Akira Ransomware Group: Dark Web Data Leaks Case Study
- securedmonk
- Apr 20
- 11 min read
Executive Summary
The Akira ransomware group emerged in March 2023 and rapidly escalated into one of the most financially destructive threat actors globally. By late 2025, the group had extorted approximately $244.17 million - a 480% increase from $42 million reported in January 2024. Akira succeeds not through exotic zero-days but through identity compromise and weak exposure management: unpatched VPN appliances, absent MFA, and credential reuse. The complete attack lifecycle - from initial VPN compromise to full network encryption - has been documented in under 60 minutes in confirmed incidents.
The group operates a double extortion model: data is stolen before encryption, then victims simultaneously face paying for a decryptor and preventing public release on Akira's distinctive dark web leak site - a retro green-screen terminal that has become one of the most recognized brands in ransomware.
Metric | Value |
First Observed | March 2023 |
Cumulative Revenue (2025) | $244.17 Million |
Median Demand / Settlement | $500,000 / $150,000–$200,000 |
Max Known Demand | $4 Million |
Attack Duration | Under 60 minutes (entry to encryption) |
Primary Entry Vector | VPN exploitation - Cisco ASA, SonicWall |
Extortion Model | Double extortion - encryption + data leak |
Risk Classification | Critical - Tier-1 Global Threat Actor |
Introduction: Why This Case Study Matters
Ransomware has undergone a fundamental transformation. The original encrypt-and-demand model has been superseded by a data-centric extortion economy where the threat of publicly releasing stolen data creates pressure independent of whether backups exist.
Akira is the ideal case study: consistent leak infrastructure, clear victim profiling, documented methodology, and a distinctive dark web presence analyzed by multiple threat intelligence organizations.
The vulnerabilities Akira exploits, the infrastructure it operates, and the controls that stop it are directly applicable to any mid-to-large enterprise. This report covers the full spectrum from threat actor profile through attack lifecycle, dark web infrastructure, IOCs, and actionable prevention.
Threat Actor Profile: Who Is Akira?
Background, Conti Lineage, and Operating Model
Akira was first observed in March 2023. The group's identity draws from the 1988 Japanese anime film and their dark web site is styled as a 1980s green-screen terminal - deliberate branding that creates strong recognition in a crowded RaaS market. Technical forensic analysis has established strong genealogical links to the dissolved Conti ransomware syndicate: identical cryptographic routines, string obfuscation methods, and directory exclusion lists. Cryptocurrency forensics identified ransom payments directed to wallet addresses previously associated with Conti leadership. Akira is assessed as a direct technical and organizational Conti successor.
The group operates through a RaaS affiliate structure. Core developers maintain the codebase, payment infrastructure, negotiation portals, and leak site. Affiliates - recruited on elite Russian-speaking forums XSS and the now-seized RAMP - conduct intrusions and deploy the payload. Revenue is split, enabling global scale without requiring every attacker to be a malware developer.
Targeting Strategy and Platform Coverage
Manufacturing is consistently the most targeted sector (32%), followed by Professional Services, Education, Healthcare, Financial Services, and Technology. High-profile victims include Stanford University and Nissan Australia. The United States accounts for over 60% of publicly disclosed attacks in early 2026, with significant activity across the UK, Europe, and increasingly Asia-Pacific.
Akira maintains active encryptors for Windows, Linux, and VMware ESXi. Hypervisor targeting is strategically calculated - encrypting underlying VMDK files simultaneously disables hundreds of virtual machines. In June 2025, Akira expanded to target Nutanix Acropolis Hypervisor (AHV), signaling continued expansion beyond historical VMware focus.
Why Akira Is a High-Impact Threat in 2026
Akira's effectiveness stems from disciplined exploitation of endemic organizational weaknesses: absent MFA on VPN gateways, unpatched edge devices, credential reuse, and insufficient network segmentation. These are known, solvable problems. The group's shift to a Rust-based architecture in the Megazord and Akira_v2 variants improved encryption speed and reduced signature-based detection effectiveness. Their intermittent encryption technique - encrypting only specific file percentages - drastically reduces total encryption time while still rendering files completely unusable. Combined with sub-60-minute operational tempo, this leaves organizations an extremely narrow response window.
