akira

Akira operates an extortion-based ransomware operation carried out through affiliates, employing tradecraft such as evading endpoint detection with Safe Mode and gaining initial access via credential spraying against an exposed SonicWall SSL VPN lacking MFA. Victims are concentrated in Manufacturing, Business Services, Technology, Construction, Agriculture and Food Production, with the US, Canada, Germany, the United Kingdom and Italy the most affected, totaling more than 1,300 victims. A recurring pattern is data theft paired with extortion claims, illustrated by Akira's October 2025 breach of Morris Communications, where about 84GB of data was reportedly stolen. Recent campaigns have also used Bing SEO poisoning to deliver Akira ransomware via BumbleBee and AdaptixC2.

Sectors: Manufacturing, Business Services, Technology · Countries: US, CA, DE