State-backed hacking groups, who they go after and how they get in. 49 profiles
- Countries The sectors, groups and national bodies that matter in each country. 32 profiles
- Ransomware groups How each group gets in, how it extorts and what stops it. 24 profiles
- Malware and tools Malware families and abused tools, what they do and how to spot them. 46 profiles
- Techniques Attack techniques in plain words, mapped to MITRE ATT&CK. 36 profiles
- Vulnerabilities Flaws attackers use in real attacks and what to do about them. 44 profiles
- Significant Cyber Incidents Significant incidents since October 2024, with a dated timeline, sources and lessons. 103 profiles
Stay Ahead of
Digital Threats
Take control of your digital security with an exclusive demo of our AI-driven threat intelligence platform.