ⓘ Key Insight: Akira is effective because it exploits organizational weaknesses - not technical complexity. MFA, patch management, and network segmentation would prevent the majority of Akira intrusions. |
Full Attack Lifecycle (MITRE ATT&CK Mapping)
Akira attacks follow a structured, fast-tempo chain. Initial Access exploits vulnerable VPN appliances - primarily Cisco ASA (CVE-2023-20269), SonicWall SSL VPN (CVE-2024-40766), Cisco AnyConnect (CVE-2020-3259), and Veeam Backup (CVE-2023-27532) - targeting devices without MFA. Stolen credentials from dark web infostealer logs support credential stuffing against exposed services.
Execution and Persistence: PowerShell scripts, WMI, and living-off-the-land binaries (LOLBins) blend with normal activity. New administrative accounts (commonly named itadm) are created and Group Policy Objects (GPOs) modified to push payloads across all domain-joined workstations.
Privilege Escalation: Mimikatz and LaZagne perform LSASS credential dumping. The defining Akira technique is Bring Your Own Vulnerable Driver (BYOVD) - loading the legitimate but vulnerable Zemana AntiMalware driver and using PowerTool to achieve kernel-level EDR termination before encryption begins, effectively blinding defenses.
Lateral Movement: RDP and SSH abuse using harvested admin credentials, supported by AnyDesk and LogMeIn remote management tools for persistent interactive access. Active Directory domain compromise enables GPO-based mass deployment to all joined systems simultaneously.
Data Exfiltration: Rclone is the primary tool, syncing data to Mega cloud storage or attacker-controlled VPS instances. WinRAR, FileZilla, and WinSCP also observed. The traffic is indistinguishable from legitimate cloud backup operations, making automated detection extremely difficult. Financial records, client NDAs, credentials, and source code are prioritized for maximum extortion value.
Encryption Phase: Encryptors deploy simultaneously across file servers, ESXi VMDK files, and backup systems. Volume Shadow Copies are deleted via vssadmin.exe or WMI, closing Windows-based recovery paths.
MITRE Tactic | Technique ID | Technique | Akira Implementation |
Initial Access | T1133 / T1190 | External Remote Services / Exploit Public App | VPN exploitation - CVE-2023-20269, CVE-2024-40766 |
Execution | T1059 / T1047 | PowerShell / WMI | LOLBins and script-based delivery |
Persistence | T1136 / T1484 | Create Account / GPO Modification | itadm accounts + AD mass deployment |
Privilege Escalation | T1003.001 / T1543 | LSASS Dump / BYOVD | Mimikatz + Zemana driver exploit |
Lateral Movement | T1021.001 | RDP / SSH | Stolen admin credentials + RMM tools |
Exfiltration | T1048 | Exfiltration Over Web Service | Rclone to Mega / attacker VPS |
Impact | T1486 / T1490 | Data Encrypted / Inhibit Recovery | ChaCha20 + RSA-4096 + shadow copy deletion |
Technical Deep Dive: Encryption Architecture
Akira has evolved from an initial C++ codebase to a Rust-based architecture in later variants, improving encryption speed and reducing signature detection effectiveness. The encryption scheme pairs ChaCha20 stream cipher for fast file locking with RSA-4096 for key protection - chosen for performance across both Windows and Linux. Intermittent encryption encrypts only specific file percentages, reducing time while ensuring files are completely unusable.
Variant | Language | Extension | Ransom Note | Notable Features |
Original Akira | C++ | .akira | akira_readme.txt | Initial variant - Windows and Linux |
Megazord | Rust | .powerranges | powerranges.txt | Aug 2023 - improved evasion and speed |
Akira_v2 | Rust | .akiranew | akiranew.txt | Targets virtual hard disks + Exchange |
Linux/ESXi | C++/Rust | .akira | akira_readme.txt | VMware ESXi VMDK file targeting |
In early 2023 Avast identified a cryptographic flaw in the C++ variant - nonce reuse across files enabled XOR-based plaintext recovery and a public decryptor was released. Akira patched within weeks and migrated to the Rust-based Megazord variant, demonstrating the group's technical agility and institutional resilience.
