Report

Malware Spotlight: Akira Ransomware

Nov 13, 2024

Arete Analysis

Cyber Threats

Red digital warning symbol glowing on a circuit board interface, representing active ransomware exploitation of the VMware ESXi CVE 2025 22225 vulnerability and hypervisor compromise.

Download The Report

Executive Summary

Since April 2023, Arete’s Incident Response (IR) team has responded to more than one hundred incidents attributed to the Akira ransomware group. Akira is a prolific threat and quickly established itself as one of the most active ransomware groups alongside ALPHV/BlackCat and LockBit in 2023. In 2024, Akira benefited from law enforcement actions that disrupted LockBit and ALPHV/BlackCat’s operations and has continued to be one of the most active threat actor groups.

This spotlight explores the ransomware group’s observed behavior, background information on the threat actor, and statistics from Incident Response engagements, along with a technical analysis of Akira’s ransomware executable. Finally, we discuss security recommendations to better defend against this evolving cyber threat and mitigate the risk of financial and reputational losses.

Incident Response Data on the Akira Ransomware Group

The information below is based on engagements involving Akira ransomware 
investigated by Arete since April 2023. Our IR, Threat Intelligence, and 
Data Analytics teams work together to analyze key data points during every 
ransomware engagement and form real-time threat actor (TA) insights.
 
- Targeted sectors include healthcare, hospitality, manufacturing, public and 
  financial services, and professional services.

- The median initial demand is $500,000.

- The median ransom payment facilitated is $150,000.

- Tools observed during investigations include SystemBC, Cobalt Strike, Rclone,
  Filezilla, WinSCP, AnyDesk, PuTTY, SoftPerfect Network Scanner (netscan), 
  Advanced IP Scanner, and Angry IP Scanner.

- Over the last six months, 43% of engagements involved data exfiltration.

- Depending on the variant, Akira encrypts and appends an “.akira”, “.powerranges”, 
  or “.akiranew” extension to encrypted files.

- The ransom note file name is commonly “akira_readme.txt” or “powerranges.txt” and 
  includes a password-protected Tor site for negotiations and communication with 
  victims.

- The group operates a data leak site (DLS) self-proclaimed as “AKIRA” and commonly 
  threatens victims with releasing stolen data as a pressure tactic if a payment is 
  not made.

- Akira will delete Windows Shadow Volume Copies using Powershell and utilize 
  Windows’ Restart Manager to exit processes and services that could potentially 
  prevent encryption

The information below is based on engagements involving Akira ransomware 
investigated by Arete since April 2023. Our IR, Threat Intelligence, and 
Data Analytics teams work together to analyze key data points during every 
ransomware engagement and form real-time threat actor (TA) insights.
 
- Targeted sectors include healthcare, hospitality, manufacturing, public and 
  financial services, and professional services.

- The median initial demand is $500,000.

- The median ransom payment facilitated is $150,000.

- Tools observed during investigations include SystemBC, Cobalt Strike, Rclone,
  Filezilla, WinSCP, AnyDesk, PuTTY, SoftPerfect Network Scanner (netscan), 
  Advanced IP Scanner, and Angry IP Scanner.

- Over the last six months, 43% of engagements involved data exfiltration.

- Depending on the variant, Akira encrypts and appends an “.akira”, “.powerranges”, 
  or “.akiranew” extension to encrypted files.

- The ransom note file name is commonly “akira_readme.txt” or “powerranges.txt” and 
  includes a password-protected Tor site for negotiations and communication with 
  victims.

- The group operates a data leak site (DLS) self-proclaimed as “AKIRA” and commonly 
  threatens victims with releasing stolen data as a pressure tactic if a payment is 
  not made.

- Akira will delete Windows Shadow Volume Copies using Powershell and utilize 
  Windows’ Restart Manager to exit processes and services that could potentially 
  prevent encryption

The information below is based on engagements involving Akira ransomware 
investigated by Arete since April 2023. Our IR, Threat Intelligence, and 
Data Analytics teams work together to analyze key data points during every 
ransomware engagement and form real-time threat actor (TA) insights.
 
- Targeted sectors include healthcare, hospitality, manufacturing, public and 
  financial services, and professional services.

- The median initial demand is $500,000.

- The median ransom payment facilitated is $150,000.

- Tools observed during investigations include SystemBC, Cobalt Strike, Rclone,
  Filezilla, WinSCP, AnyDesk, PuTTY, SoftPerfect Network Scanner (netscan), 
  Advanced IP Scanner, and Angry IP Scanner.

