Akira Ransomware Group Made $244 Million in Ransom Proceeds

The Akira ransomware group has made over $244 million in proceeds from its activities, according to an updated joint advisory from government agencies in the US, France, Germany, and the Netherlands. Active since at least March 2023, the group is best known for deploying a ransomware variant tailored for VMware ESXi servers and targeting businesses and critical infrastructure across North America, Europe and Australia.

In June 2025, it encrypted Nutanix AHV VM disk files and exploited a SonicWall firewall vulnerability tracked as CVE-2024-40766, while also exploiting several other vulnerabilities for initial access this year, including CVE-2020-3580, CVE-2023-28252, CVE-2024-37085, CVE-2023-27532, and CVE-2024-40711.

Initial access has been achieved through stolen credentials on SonicWall appliances, access brokers or brute-forcing VPN endpoints, with password spraying and tools such as SharpDomainSpray cited as techniques to gain credentials. The advisory notes further activity such as bypassing VMDK protections to exfiltrate NTDS[.]dit and the SYSTEM hive, and deploying ransom notes with extensions like .akira, .powerranges, .akiranew and .aki.