Akira
financial
Tracked by CyberSIXT since 28 Aug 2025
- Articlesall time
- 32
- Articleslast 30 days
- 1
- CVEs exploitedattributed · all time
- 1
- Research reportsall time
- 3
32 articles from 13 outlets; 1 in the last 7 days.
- Article
- Research report
Show as table
Profile
Written by CyberSIXT from the sources listed below. Updated 26 Oct.
MITRE ATT&CK describes Akira as a ransomware variant and ransomware deployment entity active since at least March 20231. Microsoft lists the motivation as financial and uses the name Storm-15672,3. MITRE ATT&CK also lists GOLD SAHARA, Howling Scorpius and PUNK SPIDER as names4.
Darktrace reported that Akira activity against SonicWall SSL VPN devices surged globally from July 2025 and linked the campaign to CVE-2024-407665. Unit 42 reported a 42-day intrusion in which Howling Scorpius used SectopRAT, exfiltrated nearly 1 TB of data and deployed Akira ransomware across servers in three networks6. Dark Reading reported a June 2025 operation that encrypted Nutanix AHV virtual machine disk files7.
DataBreaches.net reported that US and European agencies updated an advisory first issued in April 2024, which stated that the group had demanded more than 244 million dollars in ransom by late September8. Akira announced on 29 October 2025 that it had breached Apache OpenOffice, and as of 1 November 2025 the Apache Software Foundation had not confirmed or denied the breach9.
Sources
- Akira: description · MITRE ATT&CK
- Akira: motivation · Microsoft
- Akira: alias · Microsoft
- Akira: alias · MITRE ATT&CK
- Akira SonicWall Campaign Uncovered · Darktrace · 2025-10-09
- Anatomy of an Akira Ransomware Attack: When a Fake CAPTCHA Led to 42 Days of Compromise · Unit 42 · 2025-11-19
- Akira RaaS Targets Nutanix VMs, Threatens Critical Orgs · Dark Reading · 2025-11-14
- Akira ransomware: FBI tallies 250 million in payouts · DataBreaches.net · 2025-12-10
- Akira Ransomware Strikes Apache OpenOffice, Allegedly Exfiltrates 23GB of Data · GBHackers · 2025-11-01
© 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation.
Diamond Model
What the record links to AkiraRecorded associations sorted by Diamond Model vertex. They do not reconstruct an intrusion or establish a campaign. Model: Caltagirone, Pendergast and Betz (2013).
Names and sources
- Storm-1567
- CyberSIXT coverage, Malpedia, Microsoft, MISP Galaxy
- Akira
- Malpedia, MISP Galaxy, MITRE ATT&CK®
- GOLD SAHARA
- Malpedia, MISP Galaxy, MITRE ATT&CK®
- PUNK SPIDER
- Malpedia, Microsoft, MISP Galaxy, MITRE ATT&CK®
- Howling Scorpius
- MITRE ATT&CK®
Attributed facts
- Category
Financial Microsoft · Storm-1567
- Motivation
Financial Microsoft · Storm-1567
CVEs exploited
1 CVE an article attributes to AkiraVendors targeted
Malware and tools
Malpedia · storm-1567 2
MITRE ATT&CK® techniques
17 techniques · 13 tacticsFrom MITRE ATT&CK® · G1024
Execution 1
- T1059.001
- PowerShell
Privilege Escalation 1
- T1078
- Valid Accounts
Stealth 3
Defense Impairment 1
- T1685
- Disable or Modify Tools
Credential Access 1
- T1558
- Steal or Forge Kerberos Tickets
Lateral Movement 1
- T1021.001
- Remote Desktop Protocol
Command and Control 1
- T1219
- Remote Access Tools
Exfiltration 1
- T1567.002
- Exfiltration to Cloud Storage
© 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. All techniques on MITRE ATT&CK
- Ransomware Attacks Jump 50% as Data Theft Replaces EncryptionInfosecurity
- Ransomware Attacks on Manufacturers Surge 40% as New Groups EmergeSecurityWeek
- Security Affairs Flags Akira Ransomware, New Linux Botnet ThreatsSecurity Affairs
- SonicWall VPN Gap Lets Akira Ransomware Try Safe Mode EvasionSecurity Affairs
- Akira Ransomware Fails After Safe Mode Trick on SonicWall VPNInfosecurity
- Over 9,000 ransomware attacks; US leads, healthcare worst hitSecurity Affairs
- Ransomware attacks in Europe surge 55% as Qilin variant dominatesInfosecurity
- Woodgnat IAB Uses Backdoor.Mistic RAT in WordPress, Teams AttacksSecurityWeek
- CVE-2024-40766 exposes SonicWall firewalls to ransomwareSANS ISC
- Brazil faces surge in ransomware as top threat actors target 2026SOCRadar
- Akira ransomware breach exposed by missing SSLVPN log integrationSANS ISC
- Microsoft shuts down Fox Tempest malware signing serviceThe Hacker News
The latest 12 are listed. See all 46 articles in the timeline.