Report
Malware Spotlight: Akira Ransomware
Arete Analysis
Cyber Threats
Download The Report
Executive Summary
Since April 2023, Arete’s Incident Response (IR) team has responded to more than one hundred incidents attributed to the Akira ransomware group. Akira is a prolific threat and quickly established itself as one of the most active ransomware groups alongside ALPHV/BlackCat and LockBit in 2023. In 2024, Akira benefited from law enforcement actions that disrupted LockBit and ALPHV/BlackCat’s operations and has continued to be one of the most active threat actor groups.
This spotlight explores the ransomware group’s observed behavior, background information on the threat actor, and statistics from Incident Response engagements, along with a technical analysis of Akira’s ransomware executable. Finally, we discuss security recommendations to better defend against this evolving cyber threat and mitigate the risk of financial and reputational losses.
Incident Response Data on the Akira Ransomware Group
Background
Akira has evolved into a notable ransomware operation and was among the top variants observed by Arete in the first half of 2024.
Source: Arete's H1 2024 Crimeware Report
Akira targets a broad range of organizations throughout North America, including Canada, and swiftly lists victims on its data leak site. Targeted sectors include healthcare, hospitality, manufacturing, public and financial services, and professional services. The group maintains Windows and Linux versions of its ransomware and uses virtual private network (VPN) appliances as an initial access vector in 50% of attacks.
Megazord, a variant of Akira, demonstrates the evolution of the group’s ransomware. Introduced around August 2023, this variant is unique due to its Rust-based code, which is a departure from the C++ code of the original Akira ransomware. The Megazord variant also includes different command line arguments and encrypts files with a “.powerranges” extension, which are differentiating attributes.
Technical Analysis
Malware analysis of one of the Windows-based variants revealed that Akira ransomware:
Supports multiple command-line arguments.
Encrypts files on the system and mounted shares.
Adds the following extension to encrypted files (variant dependent): .akira (e.g., file.docx.akira).
Creates a ransom note with the following filename (variant dependent): akira_readme.txt.
References a data leak site in the ransom note that, when accessed, self-identifies the group as AKIRA.
Kills a list of processes and services.
Maintains a list of whitelisted files and directories to ensure it will not render the system unusable, preventing recovery when running a decryptor.
Attempts to prevent system recovery by deleting the system’s volume shadow copies.
Creates a log file with a name based on the date and time: Log-%d-%m-%Y-%H-%M-%S (e.g., Log-19-09-2024-09-21-20.txt).
Execution Pattern/Arguments
Akira ransomware does not need a command line argument to execute and encrypt files in the system. However, Akira supports the following command line arguments:
Command line argument | Description |
|---|---|
-p / –encryption_path | Specify a target directory to encrypt. If not provided, the payload will encrypt the local and mounted shared drives by default. |
-s / –share_file | Encrypt shared volumes/directory files. |
-n / –encryption_percent | Number that represents the percentage of the file that will be encrypted. |
-localonly | Encrypt only local volumes. |
-e/ –exclude | Meant to exclude directories but does not seem to be fully functional. |
Megazord variant:
Command line argument | Description |
|---|---|
–path | Path to encrypt. If not provided, the payload will encrypt the local and mounted shared drives by default. |
–id | Unique token to execute the ransomware. |
–threads | Number of threads (1-1000). |
–h (–help) | Displays help options. |
-log | Logging options with multiple logs supported (info, error, debug). Not displayed by default. |
Examples of how the supported arguments are used:
Akira.exe -p=C:\Users\%USERNAME%\Desktop\MyFiles |
Akira.exe –encryption_percent=10 |
Figure 1. Code in the ransomware written to read command line arguments
Stop Services and Processes
Before file encryption, the ransomware terminates a pre-determined list of processes and services to encrypt as many files as possible. Akira ransomware contains a list of processes it will exclude during process termination, listed below:
Process names:
explorer.exe, sihost.exe, spoolsv.exe, dwm.exe, LogonUI.exe, fontdrvhost.exe, cmd.exe, csrss.exe, smss.exe, SearchUI.exe, lsass.exe, conhost.exe, System, winlogon.exe, services.exe, wininit.exe, Registry, Memory Compression, System Idle Process, Secure System | ||
|---|---|---|
File and Directory Exclusions
The ransomware excludes system-related files and folders, ransomware-related files, and whitelisted extensions during encryption.