- Over the last six months, 43% of engagements involved data exfiltration.

- Depending on the variant, Akira encrypts and appends an “.akira”, “.powerranges”, 
  or “.akiranew” extension to encrypted files.

- The ransom note file name is commonly “akira_readme.txt” or “powerranges.txt” and 
  includes a password-protected Tor site for negotiations and communication with 
  victims.

- The group operates a data leak site (DLS) self-proclaimed as “AKIRA” and commonly 
  threatens victims with releasing stolen data as a pressure tactic if a payment is 
  not made.

- Akira will delete Windows Shadow Volume Copies using Powershell and utilize 
  Windows’ Restart Manager to exit processes and services that could potentially 
  prevent encryption

Background

Akira has evolved into a notable ransomware operation and was among the top variants observed by Arete in the first half of 2024.

Source: Arete's H1 2024 Crimeware Report

Akira targets a broad range of organizations throughout North America, including Canada, and swiftly lists victims on its data leak site. Targeted sectors include healthcare, hospitality, manufacturing, public and financial services, and professional services. The group maintains Windows and Linux versions of its ransomware and uses virtual private network (VPN) appliances as an initial access vector in 50% of attacks.

Megazord, a variant of Akira, demonstrates the evolution of the group’s ransomware. Introduced around August 2023, this variant is unique due to its Rust-based code, which is a departure from the C++ code of the original Akira ransomware. The Megazord variant also includes different command line arguments and encrypts files with a “.powerranges” extension, which are differentiating attributes.

Technical Analysis

Malware analysis of one of the Windows-based variants revealed that Akira ransomware:

Supports multiple command-line arguments.
Encrypts files on the system and mounted shares.
Adds the following extension to encrypted files (variant dependent): .akira (e.g., file.docx.akira).
Creates a ransom note with the following filename (variant dependent): akira_readme.txt.
References a data leak site in the ransom note that, when accessed, self-identifies the group as AKIRA.
Kills a list of processes and services.
Maintains a list of whitelisted files and directories to ensure it will not render the system unusable, preventing recovery when running a decryptor.
Attempts to prevent system recovery by deleting the system’s volume shadow copies.
Creates a log file with a name based on the date and time: Log-%d-%m-%Y-%H-%M-%S (e.g., Log-19-09-2024-09-21-20.txt).

Execution Pattern/Arguments

Akira ransomware does not need a command line argument to execute and encrypt files in the system. However, Akira supports the following command line arguments:

Command line argument	Description
-p / –encryption_path	Specify a target directory to encrypt. If not provided, the payload will encrypt the local and mounted shared drives by default.
-s / –share_file	Encrypt shared volumes/directory files.
-n / –encryption_percent	Number that represents the percentage of the file that will be encrypted.
-localonly	Encrypt only local volumes.
-e/ –exclude	Meant to exclude directories but does not seem to be fully functional.

Megazord variant:

Command line argument	Description
–path	Path to encrypt. If not provided, the payload will encrypt the local and mounted shared drives by default.
–id	Unique token to execute the ransomware.
–threads	Number of threads (1-1000).
–h (–help)	Displays help options.
-log	Logging options with multiple logs supported (info, error, debug). Not displayed by default.

Examples of how the supported arguments are used:

Akira.exe -p=C:\Users\%USERNAME%\Desktop\MyFiles

Akira.exe –encryption_percent=10

Figure 1. Code in the ransomware written to read command line arguments

Stop Services and Processes

Before file encryption, the ransomware terminates a pre-determined list of processes and services to encrypt as many files as possible. Akira ransomware contains a list of processes it will exclude during process termination, listed below:

Process names:

explorer.exe, sihost.exe, spoolsv.exe, dwm.exe, LogonUI.exe, fontdrvhost.exe, cmd.exe, csrss.exe, smss.exe, SearchUI.exe, lsass.exe, conhost.exe, System, winlogon.exe, services.exe, wininit.exe, Registry, Memory Compression, System Idle Process, Secure System

File and Directory Exclusions

The ransomware excludes system-related files and folders, ransomware-related files, and whitelisted extensions during encryption.

