Glossary term
Ransomware
Ransomware is malware that encrypts files and systems so they become unusable until a ransom is paid.
Read more
Ransomware group profile
Akira ransomware group
Also known as Storm-1567, Howling Scorpius, Punk Spider
Akira is a ransomware group active since March 2023.
- Active
In short
Akira is a ransomware group active since March 2023. A joint advisory (AA24-109A, first published April 18, 2024, revised 13 November 2025) from the FBI, CISA, Europol and agencies in France, Germany and the Netherlands says it has hit businesses and critical infrastructure in North America, Europe and Australia. As of late September 2025 it had claimed about 244.17 million US dollars in proceeds, per the advisory.
- StatusActiveas reported
- Other Names4names in public reportsStorm-1567 · Howling Scorpius · Punk Spider
- Entry Routes5ways inVPN without MFA · SonicWall flaw CVE-2024-40766 · Backup server flaws
- Defences6first steps listedKeep tested offline backups · Segment the network
Overview
Akira is a ransomware group first seen in March 2023. The joint advisory is from the FBI, CISA, the Department of Defense Cyber Crime Center, HHS, Europol’s European Cybercrime Centre, France, Germany and the Netherlands. It says Akira mainly targets small and medium businesses but has also hit larger organizations. It names a notable preference for educational institutions and for critical manufacturing, information technology, healthcare, financial services, and food and agriculture.
Scale
The advisory states that as of late September 2025, Akira had claimed approximately 244.17 million US dollars in ransomware proceeds. That is the authors’ figure and covers claimed payments.
- March 2023First activityThe advisory dates Akira attacks on businesses and critical infrastructure from March 2023.
- April 2023Linux variantA Linux version targeting VMware ESXi virtual machines appeared after an initial Windows focus.
- August 2023MegazordSome attacks began using Megazord, a Rust-based encryptor that adds a .powerranges extension.
- April 18, 2024Advisory publishedThe joint advisory AA24-109A was first released.
- 2024Megazord fadesThe authors say Megazord has likely fallen out of use since 2024.
- June 2025New targetAkira used a payload against Nutanix AHV systems in one incident.
- November 13, 2025Advisory updatedNew activity, tactics and indicators were added.
What makes it distinct
Akira goes after the systems that run other computers. It started on Windows, added a Linux version for VMware ESXi in April 2023, and in June 2025 used a payload against Nutanix AHV, which the advisory calls the first time it encrypted that platform’s disk files. Early versions were written in C++. A second variant, Akira_v2, targets ESXi.
It often enters through a virtual private network (VPN) that has no multifactor authentication (MFA), using known flaws or stolen logins. It then creates new accounts, including an administrator account called itadm, and uses common tools to steal passwords, scan the network and copy data out.
Extortion style
Akira does not leave a ransom amount on victim networks. It waits until the victim makes contact. Before encrypting, it deletes Windows shadow copies, which are the built-in restore points.
- Also known as
- Storm-1567, Howling Scorpius, Punk Spider, Gold Sahara
- First activity
- March 2023
- Main advisory
- AA24-109A, April 18, 2024, revised 13 November 2025
- Claimed proceeds
- About 244.17 million USD by late September 2025
- Platforms hit
- Windows, VMware ESXi, Hyper-V, Nutanix AHV
- Payment
- Bitcoin
Also known as
- Storm-1567
- Howling Scorpius
- Punk Spider
- Gold Sahara
How they get in
-
01
VPN without MFA
The FBI observed access through VPN services with no multifactor authentication, mostly using known flaws including CVE-2020-3259, CVE-2023-20269, CVE-2020-3580, CVE-2023-28252 and CVE-2024-37085.
-
02
SonicWall flaw CVE-2024-40766
The 2025 update says Akira likely abused this access control flaw for initial access, and steals VPN logins for SonicWall products.
-
03
Backup server flaws
After tunnelling through a router over SSH, actors exploit unpatched Veeam Backup and Replication servers (CVE-2023-27532 and CVE-2024-40711).
-
04
Credentials and phishing
Spearphishing, valid accounts, brute force and password spraying, and possibly access bought from initial access brokers.
-
05
Exposed remote services
External-facing services such as Remote Desktop Protocol (RDP).
How they extort
Double extortion, per the advisory: data is stolen first, then systems are encrypted and victims are threatened with a leak. The ransom note gives a unique code and a Tor address. No demand is left on the network. Payment is requested in Bitcoin.
Who they target
-
01
Education
See the industry page -
02
Manufacturing
See the industry page -
03
Technology and IT
See the industry page -
04
Healthcare
See the industry page -
05
Financial services
See the industry page
Vulnerabilities they exploit
How to defend
-
Patch known exploited flaws first
Prioritize internet-facing systems, including VPNs, firewalls and backup servers.
-
Require MFA everywhere it can be
Especially for webmail, VPNs and accounts that reach critical systems. Prefer phishing-resistant MFA.
-
Keep tested offline backups
Keep copies offline and test restores, and have a recovery plan with copies in a separate, secure place.
-
Segment the network
Limit lateral movement so one stolen account cannot reach everything.
-
Monitor for abnormal activity
Use network monitoring and watch for new admin accounts, remote access tools and mass file copying.
-
Use long passwords and lockouts
At least 15 characters, no reuse, lock accounts after repeated failures.
Questions
What is Akira ransomware?
Akira is a ransomware group first seen in March 2023. A joint advisory (AA24-109A) says it mainly targets small and medium businesses but has also hit larger organizations, with a notable preference for educational institutions and critical manufacturing.
How does Akira get into networks?
The FBI observed access through VPN services with no multifactor authentication, mostly using known flaws. The 2025 update says Akira likely abused a SonicWall flaw (CVE-2024-40766). Other routes include spearphishing, stolen accounts and exposed remote services such as RDP.
Which systems does Akira encrypt?
Akira started on Windows, added a Linux version for VMware ESXi in April 2023, and in June 2025 used a payload against Nutanix AHV, which the advisory calls the first time it encrypted that platform's disk files.
How can I defend against Akira?
The page lists patching known exploited flaws first, especially on VPNs, firewalls and backup servers. It also advises MFA everywhere possible, tested offline backups, network segmentation, monitoring for new admin accounts and long passwords with lockouts.
Sources
- #StopRansomware: Akira Ransomware (AA24-109A) CISA, FBI, DC3, HHS, Europol EC3 and partners
- Akira, Software S1129 MITRE ATT&CK
Browse the threat library
- APT groups State-backed hacking groups, who they go after and how they get in. 49 profiles
- Countries The sectors, groups and national bodies that matter in each country. 32 profiles
- Ransomware groups How each group gets in, how it extorts and what stops it. 24 profiles
- Malware and tools Malware families and abused tools, what they do and how to spot them. 46 profiles
- Techniques Attack techniques in plain words, mapped to MITRE ATT&CK. 36 profiles
- Vulnerabilities Flaws attackers use in real attacks and what to do about them. 44 profiles
- Significant Cyber Incidents Significant incidents since October 2024, with a dated timeline, sources and lessons. 103 profiles
Stay Ahead of
Digital Threats
Take control of your digital security with an exclusive demo of our AI-driven threat intelligence platform.