Akira Ransomware Has Raked In $244 Million: US and European Agencies Warn of New Tactics

That's quite a haul. The Akira ransomware group, active since at least March 2023, has now extorted more than $244 million from its victims. The figure comes from the latest updated advisory issued jointly by government agencies in the US, France, Germany and the Netherlands.

Until now, Akira was best known for attacking VMware ESXi servers, targeting businesses and critical infrastructure across North America, Europe and Australia. But the group is clearly not resting on its laurels.

New Arsenal, New Targets

In 2025, the group significantly expanded its toolkit. According to the advisory, in a June 2025 attack the threat actors encrypted virtual machine disk files on Nutanix Acropolis Hypervisor (AHV). They are also actively exploiting a vulnerability in SonicWall firewalls (CVE-2024-40766).

Their list of "favorite" vulnerabilities for gaining initial access has grown as well. It now includes:

• CVE-2020-3580 (Cisco ASA and FTD)
• CVE-2023-28252 (Windows)
• CVE-2024-37085 (VMware ESXi)
• CVE-2023-27532 and CVE-2024-40711 (both in Veeam Backup & Replication)

Vulnerability analysis: See our breakdown of vulnerabilities in Microsoft and other vendors' products, which often become the entry point for groups like Akira.

How Do the Akira Hackers Operate?

Beyond exploiting the vulnerabilities above, Akira also breaks into victims' networks using more traditional methods. These include using stolen credentials for SonicWall devices, buying access from other cybercriminals (so-called access brokers) and classic brute-force attacks against VPN endpoints. The group also uses password spraying, relying on tools such as SharpDomainSpray.

Once inside the network, the real work begins:

1. Reconnaissance: They use Visual Basic (VB) scripts and nltest commands to map the network and the domain.
2. Lateral Movement: To move across the network and escalate privileges, they rely on a whole range of tools: AnyDesk, LogMeIn, RDP, SSH, MobaXterm, as well as Impacket (wmiexec.py).
3. Defense Evasion: Before the main strike, they methodically uninstall EDR (Endpoint Detection and Response) products so they can operate undetected (learn more about the role of EDR and XDR systems).
4. Privilege Escalation: They create new user accounts and add them to administrator groups, or exploit vulnerabilities in Veeam services.

The advisory also describes one particularly clever technique. To get around protections on virtual disk (VMDK) files, the attackers temporarily powered off the domain controller's virtual machine, copied its VMDK files and then attached them to a new virtual machine they had created. This allowed them to extract the NTDS.dit file and the SYSTEM hive, which led directly to a takeover of the domain administrator account.

In some cases, the attackers managed to steal (exfiltrate) data within just 2 hours of gaining initial access. All that remains at the end is to encrypt the files (appending the .akira, .powerranges, .akiranew or .aki extensions) and drop the ransom notes.

Akira is not the only dangerous ransomware group out there. BlackCat 3.0 is just as destructive and uses similar double extortion techniques. It's also worth understanding how the zero-day vulnerabilities exploited by most ransomware groups work. Read our comprehensive guide to 0-day vulnerabilities.

Source: Based on the joint government advisory dated November 13, 2025 (US, France, Germany, the Netherlands)

Aleksander