CISA Warns: Akira Ransomware Has Extracted $42M After Targeting Hundreds

CISA Warns: Akira Ransomware Has Extracted $42M After Targeting Hundreds is the headline, reflecting claims that the Akira operation has amassed substantial ransom proceeds. According to the FBI, CISA, Department of Defense Cyber Crime Center (DC3), Department of Health and Human Services (HHS) and international law enforcement partners from Europe, Akira threat actors have impacted organisations across North America, Europe and Australia since March 2023.

As of late September 2025, the ransomware operation has claimed approximately $244.17 million in total ransomware proceeds, while the page title notes $42M extracted after targeting hundreds.

The group’s activity has involved multiple threat-actor aliases such as Storm-1567, Howling Scorpius, Punk Spider, and Gold Sahara with possible ties to the defunct Conti ransomware, and they primarily target small- and medium-sized businesses across sectors including manufacturing, education, IT, healthcare and financial services.

Their attack methods have evolved to include Linux and Windows variants, exploitation of CVEs such as CVE-2024-40766, and a double-extortion approach, with rapid data exfiltration and use of tools like Mimikatz, WinSCP and Ngrok for C2 and exfiltration. They gain initial access via VPNs without MFA and have exploited vulnerabilities across Cisco products, Veeam backup servers, and other targets, while employing spearphishing, credential theft and brute-force techniques to expand access.