Double Extortion Model
Akira's double extortion creates two simultaneous crises. The first is operational: encrypted systems halt business. The second is strategic: stolen data publication creates regulatory, legal, and reputational pressure entirely independent of backup status. Psychological mechanics are deliberate - countdown timers create urgency, data previews prove breach authenticity, and direct negotiation allows Akira to offer reduced demands for leak prevention without decryption.
In a calculated post-payment gesture, Akira provides paying victims a security checklist recommending MFA enablement, patching, and awareness training - simultaneously building perverse trust and mocking the security failures that enabled the attack. The group also offers "extortion-only" pricing for organizations that need data leak prevention but not a decryptor.
Dark Web Infrastructure and Data Leak Ecosystem
The Unique Terminal Leak Site
Akira's public data leak site is among the most distinctive in ransomware. Hosted on the Tor network, it resembles a 1980s green-screen terminal - a deliberate branding choice creating strong market recognition. Visitors interact through a command-line interface (CLI) with commands: leaks (victim listings), news (upcoming releases), contact (encrypted communication), and help (available commands).
Figure 1: Akira dark web leak site - retro green-screen terminal CLI interface. The site frames ransomware deployment as an "unscheduled forced audit," warns non-paying victims will be "shamed here publicly," and confirms Akira never targets hospitals or schools
As visible in the screenshot, the homepage directly addresses victims: it frames the attack as an "unscheduled forced audit," states victims are "unable to recover without our help," and warns those who "choose a different path will be shamed here publicly." A separate password-protected negotiation portal - accessed via a unique code from the ransom note - hosts the private chat system for victim negotiations. The infrastructure rotates .onion domains frequently to evade takedown.
Torrent-Based Data Distribution
Unlike most ransomware groups hosting stolen data on Tor directly, Akira implements torrent-based distribution via magnet links downloadable through standard clients including uTorrent, qBittorrent, and Transmission. Archives have no password, maximizing accessibility. This approach distributes hosting load and makes data removal practically impossible once published.
Figure 2: Akira leak site showing torrent distribution with magnet URLs and the contact form. Pagination shows 58 pages of victim listings at time of capture, with the contact function also serving as affiliate recruitment channel
The contact form visible in the screenshot - shown being used to ask "What if someone wants to join you?" - reveals the site's dual function as both victim extortion dashboard and affiliate recruitment channel. The 58 pages of victim listings visible at time of capture illustrates the operational scale of the group.
Leak Behavior and Data Categories
Akira employs a graduated pressure strategy: teaser samples first (demonstrating breach authenticity), followed by partial dumps if negotiations stall, then full torrent release after deadline. Financial records, client NDAs, and legal documents are prioritized for highest extortion value - they directly implicate business relationships and regulatory obligations. Once published, redistribution to Telegram channels and dark web marketplaces occurs within hours, making containment practically impossible.