Excluded file extensions:

.exe, .dll, .sys, .msi, .lnk, .akira, akira_readme.txt

Excluded directories:

tmp, temp, winnt, $Recycle.Bin, thumb, System Volume Information, $RECYCLE.BIN, Windows, ProgramData, Trend Micro, ProgramData, Boot

Inhibit System Recovery

Windows operating systems contain features that can help fix corrupted system files, including shadow copies, which are backups of files created by the Volume Shadow Copy Service (VSS). By deleting shadow copies, the ransomware can prevent victims from restoring files from backups, making it more difficult for them to recover their data without paying the ransom.

The ransomware deletes volume shadow copies before file encryption by starting the following Powershell process and executing the command:

powershell.exe -Command “Get-WmiObject Win32_Shadowcopy | Remove-WmiObject”

Network Share Discovery

Akira ransomware can enumerate network-mounted shares by scanning the network interfaces. If any are found, it will attempt to encrypt them, as shown below.

Figure 2. Share drive encrypted

Data Encrypted for Impact

The ransomware initially finds available drives and then loads the files one by one using the Windows API FindFirstFileW and FindNextFileW. The ransomware generates random AES keys to encrypt the files, and after encrypting them, the keys are encrypted using a public RSA key. The resulting key is again encrypted and placed at the end of the file.

Figure 3. Data encryption code

Figure 4. Extension added to the encrypted files

Figure 5. Encrypted files

During execution, the ransomware creates a log file in the working directory where the file is executed from. The log file is named based on the date and time of execution using the following string format: Log-%d-%m-%Y-%H-%M-%S. For example, during execution, the following log file with the name was created: Log-19-09-2024-09-21-20.txt.

Figure 6. Log file created by Akira

Figure 7. Portion of the log file

Figure 8. Log file name string format in the code

Upon successful execution, the ransomware creates ransom notes with the file name akira_readme.txt. The Megazord variant creates ransom notes with the same content, but the file name is powerranges.txt.

Figure 9. Akira ransom note

Ransom note content:

Hi friends,

Whatever who you are and what your title is if you’re reading this it means the internal infrastructure of your company is fully or partially dead, all your backups – virtual, physical – everything that we managed to reach – are completely removed. Moreover, we have taken a great amount of your corporate data prior to encryption.

Well, for now let’s keep all the tears and resentment to ourselves and try to build a constructive dialogue. We’re fully aware of what damage we caused by locking your internal sources. At the moment, you have to know:

Dealing with us you will save A LOT due to we are not interested in ruining your financially. We will study in depth your finance, bank & income statements, your savings, investments etc. and present our reasonable demand to you. If you have an active cyber insurance, let us know and we will guide you how to properly use it. Also, dragging out the negotiation process will lead to failing of a deal.
Paying us you save your TIME, MONEY, EFFORTS and be back on track within 24 hours approximately. Our decryptor works properly on any files or systems, so you will be able to check it by requesting a test decryption service from the beginning of our conversation. If you decide to recover on your own, keep in mind that you can permanently lose access to some files or accidently corrupt them – in this case we won’t be able to help.
The security report or the exclusive first-hand information that you will receive upon reaching an agreement is of a great value, since NO full audit of your network will show you the vulnerabilities that we’ve managed to detect and used in order to get into, identify backup solutions and upload your data.
As for your data, if we fail to agree, we will try to sell personal information/trade secrets/databases/source codes – generally speaking, everything that has a value on the darkmarket – to multiple threat actors at ones. Then all of this will be published in our blog – https://akiraI2iz6a7qgd3ayp3I6yub7xx2uep76idk3u2kolIpj5z3z636bad[.]onion
We’re more than negotiable and will definitely find the way to settle this quickly and reach an agreement which will satisfy both of us.

If you’re indeed interested in our assistance and the services we provide you can reach out to us following simple instructions:

Install TOR Browser to get access to our chat room – https://www.torproject.org/download/.
Paste this link – <ONION_LINK>
Use this code – <UNIQUE_CODE> – to log into our chat.

Keep in mind that the faster you will get in touch, the less damage we cause.

Modify Registry

The Windows registry is a database that stores configuration settings and values for the Windows operating system. It manages user preferences, installed software, system configurations, and more. Malware abuses the Windows registry to maintain persistence, hide its presence, disable security settings, and launch malicious scripts. Akira did not perform any registry key modification.

Mutex

The mutex is the fundamental tool for managing shared resources between multiple threads or processes. Typically, ransomware uses a mutex to avoid reinfecting the victim system and causing multiple layers of encryption. The ransomware did not create a mutex during execution.

