ransomware

Akira Ransomware: Conti Lineage, VPN Exploitation, and Double Extortion at Scale

Akira ransomware, first observed in March 2023, is attributed to a financially motivated cybercrime group composed of former Conti affiliates. The group operates a ransomware-as-a-service (RaaS) model, reusing code and infrastructure from Conti, and has been responsible for...

Wes

Wes

— 12 min read
Share
Akira Ransomware: Conti Lineage, VPN Exploitation, and Double Extortion at Scale
Single-factor VPN? Enjoy Akira’s neon BOGO encryption sale.

(Have feedback? Did something resonate with you? Did something annoy you? Just hit reply! :))

Tired of writing "strategic stakeholder" reports? -- just to show your value? Trying to do it with ChatGPT yourself? Wish ChatGPT actually understood threat intelligence?

Does it take a chunks out of your day? Would you like help with the research?

This baseline report was thoughtfully researched and took 15 minutes.. It's meant to be a rough draft for you to enhance with the unique insights that make you an invaluable analyst.

We just did the initial grunt work..

Are you ready to level up your skillset? Get Started Here!

Did this help you? Forward it to a friend!

TL;DR

Key Points

    • Akira ransomware, operated by former Conti affiliates, leverages VPN vulnerabilities and credential abuse for initial access, with a focus on organizations lacking multi-factor authentication (MFA).
    • Immediate enforcement of MFA and patching of remote access infrastructure are critical to reducing risk.
    • The group employs double extortion tactics, rapid data exfiltration, and hybrid encryption (ChaCha20/RSA), targeting healthcare, manufacturing, technology, and financial sectors globally.
    • Deploy endpoint detection and response (EDR), harden credential access, and implement immutable, offline backups to mitigate impact.
    • Akira’s operational scale is increasing, with mass data leak events and evolving TTPs, including Linux/ESXi targeting and cloud exfiltration tools.
    • Continuous monitoring, DLP deployment, and regular restoration drills are essential for resilience.

Executive Summary

Akira ransomware, first observed in March 2023, is attributed to a financially motivated cybercrime group composed of former Conti affiliates. The group operates a ransomware-as-a-service (RaaS) model, reusing code and infrastructure from Conti, and has been responsible for over 250 incidents and $42 million in ransom payments as of early 2024. Akira’s primary initial access vectors include exploitation of VPN vulnerabilities (notably Cisco CVE-2020-3259, CVE-2023-20269), spear phishing, and abuse of stolen credentials, with a marked focus on organizations lacking enforced MFA.

Akira targets a broad range of sectors—most notably healthcare, manufacturing, technology, and financial services—across the US, France, Australia, UK, and Sweden. The group’s attack chain features credential dumping (Mimikatz, LaZagne), lateral movement (Kerberoasting, domain account creation), data exfiltration (FileZilla, RClone, WinSCP, WinRAR), and double extortion via Tor-based ransom notes. Hybrid encryption (ChaCha20/RSA) and deletion of shadow copies are used to maximize operational disruption and ransom leverage.

Recent campaigns have demonstrated Akira’s ability to scale, with mass data leak events (e.g., 35+ victims in a single day, November 2024) and rapid adoption of Linux/ESXi and cloud-native exfiltration techniques. The group’s TTPs align closely with those of Conti, Wizard Spider, and related post-RaaS actors, indicating ongoing affiliate dispersal and code reuse.

Recommended mitigations include immediate enforcement of MFA and patching of remote access infrastructure, deployment of EDR with behavioral analytics, hardening of credential access, and implementation of immutable, offline backups with regular restoration testing. Organizations should monitor for Akira’s exfiltration tools, conduct quarterly backup drills, and maintain continuous detection for credential dumping and lateral movement. Failure to address these vectors will likely result in increased risk of ransomware impact, data leaks, and operational disruption as Akira’s tactics continue to evolve.

Suggested Pivots

  1. What specific vulnerabilities, including ... (upgrade to see more!) ..., and how can organizations prioritize patching and detection of these vectors to prevent intrusions?

  2. How effective are current endpoint detection and response (EDR) solutions like ... (upgrade to see more!) ... in mitigating Akira ransomware attacks, considering documented Akira techniques for bypassing defenses such as disabling security processes and ... (sign up to see more!) ...?

