Sponsored by Hudson Rock – Use Hudson Rock's free cybercrime intelligence tools to learn how Infostealer infections are leading to ransomware attacks

Enjoying ransomware.live? Help us keep tracking ransomware gangs and shipping new features. Support us

Akira

Active Parent: conti .akira .arika .iqoj
World map Statistics ATT&CK Navigator
The Akira ransomware group is said to have emerged in March 2023, and there's much speculation about its ties to the former CONTI ransomware group.

It's worth noting that with the end of CONTI's operation, several affiliates migrated to independent campaigns such as Royal, BlackBasta, and others.

According to some reports, Akira affiliates also work with other ransomware operations, such as Snatch and BlackByte, as an open directory of tools used by an Akira operator was identified, which also had connections to the Snatch ransomware.

The first version of the Akira ransomware was written in C++ and appended files with the '.akira' extension, creating a ransom note named 'akira_readme.txt,' partially based on the Conti V2 source code. However, on June 29, 2023, a decryptor for this version was reportedly released by Avast.

Subsequently, a version was released that fixed the decryption flaw on July 2, 2023. Since then, the new version is said to be written in Rust, this time called 'megazord.exe,' and it changes the extension to '.powerranges' for encrypted files.

Most of Akira's initial access vectors use brute-force attempts on Cisco VPN devices (which use single-factor authentication only).
Additionally, exploitation of CVEs: CVE-2019-6693 and CVE-2022-40684 for initial access has been identified.
Source: https://github.com/crocodyli/ThreatActors-TTPs
Victims
1,681
23 this month
Rank
#3 / 388
#3 over the last 12 months
First victim
2023-04-12
estimated attack date
Last victim
2026-11-13
2 days ago
Attack → claim
53.9 d
average delay
Countries
71
hit
Infostealer
34.0%
of victims with a domain
Leak-site uptime
92.6% average, 30 days

Victims per month

-28%
By estimated attack date when known, otherwise by discovery date.

Top sectors

  • Manufacturing 465 · 28%
  • Professional Services 384 · 23%
  • Technology 161 · 10%
  • Retail & E-Commerce 123 · 7%
  • Financial Services 106 · 6%
  • Agriculture and Food Production 95 · 6%
  • Transportation 80 · 5%
  • Healthcare 59 · 4%
  • Energy & Utilities 53 · 3%
  • Hospitality 51 · 3%

Top countries

What ransomware.live knows about akira

External information