Network Activity

The ransomware did not try to communicate with a remote server other than encrypting data from mounted shares.

Indicators of Compromise

Indicator	Type	Context
9f873c29a38dd265decb6517a2a1f3b5d4f90ccd42e-b61039086ea0b5e74827e	SHA256 hash	Akira ransomware
2b00a02196b87445633cabde506b4387979504cf60955f0b-40cf2e4da4f0fd23	SHA256 hash	Akira ransomware
237d3c744fd5fc5d7e7a55e4385dff51045a1c6d8ee-7346a270a688ab3791d49	SHA256 hash	Akira ransomware
akira_readme.txt, powerranges.txt	File name	Akiraransom notes
.akira, .powerranges, .akiranew	Extension	Encrypted files extension
powershell.exe -Command “Get-WmiObject Win32_Shadowcopy \| Remove-WmiObject”	Process	Volume Shadow Copy deletion
Log-19-09-2024-09-21-20.txt	File name	Example log file name created by Akira
https://akirai2iz6a7qgd3ayp3l6yub7xx2uep76idk3u2kolIpj5z3z636bad[.]onion	URL	TA data leak site (DLS)

Data Leak Site

The ransom note contains a data leak site (DLS) that, when accessed, displayed the following page, self-identifying the group as Akira:

Figure 10. Tor DLS

Tor Chat Site

The ransom note contains a Tor chat site and a unique code used to log into the chat. The Tor chat site displayed the following page:

Figure 11. Tor chat site

Detection Mechanisms

Custom Detections and Blocking with Arete’s Arsenal

SentinelOne S1QL 1.0 query syntax (STAR rule):
Volume Shadow Copy Deletion

Akira Ransomware

EndpointOS = "windows" AND ((ObjectType = "process" AND CmdLine In Contains Anycase (
".\ProgramData\w.exe", ":\w.exe", ":\ProgramData\win.exe", ":\programdata\lck.exe", 
":\ProgramData\dllhost32.exe", ":\ProgramData\hpupdate.exe")) 
OR (ObjectType = "file" AND (EventType In ("File Creation", "File Scan") AND 
(TgtFilePath In Contains Anycase (":\ProgramData\w.exe", ":\w.exe", ":\ProgramData\win.exe", 
":\programdata\lck.exe", ":\ProgramData\dllhost32.exe", ":\ProgramData\hpupdate.exe", 
":\akira_readme.txt", ":\powerranges.txt", "akiranew.txt") OR TgtFilePath RegExp 
"\\Log-[0-9]{2}-[0-9]{2}-20[0-9]{2}-[0-9]{2}-[0-9]{2}\.

EndpointOS = "windows" AND ((ObjectType = "process" AND CmdLine In Contains Anycase (
".\ProgramData\w.exe", ":\w.exe", ":\ProgramData\win.exe", ":\programdata\lck.exe", 
":\ProgramData\dllhost32.exe", ":\ProgramData\hpupdate.exe")) 
OR (ObjectType = "file" AND (EventType In ("File Creation", "File Scan") AND 
(TgtFilePath In Contains Anycase (":\ProgramData\w.exe", ":\w.exe", ":\ProgramData\win.exe", 
":\programdata\lck.exe", ":\ProgramData\dllhost32.exe", ":\ProgramData\hpupdate.exe", 
":\akira_readme.txt", ":\powerranges.txt", "akiranew.txt") OR TgtFilePath RegExp 
"\\Log-[0-9]{2}-[0-9]{2}-20[0-9]{2}-[0-9]{2}-[0-9]{2}\.

EndpointOS = "windows" AND ((ObjectType = "process" AND CmdLine In Contains Anycase (
".\ProgramData\w.exe", ":\w.exe", ":\ProgramData\win.exe", ":\programdata\lck.exe", 
":\ProgramData\dllhost32.exe", ":\ProgramData\hpupdate.exe")) 
OR (ObjectType = "file" AND (EventType In ("File Creation", "File Scan") AND 
(TgtFilePath In Contains Anycase (":\ProgramData\w.exe", ":\w.exe", ":\ProgramData\win.exe", 
":\programdata\lck.exe", ":\ProgramData\dllhost32.exe", ":\ProgramData\hpupdate.exe", 
":\akira_readme.txt", ":\powerranges.txt", "akiranew.txt") OR TgtFilePath RegExp 
"\\Log-[0-9]{2}-[0-9]{2}-20[0-9]{2}-[0-9]{2}-[0-9]{2}\.