Excluded file extensions:
.exe, .dll, .sys, .msi, .lnk, .akira, akira_readme.txt |
Excluded directories:
tmp, temp, winnt, $Recycle.Bin, thumb, System Volume Information, $RECYCLE.BIN, Windows, ProgramData, Trend Micro, ProgramData, Boot |
Inhibit System Recovery
Windows operating systems contain features that can help fix corrupted system files, including shadow copies, which are backups of files created by the Volume Shadow Copy Service (VSS). By deleting shadow copies, the ransomware can prevent victims from restoring files from backups, making it more difficult for them to recover their data without paying the ransom.
The ransomware deletes volume shadow copies before file encryption by starting the following Powershell process and executing the command:
powershell.exe -Command “Get-WmiObject Win32_Shadowcopy | Remove-WmiObject” |
Network Share Discovery
Akira ransomware can enumerate network-mounted shares by scanning the network interfaces. If any are found, it will attempt to encrypt them, as shown below.
Figure 2. Share drive encrypted
Data Encrypted for Impact
The ransomware initially finds available drives and then loads the files one by one using the Windows API FindFirstFileW and FindNextFileW. The ransomware generates random AES keys to encrypt the files, and after encrypting them, the keys are encrypted using a public RSA key. The resulting key is again encrypted and placed at the end of the file.
Figure 3. Data encryption code
Figure 4. Extension added to the encrypted files
Figure 5. Encrypted files
During execution, the ransomware creates a log file in the working directory where the file is executed from. The log file is named based on the date and time of execution using the following string format: Log-%d-%m-%Y-%H-%M-%S. For example, during execution, the following log file with the name was created: Log-19-09-2024-09-21-20.txt.
Figure 6. Log file created by Akira
Figure 7. Portion of the log file
Figure 8. Log file name string format in the code
Upon successful execution, the ransomware creates ransom notes with the file name akira_readme.txt. The Megazord variant creates ransom notes with the same content, but the file name is powerranges.txt.
Figure 9. Akira ransom note
Ransom note content:
Hi friends,
| ||
|---|---|---|
Modify Registry
The Windows registry is a database that stores configuration settings and values for the Windows operating system. It manages user preferences, installed software, system configurations, and more. Malware abuses the Windows registry to maintain persistence, hide its presence, disable security settings, and launch malicious scripts. Akira did not perform any registry key modification.
Mutex
The mutex is the fundamental tool for managing shared resources between multiple threads or processes. Typically, ransomware uses a mutex to avoid reinfecting the victim system and causing multiple layers of encryption. The ransomware did not create a mutex during execution.
Network Activity
The ransomware did not try to communicate with a remote server other than encrypting data from mounted shares.
Indicators of Compromise
Indicator | Type | Context |
|---|---|---|
9f873c29a38dd265decb6517a2a1f3b5d4f90ccd42e-b61039086ea0b5e74827e | SHA256 hash | Akira ransomware |
2b00a02196b87445633cabde506b4387979504cf60955f0b-40cf2e4da4f0fd23 | SHA256 hash | Akira ransomware |
237d3c744fd5fc5d7e7a55e4385dff51045a1c6d8ee-7346a270a688ab3791d49 | SHA256 hash | Akira ransomware |
akira_readme.txt, powerranges.txt | File name | Akiraransom notes |
.akira, .powerranges, .akiranew | Extension | Encrypted files extension |
powershell.exe -Command “Get-WmiObject Win32_Shadowcopy | Remove-WmiObject” | Process | Volume Shadow Copy deletion |
Log-19-09-2024-09-21-20.txt | File name | Example log file name created by Akira |
https://akirai2iz6a7qgd3ayp3l6yub7xx2uep76idk3u2kolIpj5z3z636bad[.]onion | URL | TA data leak site (DLS) |
Data Leak Site
The ransom note contains a data leak site (DLS) that, when accessed, displayed the following page, self-identifying the group as Akira:
Figure 10. Tor DLS
Tor Chat Site
The ransom note contains a Tor chat site and a unique code used to log into the chat. The Tor chat site displayed the following page:
Figure 11. Tor chat site
Detection Mechanisms
Custom Detections and Blocking with Arete Bloktd℠
SentinelOne S1QL 1.0 query syntax (STAR rule):
Volume Shadow Copy Deletion
Akira Ransomware
Note: These threat hunting queries may need to be tuned for your specific network environment.