  3. What are the operational impacts and financial consequences of Akira’s ... (upgrade to see more!) ..., and how do victim response strategies (e.g., ransom payment vs. incident reporting) influence the likelihood of data leak publication and repeat targeting?

Research & Attribution

Historical Context

Akira ransomware emerged in March 2023 as a ransomware-as-a-service (RaaS) operation known for double extortion tactics, targeting a wide range of industries globally, including healthcare, manufacturing, and technology. It is widely attributed to former affiliates of the Conti ransomware group, which disbanded in 2022. Akira has evolved from Conti affiliates, reusing ransomware variants such as Megazord and Akira_v2, and employing sophisticated intrusion techniques including exploitation of VPN vulnerabilities and credential dumping. The group has been responsible for over 250 ransomware incidents and approximately $42 million in ransom payments as of early 2024.

Timeline

  • 2022: Conti ransomware group disbands amid law enforcement pressure and internal leaks.
  • March 2023: Akira ransomware group emerges, believed to be operated by former Conti affiliates.
  • June 2023: Akira deploys Linux variants targeting VMware ESXi virtual machines.
  • August 2023: Akira targets VPNs lacking multi-factor authentication (MFA).
  • April 2024: Joint advisory issued by CISA, FBI, Europol, and NCSC-NL detailing Akira TTPs and IOCs.
  • November 2024: Akira publishes data of 35+ victims in a single day, indicating operational scale.
  • 2024–2025: Continued ransomware campaigns with double extortion and evolving tactics.

Origin

Akira ransomware is attributed to a financially motivated cybercrime group composed of former Conti affiliates. This attribution is supported by malware analysis showing code reuse (e.g., Megazord ransomware), shared infrastructure, and operational tactics consistent with Conti’s playbook. The group operates as a RaaS, recruiting affiliates to conduct intrusions and deploy ransomware variants on both Windows and Linux systems.

Countries Targeted

  1. United States – Primary target with the highest number of detected Akira ransomware incidents.
  2. France – Significant targeting, accounting for over 50% of detected Akira attacks in some studies.
  3. Australia – Notable attacks including the January 2023 Nissan Oceania incident.
  4. United Kingdom – Targeted in joint advisories and ransomware campaigns.
  5. Sweden – Victims include cloud providers and service companies.

Sectors Targeted

  1. Healthcare – Frequent target due to sensitive data and critical operations.
  2. Manufacturing – Targeted for operational disruption and ransom potential.
  3. Technology – Attacks on tech firms to leverage intellectual property.
  4. Financial Services – Targeted for financial gain and data theft.
  5. Government – Targeted for disruption and potential espionage.

Motivation & Attack Types

Akira ransomware actors are financially motivated, employing a double extortion model that encrypts data and threatens to leak stolen information to maximize ransom payments. The group’s motivation aligns with that of former Conti affiliates, focusing on monetary gain through ransomware and data extortion.

  • Initial access via exploitation of VPN vulnerabilities (e.g., Cisco CVE-2020-3259, CVE-2023-20269), spear phishing, RDP abuse, and stolen credentials.
  • Deployment of ransomware variants including Megazord and Akira_v2 targeting Windows and Linux systems.
  • Use of credential dumping tools such as Mimikatz and LaZagne.
  • Lateral movement and privilege escalation through domain account creation and Kerberoasting.
  • Data exfiltration using tools like FileZilla, RClone, WinSCP, and WinRAR.
  • Double extortion with ransom notes delivered via Tor onion sites.
  • Encryption using hybrid ChaCha20 and RSA schemes.
  • Deletion of volume shadow copies to inhibit recovery.

Known Aliases

  1. Akira Ransomware (Google GTI, CISA, Fortinet)
  2. GOLD SAHARA (Secureworks)
  3. PUNK SPIDER (Fortinet)
  4. Conti (Google GTI / General Industry)
  5. Wizard Spider (Google GTI)
  6. TrickBot (Google GTI)
  7. Diavol (CrowdStrike, Trend Micro)

Akira is linked to former Conti affiliates, part of the broader Wizard Spider cybercrime ecosystem. Shared tooling, infrastructure, and personnel overlap with Conti and related groups such as Diavol and TrickBot have been documented.

Similar Threat Actor Groups

  • Conti affiliates who rebranded or joined other ransomware operations such as Diavol.
  • Other post-RaaS groups like REvil and BlackMatter, showing similar affiliate dispersal and code reuse.
  • FIN12, another financially motivated group with ties to Conti affiliates.