Note: These threat hunting queries may need to be tuned for your specific network environment.

Yara

rule Akira_ransomware_executable
{
    meta:
        author = "areteir.com"
        description = "Detects the Akira ransomware executable"
        target = "Windows systems"
        file_type = "exe"
        copyright = "Copyright © 2024 by Arete Advisors, LLC."
        distribution = "No re-distribution without Arete Advisors, LLC consent."

    strings:
        $ns1 = "Shadowcopy" ascii wide nocase
        $ns2 = "Remove-WmiObject" ascii wide nocase
        $ns3 = "write_encrypt_info" ascii wide nocase
        $ns4 = "Log-%d-%m-%Y-%H-%M-%S" ascii wide nocase
        $as1 = "--encryption_path" ascii wide nocase
        $as2 = "--share_file" ascii wide nocase
        $as3 = "--encryption_percent" ascii wide nocase
        $as4 = "-localonly" ascii wide nocase
        $ms1 = "megazord\\src\\main.rs" ascii wide nocase
        $ms2 = "megazord::windowsmegazord\\src\\windows.rs" ascii wide nocase
        $ms3 = "megazord::path_findermegazord\\src\\path_finder.rs" ascii wide nocase
        $ms4 = "megazord\\src\\lock.rs" ascii wide nocase
        $pdb1 = ":\\rust\\megazord" ascii wide nocase
        $pdb2 = "\\release\\deps\\megazord.pdb" ascii wide nocase
        $dls = "akiral2iz6a7qgd3ayp3l6yub7xx2uep76idk3u2kollpj5z3z636bad" ascii wide nocase

condition:
((uint16(0) == 0x5A4D) and (uint32(uint32(0x3C)) == 0x00004550)) and
( ( (2 of ($ns*)) and (3 of ($as*)) ) or ( all of ($ms*) ) or ( all of ($pdb*) ) or ($dls) )
}

rule Akira_ransomware_executable
{
    meta:
        author = "areteir.com"
        description = "Detects the Akira ransomware executable"
        target = "Windows systems"
        file_type = "exe"
        copyright = "Copyright © 2024 by Arete Advisors, LLC."
        distribution = "No re-distribution without Arete Advisors, LLC consent."

    strings:
        $ns1 = "Shadowcopy" ascii wide nocase
        $ns2 = "Remove-WmiObject" ascii wide nocase
        $ns3 = "write_encrypt_info" ascii wide nocase
        $ns4 = "Log-%d-%m-%Y-%H-%M-%S" ascii wide nocase
        $as1 = "--encryption_path" ascii wide nocase
        $as2 = "--share_file" ascii wide nocase
        $as3 = "--encryption_percent" ascii wide nocase
        $as4 = "-localonly" ascii wide nocase
        $ms1 = "megazord\\src\\main.rs" ascii wide nocase
        $ms2 = "megazord::windowsmegazord\\src\\windows.rs" ascii wide nocase
        $ms3 = "megazord::path_findermegazord\\src\\path_finder.rs" ascii wide nocase
        $ms4 = "megazord\\src\\lock.rs" ascii wide nocase
        $pdb1 = ":\\rust\\megazord" ascii wide nocase
        $pdb2 = "\\release\\deps\\megazord.pdb" ascii wide nocase
        $dls = "akiral2iz6a7qgd3ayp3l6yub7xx2uep76idk3u2kollpj5z3z636bad" ascii wide nocase

condition:
((uint16(0) == 0x5A4D) and (uint32(uint32(0x3C)) == 0x00004550)) and
( ( (2 of ($ns*)) and (3 of ($as*)) ) or ( all of ($ms*) ) or ( all of ($pdb*) ) or ($dls) )
}

rule Akira_ransomware_executable
{
    meta:
        author = "areteir.com"
        description = "Detects the Akira ransomware executable"
        target = "Windows systems"
        file_type = "exe"
        copyright = "Copyright © 2024 by Arete Advisors, LLC."
        distribution = "No re-distribution without Arete Advisors, LLC consent."