Yara
Recommended Mitigations
Utilize an endpoint detection and response (EDR) solution with the capability to halt detected processes and isolate systems on the network based on identified conditions.
Block any known attacker C2s in the firewall.
Implement multi-factor authentication on RDP and VPN to restrict access to critical network resources.
Eliminate unnecessary RDP ports exposed to the internet.
Block a high number of SMB connection attempts from one system to others in the network over a short period of time.
Perform periodic dark web monitoring to verify if data is available for sale on the black market.
Perform penetration tests.
Periodically patch systems and update tools.
Monitor connections to the network from suspicious locations.
Monitor downloads and uploads of files to file-sharing services outside standard work hours.
Monitor file uploads from domain controllers to the internet.
Monitor network scans from uncommon servers (e.g., RDP server).
Organizations can find the full list of US government-recommended ransomware prevention and mitigation
guidance here: https://www.cisa.gov/stopransomware/ransomware-guide.
Arete provides data-driven cybersecurity solutions to transform your response to emerging cyber threats.
Click here to learn more.
References
At Arete, we envision a world without cyber extortion, where people, businesses, and governments can thrive. We are taking all that we know from over 9,000 engagements to inform our solutions and strengthen powerful tools to better prevent, detect, and respond to the cyber extortion threats of tomorrow. Our elite team of experts provides unparalleled capabilities to address the entire cyber threat lifecycle, from incident response and restoration to advisory and managed security services. To learn more about our solutions, visit www.areteir.com. | ||
|---|---|---|
Back to Blog Posts
Article
Ransomware Trends & Data Insights: July 2026
INC Ransom was the most active threat group in July, while activity remained relatively distributed among multiple threat groups, with 19 unique groups observed throughout the month. Alongside INC Ransom, Qilin, Global Secret Group, Anubis, and DragonForce rounded out the five most active threat groups observed in July. Several emerging threat actors were also observed during the month, including Booba Team, Settra, and Global Secret Group.
Figure 1. Activity from the top 3 threat groups in July 2026
Throughout the month, analysts at Arete identified several trends behind the threat actors perpetrating cybercrime activities:
In July 2026, Global Secret Group emerged as a new threat actor, leveraging the leaked LockBit 3.0 (LockBit Black) source code. Although the group began operations in June 2026, it quickly accumulated a substantial number of victims on its data leak site (DLS). The group operates through TOR-based negotiation portals and qTox communications. Notably, its DLS provides step-by-step guidance on purchasing Bitcoin, including references to Coinbase and Binance, demonstrating a streamlined, victim-focused extortion process designed to simplify ransom payments.
Similar to Fulcrumsec, the recently emerged Settra ransomware group appears to leverage AI-driven analysis of stolen data, publishing detailed and highly structured victim reports on its DLS. Additionally, a potential EDR-disabling tool, edr_blind.exe, was identified in multiple cases, suggesting a focus on defense-evasion capabilities.
With the continuation of the FortiBleed campaign, researchers have now identified compromised FortiGate credentials being leveraged by both the INC and Lynx ransomware operations. Analysis revealed direct operational links between the groups, including shared ransomware infrastructure and overlap between FortiBleed victims and ransomware targets. The operators are also incorporating AI to enhance various stages of the attack lifecycle and increase operational efficiency and scale. Notably, Arete also observed an INC ransomware intrusion leveraging FortiBleed-derived access in July, reinforcing the campaign's role as a precursor to ransomware deployment.