Breaches Involving This Threat Actor

  • October 2023: Stanford University data breach claimed by Akira.
  • January 2024: Cloud provider Tietoevry attacked by Akira, affecting multiple Swedish companies.
  • March 2024: Nissan Oceania ransomware attack attributed to Akira.
  • November 2024: Akira published data of 35+ victims in a single day.

Recommendations, Actions, Suggested Pivots, Forecasts and Next Steps

(Subscribers Only)

Recommendations, Actions, and Next Steps

  1. Enforce Multi-Factor Authentication (MFA) and Patch VPN Vulnerabilities Immediately

    • Mandate MFA for all remote access, especially VPNs, and prioritize patching known exploited vulnerabilities (e.g., Cisco CVE-2020-3259, CVE-2023-20269). Conduct regular vulnerability assessments and ensure VPN appliances and remote access infrastructure are up to date.
    • Recent Akira campaigns have shown increased targeting of organizations lacking MFA, as highlighted in the April 2024 CISA advisory. This directly addresses Akira’s primary initial access vectors and significantly reduces the risk of unauthorized entry and credential abuse.
    • Challenges include user resistance to MFA adoption, legacy system compatibility, and the need for continuous patch management.
    • Metrics for success: 100% MFA coverage for remote access, zero unpatched critical VPN vulnerabilities, and regular audit logs showing no unauthorized VPN access attempts.
    • MITRE ATT&CK IDs: T1078 (Valid Accounts), T1133 (External Remote Services), T1190 (Exploit Public-Facing Application).

  2. Deploy EDR and Harden Lateral Movement and Credential Access Defenses

    • Implement endpoint detection and response (EDR) solutions with behavioral analytics to detect credential dumping (e.g., Mimikatz, LaZagne) and lateral movement (e.g., Kerberoasting, domain account creation). Enforce least privilege access, monitor for abnormal account activity, and restrict use of administrative credentials.
    • CISA and CybelAngel document Akira’s use of credential dumping and privilege escalation tools, as well as lateral movement via domain account creation. EDR solutions and access controls directly mitigate these TTPs.
    • Considerations include EDR deployment costs, tuning for false positives, and ongoing staff training for incident response.
    • Metrics for success: Reduction in successful lateral movement attempts, detection of credential dumping tools, and regular review of privileged account usage.
    • MITRE ATT&CK IDs: T1003 (OS Credential Dumping), T1558 (Steal or Forge Kerberos Tickets), T1078 (Valid Accounts).

  3. Strengthen Data Backup, Recovery, and Exfiltration Monitoring

    • Implement immutable, offline backups with regular testing of restoration procedures. Monitor for large-scale data exfiltration using DLP (Data Loss Prevention) tools and network traffic analysis, focusing on tools Akira actors use (e.g., FileZilla, RClone, WinSCP, WinRAR, as documented in CISA and FortiGuard advisories). Ensure shadow copies are protected from unauthorized deletion.
    • This reduces the impact of double extortion by ensuring data can be restored without ransom payment and enables early detection of exfiltration attempts.
    • Challenges include backup infrastructure costs, ensuring backup integrity, and tuning DLP systems to minimize false positives.
    • Metrics for success: Successful backup restoration drills, detection of unauthorized data transfer attempts, and no loss of critical data during simulated incidents.
    • MITRE ATT&CK IDs: T1486 (Data Encrypted for Impact), T1041 (Exfiltration Over C2 Channel), T1070.004 (Indicator Removal on Host: File Deletion).

Suggested Pivots

  1. What specific vulnerabilities, including recent CVEs such as CVE-2020-3259, CVE-2023-20269, CVE-2024-40766, and CVE-2024-37085, are currently exploited by Akira ransomware affiliates for initial access, and how can organizations prioritize patching and detection of these vectors to prevent intrusions?

  2. How effective are current endpoint detection and response (EDR) solutions like FortiEDR and multi-factor authentication (MFA) in mitigating Akira ransomware attacks, considering documented Akira techniques for bypassing defenses such as disabling security processes and using stolen credentials?

  3. What are the operational impacts and financial consequences of Akira’s double extortion model on targeted sectors such as healthcare, manufacturing, and technology, and how do victim response strategies (e.g., ransom payment vs. incident reporting) influence the likelihood of data leak publication and repeat targeting?