    strings:
        $ns1 = "Shadowcopy" ascii wide nocase
        $ns2 = "Remove-WmiObject" ascii wide nocase
        $ns3 = "write_encrypt_info" ascii wide nocase
        $ns4 = "Log-%d-%m-%Y-%H-%M-%S" ascii wide nocase
        $as1 = "--encryption_path" ascii wide nocase
        $as2 = "--share_file" ascii wide nocase
        $as3 = "--encryption_percent" ascii wide nocase
        $as4 = "-localonly" ascii wide nocase
        $ms1 = "megazord\\src\\main.rs" ascii wide nocase
        $ms2 = "megazord::windowsmegazord\\src\\windows.rs" ascii wide nocase
        $ms3 = "megazord::path_findermegazord\\src\\path_finder.rs" ascii wide nocase
        $ms4 = "megazord\\src\\lock.rs" ascii wide nocase
        $pdb1 = ":\\rust\\megazord" ascii wide nocase
        $pdb2 = "\\release\\deps\\megazord.pdb" ascii wide nocase
        $dls = "akiral2iz6a7qgd3ayp3l6yub7xx2uep76idk3u2kollpj5z3z636bad" ascii wide nocase

condition:
((uint16(0) == 0x5A4D) and (uint32(uint32(0x3C)) == 0x00004550)) and
( ( (2 of ($ns*)) and (3 of ($as*)) ) or ( all of ($ms*) ) or ( all of ($pdb*) ) or ($dls) )
}

Recommended Mitigations

Utilize an endpoint detection and response (EDR) solution with the capability to halt detected processes and isolate systems on the network based on identified conditions.
Block any known attacker C2s in the firewall.
Implement multi-factor authentication on RDP and VPN to restrict access to critical network resources.
Eliminate unnecessary RDP ports exposed to the internet.
Block a high number of SMB connection attempts from one system to others in the network over a short period of time.
Perform periodic dark web monitoring to verify if data is available for sale on the black market.
Perform penetration tests.
Periodically patch systems and update tools.
Monitor connections to the network from suspicious locations.
Monitor downloads and uploads of files to file-sharing services outside standard work hours.
Monitor file uploads from domain controllers to the internet.
Monitor network scans from uncommon servers (e.g., RDP server).

Organizations can find the full list of US government-recommended ransomware prevention and mitigation
guidance here: https://www.cisa.gov/stopransomware/ransomware-guide.

Arete provides data-driven cybersecurity solutions to transform your response to emerging cyber threats.
Click here to learn more.

References

At Arete, we envision a world without cyber extortion, where people, businesses, and governments can thrive. We are taking all that we know from over 9,000 engagements to inform our solutions and strengthen powerful tools to better prevent, detect, and respond to the cyber extortion threats of tomorrow. Our elite team of experts provides unparalleled capabilities to address the entire cyber threat lifecycle, from incident response and restoration to advisory and managed security services. To learn more about our solutions, visit www.areteir.com.

Back to Blog Posts

Article

Feb 20, 2026

Threat Actors Leveraging Gemini AI for All Attack Stages

State-backed threat actors are leveraging Google’s Gemini AI as a force multiplier to support all stages of the cyberattack lifecycle, from reconnaissance to post-compromise operations. According to the Google Threat Intelligence Group (GTIG), threat actors linked to the People’s Republic of China (PRC), Iran, North Korea, and other unattributed groups have misused Gemini to accelerate target profiling, synthesize open-source intelligence, identify official email addresses, map organizational structures, generate tailored phishing lures, translate content, conduct vulnerability testing, support coding tasks, and troubleshoot malware development. Cybercriminals are increasingly exploring AI-enabled tools and services to scale malicious activities, including social engineering campaigns such as ClickFix, demonstrating how generative AI is being integrated into both espionage and financially motivated threat operations.

What’s Notable and Unique

Threat actors are leveraging Gemini beyond basic reconnaissance, using it to generate polished, culturally nuanced phishing lures and sustain convincing multi-turn social engineering conversations that minimize traditional red flags.
In addition, threat actors rely on Gemini for vulnerability research, malware debugging, code generation, command-and-control development, and technical troubleshooting, with PRC groups emphasizing automation and vulnerability analysis, Iranian actors focusing on social engineering and malware development, and North Korean actors prioritizing high-fidelity target profiling.
Beyond direct operational support, adversaries have abused public generative AI platforms to host deceptive ClickFix instructions, tricking users into pasting malicious commands that deliver macOS variants of ATOMIC Stealer.
AI is also being integrated directly into malware development workflows, as seen with CoinBait’s AI-assisted phishing kit capabilities and HonestCue’s use of the Gemini API to dynamically generate and execute in-memory C# payloads.
Underground forums show strong demand for AI-powered offensive tools, with offerings like Xanthorox falsely marketed as custom AI but actually built on third-party commercial models integrated through open-source frameworks such as Crush, Hexstrike AI, LibreChat-AI, and Open WebUI, including Gemini.

