Akira RaaS Targets Nutanix VMs, Threatens Critical Orgs

The Akira ransomware group has been expanding its tools and attack surfaces, with a June 2025 operation encrypting Nutanix AHV virtual machine disk files, marking a shift to a hypervisor that isn’t as commonly targeted. Authorities note Akira’s rapid data exfiltration and its use of a range of new malware tools and software vulnerabilities to hit multiple critical systems at once.

The attack surface focus on virtual infrastructure continues to be a key enabler for disruption, as Akira moves beyond ESXi and Hyper-V to AHV. Akira has also been seen exploiting fixable vulnerabilities in edge devices, using AnyDesk and LogMeIn for administrator actions to undermine security programs, and deploying tools like SystemBC, StoneStop and PoorTry in various roles.

In addition to its operational tempo, Arctic Wolf Labs observers highlight that the group has achieved data exfiltration in times as short as just over two hours, and as of late September 2025 had collected around $245 million in ransom payments.