Victimology: Sector and Timeline Analysis
Sector | Distribution | Share |
Manufacturing | ████████████████████████████ | 32% |
Professional Services | ████████████████░░░░░░░░░░░░ | 18% |
Education | ████████████░░░░░░░░░░░░░░░░ | 14% |
Healthcare | ██████████░░░░░░░░░░░░░░░░░░ | 11% |
Financial Services | ████████░░░░░░░░░░░░░░░░░░░░ | 9% |
Technology | ██████░░░░░░░░░░░░░░░░░░░░░░ | 7% |
Others | ████████░░░░░░░░░░░░░░░░░░░░ | 9% |
Figure 3: Akira victimology by sector - percentage of total leak site postings
Month | Victim Activity | Count |
Apr | ▮▮▮ | 8 victims |
May | ▮▮▮▮▮▮ | 14 victims |
Jun | ▮▮▮▮▮▮▮▮▮ | 22 victims |
Jul | ▮▮▮▮▮▮▮▮ | 19 victims |
Aug | ▮▮▮▮▮▮▮▮▮▮▮▮▮▮▮ | 36 victims |
Sep | ▮▮▮▮▮▮▮▮▮▮▮▮▮▮▮▮▮ | 42 victims |
Oct | ▮▮▮▮▮▮▮▮▮▮▮▮▮▮▮▮ | 38 victims |
Nov | ▮▮▮▮▮▮▮▮▮▮▮▮ | 29 victims |
Dec | ▮▮▮▮▮▮▮▮▮▮▮▮▮▮▮▮▮▮ | 45 victims |
Jan | ▮▮▮▮▮▮▮▮▮▮▮▮▮▮▮▮▮▮▮▮▮ | 52 victims |
Feb | ▮▮▮▮▮▮▮▮▮▮▮▮▮▮▮▮▮▮▮▮ | 48 victims |
Mar | ▮▮▮▮▮▮▮▮▮▮▮▮▮▮▮▮▮▮▮▮▮▮▮▮▮ | 61 victims |
Figure 4: Akira attack frequency Apr 2025 - Mar 2026. Spikes correlate with mass CVE exploitation campaigns
Manufacturing leads at 32% driven by operational technology reliance and low downtime tolerance. Healthcare and Education follow, targeted for sensitive data and underfunded security. The timeline shows a 663% increase from 8 victims in April 2025 to 61 in March 2026 - confirming rapid operational scaling.
Indicators of Compromise (IOCs)
File and Hash IOCs
Indicator | Type | Description |
akira_readme.txt / akiranew.txt / powerranges.txt | Ransom Notes | Dropped in encrypted directories - variant-specific |
.akira / .akiranew / .powerranges | File Extensions | Appended to encrypted files - original, v2, and Megazord |
3298d203c2acb68c474e5fdad8379181890b4403... | SHA-256 | Akira_v2 ransomware payload |
ffd9f58e5fe8502249c67cad0123ceeeaa6e9f69... | SHA-256 | Akira Megazord (Rust) encryptor |
aaa6041912a6ba3cf167ecdb90a434a62feaf086... | SHA-256 | Veeam credential stealer component |
5e1e3bf6999126ae4aa52146280fdb913912632e... | SHA-256 | Kerberos ticket dumper |
1d3b5c650533d13c81e325972a912e3ff8776e36... | SHA-256 | Linux/ESXi encryptor |
Network IOCs
Indicator | Type | Context |
185.181.230[.]108 | C2 IP - AS60602 | Inovare-Prim - command and control |
207.188.6[.]17 | C2 IP - AS396356 | Latitude.Sh - command and control |
107.175.102[.]58 | C2 IP - AS131199 | Nexeon Technologies - lateral movement relay |
185.174.100[.]199 | C2 IP - AS8100 | Quadranet - exfiltration staging |
137.184.243[.]69 | C2 Endpoint | Active C2 endpoint |
66.165.243[.]39 | Exfiltration IP | Data exfiltration destination |
akiral2iz6a7qgd3...bad.onion | Tor - Primary Leak Site | Akira primary data leak site |
akiralkzxzq2dsr...2id.onion | Tor - Mirror | Mirror / alternative access point |
Detection Strategies (SOC-Focused)
Effective Akira detection requires behavioral detection rather than signatures, given Rust-based payloads that evade traditional AV and extensive use of legitimate admin tools. Key SOC priorities: alert on abnormal VPN auth patterns (multiple failures then success from unusual geographies - SIEM Event IDs 4624/4625); detect BYOVD attacks through vulnerable driver loads paired with EDR process termination (EDR/XDR behavioral rule); flag LSASS memory access by non-system processes (CrowdStrike/Defender); monitor for rclone.exe outbound HTTPS to Mega endpoints (EDR + DLP); alert on vssadmin.exe shadow copy deletion (high-fidelity EDR alert); and track creation of accounts outside approved change windows especially named itadm (Event ID 4720/4728).