Analyst Comments

The increasing misuse of generative AI platforms like Gemini highlights a rapidly evolving threat landscape in which state-backed and financially motivated actors leverage AI as a force multiplier for reconnaissance, phishing, malware development, and post-compromise operations. At the same time, large-scale model extraction attempts and API abuse demonstrate emerging risks to AI service integrity, intellectual property, and the broader AI-as-a-Service ecosystem. While these developments underscore the scalability and sophistication of AI-enabled threats, continued enforcement actions, strengthened safeguards, and proactive security testing by providers reflect ongoing efforts to mitigate abuse and adapt defenses in response to increasingly AI-driven adversaries.

Sources

GTIG AI Threat Tracker: Distillation, Experimentation, and (Continued) Integration of AI for Adversarial Use

Article

Feb 12, 2026

2025 VMware ESXi Vulnerability Exploited by Ransomware Groups

Ransomware groups are actively exploiting CVE‑2025‑22225, a VMware ESXi arbitrary write vulnerability that allows attackers to escape the VMX sandbox and gain kernel‑level access to the hypervisor. Although VMware (Broadcom) patched this flaw in March 2025, threat actors had already exploited it in the wild, and CISA recently confirmed that threat actors are exploiting CVE‑2025‑22225 in active campaigns.

What’s Notable and Unique

Chinese‑speaking threat actors abused this vulnerability at least a year before disclosure, via a compromised SonicWall VPN chain.
Threat researchers have observed sophisticated exploit toolkits, possibly developed well before public disclosure, that chain this bug with others to achieve full VM escape. Evidence points to targeted activity, including exploitation via compromised VPN appliances and automated orchestrators.
Attackers with VMX level privileges can trigger a kernel write, break out of the sandbox, and compromise the ESXi host. Intrusions observed in December 2025 showed lateral movement, domain admin abuse, firewall rule manipulation, and staging of data for exfiltration.
CISA has now added CVE-2025-22225 to its Known Exploited Vulnerabilities (KEV) catalog, underscoring ongoing use by ransomware attackers.

Analyst Comments

Compromise of ESXi hypervisors significantly amplifies operational impact, allowing access to and potential encryption of dozens of VMs simultaneously. Organizations running ESXi 7.x and 8.x remain at high risk if patches and mitigations have not been applied. Therefore, clients are recommended to apply VMware patches from VMSA‑2025‑0004 across all ESXi, Workstation, and Fusion deployments. Enterprises are advised to assess their setups in order to reduce risk, as protecting publicly accessible management interfaces is a fundamental security best practice.

Sources

CVE-2025-22225 in VMware ESXi now used in active ransomware attacks
The Great VM Escape: ESXi Exploitation in the Wild
VMSA-205-004: VMware ESXi, Workstation, and Fusion updates address multiple vulnerabilities (CVE-205-22224, CVE-2025-22225, CVE-2025-22226)

Article

Feb 5, 2026

Ransomware Trends & Data Insights: January 2026

Although Akira was once again the most active ransomware group in January, the threat landscape was more evenly distributed than it was throughout most of 2025. In December 2025, the three most active threat groups accounted for 57% of all ransomware and extortion activity; in January, the top three accounted for just 34%. Akira’s dominance also decreased to levels more consistent with early 2025, as the group was responsible for almost a third of all attacks in December but just 17% in January.

The number of unique ransomware and extortion groups observed in January increased slightly, to 17, up from 14 in December. It is too early to assess whether this trend will be the new normal for 2026. It is also worth noting that overall activity in January was lower than in previous months, consistent with what Arete typically observes at the beginning of a new year.

Figure 1. Activity from all threat groups in January 2026

Throughout the month of January, analysts at Arete identified several distinct trends behind the threat actors perpetrating cybercrime activities:

In January, Arete observed the reemergence of the LockBit Ransomware-as-a-Service (RaaS) group, which deployed an updated “LockBit 5.0” variant of its ransomware. LockBit first announced the 5.0 version on the RAMP dark web forum in early September 2025, coinciding with the group’s six-year anniversary. The latest LockBit 5.0 variant has both Windows and Linux versions, with notable improvements, including anti-analysis features and unique 16-character extensions added to each encrypted file. However, it remains to be seen whether LockBit will return to consistent activity levels in 2026.

