CISA/Europol Warn: Akira Ransomware Profits Hit $244M, Group Expands to Encrypt Nutanix AHV VMs

CISA, alongside Europol EC3 and other partners, has issued a warning that Akira ransomware profits have risen to approximately $244.17 million (USD) as of late September 2025, with the gang expanding to encrypt Nutanix AHV virtual machines after a June 2025 incident exploiting SonicWall vulnerability CVE-2024-40766.

The advisory notes Akira’s shift from targeting smaller firms to organisations across manufacturing, education, IT, healthcare, financial services, and food and agriculture, and its use of a double-extortion model that combines encryption with data theft. According to the bulletin, Akira’s encryptor family includes Akira_v2, with new extensions such as .akiranew and .aki, and its ransomware payload employs a hybrid ChaCha20 and RSA scheme, encrypting files and appending extensions like .akira or .powerranges.

The warning also highlights rapid intrusions, with some incidents involving data exfiltration in just over two hours from initial access, and notes that Akira often gains entry via VPN vulnerabilities and password-spraying techniques. Since its emergence in March 2023, the group has operated across North America, Europe and Australia, and the advisory is co-authored by a broad consortium including the FBI, CISA, the Department of Defense Cyber Crime Center (DC3), the U.S.

Department of Health and Human Services (HHS), Europol EC3, French OFAC, German Cybercrime-Zentrum and LKA Baden-Württemberg, and the Netherlands’ NCSC-NL. According to the document, the original advisory was published in April 2024 and updated on 13 November 2025.