Sources
Arete Internal
Podcast
Cyber Campfire: June Threat Trends & Insights
In this episode of Arete’s Cyber Campfire podcast, our Threat Intelligence Team discusses trends, statistics, and emerging threat actors from June 2026. Tune in for firsthand insights on today’s threat landscape that can enhance your approach to cyber risk.
Article
Current: Misconfigured Server Reveals Multiple Phishing Campaigns
Researchers uncovered three Microsoft 365 phishing campaigns after discovering a misconfigured HTTP server that exposed a threat actor’s phishing tools, configurations, victim logs, and operational infrastructure. The investigation revealed two operators using custom Evilginx-based adversary-in-the-middle (AiTM) phishing frameworks to steal authentication sessions and bypass MFA protections. A third operator abused Microsoft’s OAuth Device Code flow by tricking victims into completing authentication through Microsoft’s legitimate login process, allowing attackers to obtain valid access and refresh tokens without stealing passwords. The largest campaign compromised at least 218 victims across 12 countries, primarily targeting corporate Microsoft 365 accounts, with refresh tokens enabling persistent access. Researchers also identified the use of remote management tools for maintaining access, AI-assisted development of phishing tooling, and links to broader Phishing-as-a-Service (PhaaS) ecosystems, highlighting how commodity frameworks and automation are lowering the barrier for sophisticated identity-based attacks.
What’s Notable and Unique
The campaigns demonstrate the continued shift from traditional credential theft to identity- and token-based compromise, in which attackers target authentication sessions, cookies, and OAuth tokens rather than relying solely on password theft. By obtaining valid authentication artifacts, attackers can access Microsoft 365 environments while bypassing conventional MFA protections.
The use of Evilginx-based AiTM frameworks highlights how publicly available phishing tools have evolved into effective MFA-bypass platforms. These frameworks proxy legitimate login pages, capture authenticated sessions, and allow attackers to reuse valid sessions without requiring victims’ credentials again.
The OAuth Device Code flow abuse represents a different attack method, in which attackers leverage a legitimate Microsoft authentication mechanism to obtain tokens after victims approve the request. This approach bypasses password theft entirely by abusing trusted authentication workflows.
The exposed infrastructure provided insight into attacker operations, including phishing configurations, victim tracking data, remote administration tools, and evidence of AI-assisted development. The findings demonstrate how phishing ecosystems now provide reusable tooling and automation that reduce the technical expertise required to conduct large-scale identity attacks.
Analyst Comments
These Microsoft 365 phishing campaigns demonstrate the ongoing evolution of identity-focused attacks, as adversaries increasingly target authentication sessions, tokens, and legitimate cloud authorization mechanisms to bypass traditional security controls. The combination of AiTM phishing, OAuth abuse, remote management tools, and PhaaS infrastructure enables threat actors to maintain persistent access while blending into legitimate cloud activity.
The growing availability of phishing frameworks and AI-assisted attack development highlights the need for continuous identity security improvements beyond traditional phishing defenses. Arete recommends that organizations strengthen identity monitoring, adopt phishing-resistant MFA where possible, review OAuth application permissions, monitor token activity, and implement conditional access policies to detect and restrict suspicious Microsoft 365 authentication behavior. Security teams should also monitor post-compromise indicators such as abnormal mailbox access, suspicious application consent, unauthorized remote tools, and unusual sign-in activity.
Sources
One Misconfigured Server, Three Active Campaigns: Full exposure of three AiTM Phishing Operators
Misconfigured Server Reveals Three Evilginx Phishing Operations Targeting Microsoft 365
Podcast
Digital Forensics Meets the Courtroom: Insights on Expert Witness and Cyber-Related Litigation
In this episode of Bytes of Insight, host Vinny Sakore and special guest Dr. Bruce Hartley, Managing Director and Co-Founder of Advisory Services at Arete, discuss the evolving role of digital forensics and expert witness work in cybersecurity litigation. Tune in for firsthand insights on how Arete conducts post-breach investigations, what it takes to undergo cross-examination on the stand, and how emerging threats like AI-driven social engineering and third-party breaches are reshaping the advisory landscape.