Prevention and Mitigation
Identity Security: MFA enforcement on all VPN, RDP, and remote access is the single highest-impact control. Akira's primary entry vector is largely negated by phishing-resistant MFA (FIDO2/hardware tokens). PAM solutions with just-in-time access reduce credential value if compromised.
Exposure Management: Patch edge devices within 24-72 hours of critical CVE publication. The CVEs Akira most exploits (CVE-2023-20269, CVE-2024-40766) had available patches before mass exploitation campaigns began. External attack surface monitoring identifies exposed services before attackers find them.
Network Segmentation: Restrict workstation-to-workstation SMB and RDP. Place domain controllers, backup servers, and hypervisors in isolated segments. This prevents Akira's GPO-based mass deployment from reaching all domain systems simultaneously.
Backup Strategy: Immutable, air-gapped backups following the 3-2-1 rule (three copies, two media types, one physically disconnected) are the definitive recovery control. Akira specifically targets backup systems - offline backups are the only reliable neutralization of this tactic. Test restoration regularly.
Endpoint Detection: Deploy EDR with behavioral detection for BYOVD attacks, LSASS access patterns, mass file renames, and Rclone execution. Signature-based AV is insufficient against Rust-based payloads.
Incident Response Playbook
Given Akira's documented sub-60-minute attack duration, response speed is critical. Execute these actions immediately:
Isolate affected systems - without powering down to preserve memory forensics
Disable compromised accounts - block VPN credentials used for initial access
Identify spread scope - review AD logs for itadm accounts, GPO changes, RDP patterns
Block exfiltration - firewall-block outbound http://Mega.nz and rclone endpoints immediately
Preserve evidence - Windows Event Logs, Sysmon logs, memory dumps, network capture
Validate backup integrity - confirm offline backups are uncorrupted before restoration
Engage legal and insurance - assess GDPR/HIPAA 72-hour breach notification obligations
Contact law enforcement - FBI IC3, CISA, or national cyber agency
Do not pay without counsel - establish decryptor vs. leak prevention priority with legal and insurer
Business and Legal Implications
A confirmed Akira attack triggers simultaneous multi-dimensional crisis. GDPR breach notification requires reporting within 72 hours for EU victims; HIPAA applies to US healthcare organizations - failure to report adds penalties independent of the breach. The total financial impact - operational disruption, IR costs, legal fees, regulatory fines, insurance deductibles, and reputational damage - collectively dwarfs the median ransom demand. Third-party liability is frequently overlooked: stolen data often includes client, supplier, and partner information, creating secondary breach obligations and potential civil exposure. Cyber insurance policies increasingly require insurer approval before any ransom payment.
Comparison with Other Groups and Future Outlook
Compared to peers: LockBit (entry via RDP/phishing, disrupted 2024), BlackCat/ALPHV (Rust, AD exploitation, disrupted 2024), and Cl0p (zero-days, mass leak drops) - Akira distinguishes itself through VPN-first entry, torrent-based leak distribution, sub-60-minute speed, and active hypervisor-focused evolution. With both LockBit and BlackCat disrupted, Akira has absorbed significant market share.
Looking ahead, Akira's expansion into Nutanix AHV signals commitment to following enterprise virtualization trends. Increased automation of CVE exploitation will compress the patch-before-exploitation window further. The RaaS affiliate model provides inherent law enforcement resilience - the Conti-to-Akira transition proved that talent and techniques survive organizational disruption. The group's $244M revenue trajectory suggests continued scaling through 2026 and beyond.
Key Takeaways
Akira = Data-first ransomware. Data theft is the primary extortion lever. Encryption is secondary. |
Identity compromise is the primary entry point - MFA on all VPN and remote access stops the majority of intrusions
Speed defines the threat - under 60 minutes entry to encryption means detection must be pre-emptive
Torrent-based leak distribution makes data containment practically impossible once published
Conti lineage = mature operators - experienced negotiation tactics and institutional knowledge
Rust migration improved evasion - behavioral EDR is required; signature-based AV is insufficient
Prevention = security fundamentals - MFA, patching, segmentation, and immutable backups address the full chain
$244M and growing - financial scale confirms Akira as a dominant Tier-1 threat through 2026
Comments