The ClickFix social engineering technique, which leverages fake error dialog boxes to deceive users into manually executing malicious PowerShell commands, continued to evolve in unique ways in January. One campaign reported in January involved fake Blue Screen of Death (BSOD) messages manipulating users into pasting attacker-controlled code. During the month, researchers also documented a separate campaign, dubbed “CrashFix,” that uses a malicious Chrome browser extension-based attack vector. It crashes the web browser, displays a message stating the browser had "stopped abnormally," and then prompts the victim to click a button that executes malicious commands.

Also in January, Fortinet confirmed that a new critical authentication vulnerability affecting its FortiGate devices is being actively exploited. The vulnerability, tracked as CVE-2026-24858, allows attackers with a FortiCloud account to log in to devices registered to other account owners due to an authentication bypass flaw in devices using FortiCloud single sign-on (SSO). This recent activity follows the exploitation of two other Fortinet SSO authentication flaws, CVE-2025-59718 and CVE-2025-59719, which were disclosed in December 2025.

Source

Arete Internal

Article

Feb 2, 2026

New FortiCloud SSO Vulnerability Exploited

Fortinet recently confirmed that its FortiGate devices are affected by a new critical authentication vulnerability that is being actively exploited. The vulnerability, tracked as CVE-2026-24858, allows attackers with a FortiCloud account to log in to devices registered to other account owners due to an authentication bypass flaw in devices using FortiCloud single sign-on (SSO). CISA added the vulnerability to its Known Exploited Vulnerabilities catalogue and gave federal agencies just three days to patch, which requires users to upgrade all devices running FortiOS, FortiManager, FortiAnalyzer, FortiProxy, and FortiWeb to fixed versions. This recent activity follows the exploitation of two other SSO authentication flaws, CVE-2025-59718 and CVE-2025-59719, which were disclosed last month.

What’s Notable and Unique

There are strong indications that much of the recent exploitation activity was automated, with attackers moving from initial access to account creation within seconds.
As observed in December 2025, the attackers’ primary target appears to be firewall configuration files, which contain a trove of information that can be leveraged in future operations.
The threat actors in this campaign favor innocuous, IT-themed email and account names, with malicious login activity originating from cloud-init@mail[.]io and cloud-noc@mail[.]io, while account names such as ‘secadmin’, ‘itadmin’, ‘audit’, and others are created for persistence and subsequent activity.

Analyst Comments

This is an active campaign, and the investigation into these attacks is ongoing. Organizations relying on FortiGate devices should remain extremely vigilant, even after following patching guidance. With threat actors circumventing authentication, it’s crucial to monitor for and alert on anomalous behavior within your environment, such as the unauthorized creation of admin accounts, the creation or modification of access policies, logins outside normal working hours, and anything that deviates from your security baseline.

Sources

Administrative FortiCloud SSO authentication bypass
Multiple Fortinet Products’ FortiCloud SSO Login Authentication Bypass
Arctic Wolf Observes Malicious Configuration Changes On Fortinet FortiGate Devices via SSO Accounts
Arctic Wolf Observes Malicious SSO Logins on FortiGate Devices Following Disclosure of CVE-2025-59718 and CVE-2025-59719

Report

Malware Spotlight: Akira Ransomware

Executive Summary

Incident Response Data on the Akira Ransomware Group

Background

Technical Analysis

Execution Pattern/Arguments

Command line argument

Description

Command line argument

Description

Stop Services and Processes

File and Directory Exclusions

Inhibit System Recovery

Network Share Discovery

Data Encrypted for Impact

Modify Registry

Mutex

Network Activity

Indicators of Compromise

Indicator

Type

Context

Data Leak Site

Tor Chat Site

Detection Mechanisms

Custom Detections and Blocking with Arete’s Arsenal

Yara

Recommended Mitigations

References

Article

Feb 20, 2026

Threat Actors Leveraging Gemini AI for All Attack Stages

What’s Notable and Unique

Analyst Comments

Sources

Article

Feb 12, 2026

2025 VMware ESXi Vulnerability Exploited by Ransomware Groups

What’s Notable and Unique

Analyst Comments

Sources

Article

Feb 5, 2026

Ransomware Trends & Data Insights: January 2026

Source

Article

Feb 2, 2026

New FortiCloud SSO Vulnerability Exploited

What’s Notable and Unique

Analyst Comments

Sources