Forecasts

Short-Term Forecast (3-6 months)

Akira ransomware campaigns will continue exploiting unpatched VPN vulnerabilities and weak remote access controls, particularly targeting organizations without enforced multi-factor authentication (MFA). The group will persist in using double extortion tactics, hybrid encryption (ChaCha20 and RSA), and rapid data exfiltration with tools such as RClone, FileZilla, and WinSCP. Healthcare, manufacturing, technology, and financial sectors in the United States, France, Australia, and the UK will remain primary targets. The frequency of large-scale data leak publications, such as the November 2024 event with over 35 victims, is expected to rise as Akira affiliates expand operations. Organizations that fail to patch known exploited vulnerabilities (e.g., Cisco CVE-2020-3259, CVE-2023-20269) or deploy endpoint detection and response (EDR) solutions focused on credential dumping and lateral movement detection will face increased risk.

Examples

  • The April 2024 joint advisory by CISA, FBI, Europol, and NCSC-NL detailing Akira’s exploitation of VPN vulnerabilities and credential dumping tools.
  • The January 2024 attack on Nissan Oceania and the October 2023 Stanford University breach, demonstrating Akira’s targeting of high-value sectors.
  • The November 2024 mass data leak event evidencing operational scale and double extortion tactics.
  • Cisco’s September 2023 advisory on exploitation of CVE-2023-20269 by Akira actors targeting VPNs without MFA.
  • CybelAngel’s 2025 playbook highlighting Akira’s rapid data exfiltration capabilities and sector targeting.

What to Watch Out For

  • Increased exploitation attempts of known VPN vulnerabilities without MFA enforcement.
  • Rising incidents of credential dumping and lateral movement within victim networks.
  • Surge in public data leak postings by Akira on Tor sites.
  • Uptick in ransomware variants targeting Linux/ESXi environments.
  • Detection of Akira’s use of tools like PowerTool to disable security software.

Long-Term Forecast (12-24 months)

Akira ransomware operators are likely to evolve their tactics by adopting more sophisticated evasion techniques, expanding their affiliate network, and diversifying targets to include additional critical infrastructure sectors such as energy and government. This forecast is supported by historical patterns observed in Conti affiliates and similar ransomware groups like REvil and BlackMatter, which have expanded their targeting and developed new ransomware variants over time. Akira may increasingly leverage cloud-native exfiltration tools and container exploitation, reflecting broader ransomware trends targeting cloud and hybrid environments. Organizations will need to adopt zero-trust architectures, continuous monitoring, and advanced threat hunting to counter these evolving threats effectively. However, this forecast is moderately speculative and should be validated continuously with emerging intelligence.

Examples

  • Akira’s evolution from Conti affiliates reusing ransomware code and infrastructure, indicating adaptability.
  • Deployment of Linux variants targeting VMware ESXi in mid-2023, showing expansion beyond Windows targets.
  • Similar evolution and diversification patterns in ransomware groups like REvil and BlackMatter.
  • Increasing ransomware targeting of cloud environments and containerized workloads documented in recent cybersecurity research.
  • CybelAngel’s 2025 analysis highlighting Akira’s use of cloud storage services for data exfiltration.

What to Watch Out For

  • Emergence of new Akira ransomware variants with enhanced encryption or stealth capabilities.
  • Expansion of Akira’s targeting to new sectors, especially critical infrastructure beyond current focus areas.
  • Increased use of cloud-native exfiltration tools and exploitation of container environments.
  • Growth in affiliate recruitment and RaaS ecosystem complexity.
  • Reports of Akira leveraging zero-trust bypass techniques or advanced evasion methods.

Appendix

References

  1. (2024-04-18) - #StopRansomware: Akira Ransomware - CISA
  2. (2025-02-03) - The 2025 Akira Ransomware Playbook - CybelAngel
  3. (2025-08-04) - Akira Ransomware - Threat Actor - FortiGuard Labs
  4. (2023-12-21) - Akira Ransomware Spotlight - Trend Micro
  5. (2025-05-06) - Akira Ransomware: Attack Trends & Defense | Qualys
  6. (2023-09-06) - Cisco Security Advisory on CVE-2023-20269 Exploitation

AlphaHunt

(Have feedback? Did something resonate with you? Did something annoy you? Just hit reply! :))

Tired of writing "strategic stakeholder" reports? -- just to show your value? Trying to do it with ChatGPT yourself? Wish ChatGPT actually understood threat intelligence?

Does it take a chunks out of your day? Would you like help with the research?

This baseline report was thoughtfully researched and took 10 minutes.. It's meant to be a rough draft for you to enhance with the unique insights that make you an invaluable analyst.

We just did the initial grunt work..

Are you ready to level up your skillset? Get Started Here!

Did this help you? Forward it to a friend!

(c) 2025 CSIRT Gadgets, LLC

MITRE ATT&CK

Techniques

  1. T1078 (Valid Accounts) – Akira actors frequently obtain and abuse valid credentials for VPNs, RDP, and domain accounts to gain initial access and move laterally within victim environments. This is a primary vector for Akira, as highlighted in CISA and FortiGuard advisories.
  2. T1133 (External Remote Services) – Akira exploits external remote services such as VPNs (including those lacking MFA) for initial access, often leveraging known vulnerabilities. This is supported by Trend Micro and CybelAngel reporting on Akira’s exploitation of VPN weaknesses.
  3. T1486 (Data Encrypted for Impact) – Akira deploys ransomware to encrypt data for impact, using hybrid encryption schemes and targeting both Windows and Linux/ESXi systems. This technique is central to Akira’s double extortion model, as documented by CISA and CybelAngel.

Tactics

  1. TA0001 (Initial Access) – Akira leverages spear phishing, VPN exploits, and stolen credentials to gain initial access, as confirmed by CISA and FortiGuard Labs.
  2. TA0006 (Credential Access) – Akira uses tools like Mimikatz and LaZagne for credential dumping to escalate privileges and facilitate lateral movement, as detailed in Trend Micro and CybelAngel reporting.
  3. TA0040 (Impact) – Akira’s primary objective is to cause impact through data encryption and double extortion, as evidenced by ransom notes and public data leaks.

Procedures

  1. T1003.001 (OS Credential Dumping: LSASS Memory) – Akira affiliates use Mimikatz to dump credentials from LSASS memory for privilege escalation and lateral movement. This is confirmed by Trend Micro and CybelAngel.
  2. T1041 (Exfiltration Over C2 Channel) – Akira exfiltrates data using tools like FileZilla, RClone, WinSCP, and WinRAR prior to encryption for double extortion. This is a key part of Akira’s operational impact, as documented by CISA and FortiGuard Labs.
  3. T1070.004 (Indicator Removal on Host: File Deletion) – Akira deletes volume shadow copies and other files to inhibit recovery and hinder forensic analysis, as reported by CISA and Trend Micro.

Software

  1. S1129 (Akira) – The primary ransomware used by the group, capable of hybrid encryption and targeting both Windows and Linux/ESXi environments. Akira’s use of hybrid encryption has led to significant operational disruption in healthcare and manufacturing.
  2. S0002 (Mimikatz) – Used for credential dumping from Windows systems, enabling privilege escalation and lateral movement.
  3. S0349 (LaZagne) – Used to extract credentials from various applications and browsers, supporting Akira’s credential access and lateral movement.

Mitigations

  1. M1032 (Multi-factor Authentication) – Enforcing MFA on all remote access points, especially VPNs, directly mitigates Akira’s primary initial access vector. CISA and FortiGuard Labs both recommend this as a top defense.
  2. M1050 (Exploit Protection) – Regularly patching and updating VPN appliances and remote access infrastructure to prevent exploitation of known vulnerabilities, as recommended by CISA and Trend Micro.
  3. M1053 (Data Backup) – Implementing immutable, offline backups and regularly testing restoration procedures to reduce the impact of ransomware, as highlighted by CybelAngel and CISA.

Groups

  1. G1024 Akira (GOLD SAHARA, PUNK SPIDER) – Akira is a ransomware group attributed to former Conti affiliates, operating as a RaaS and responsible for high-profile attacks using sophisticated TTPs, including double extortion and hybrid encryption. According to CISA and CybelAngel, there is moderate confidence in the overlap between Akira and Conti/Wizard Spider.
  2. G0102 Wizard Spider (Conti, TrickBot) – Wizard Spider is a cybercrime group linked to Conti, TrickBot, and Diavol, with significant overlap in personnel, infrastructure, and TTPs with Akira. This connection is assessed with moderate confidence based on reporting from CISA and Trend Micro.

Read more