Akira
Akira is a financially motivated ransomware group active since at least March 2023. Known aliases in the provided content include Gold Sahara, Howling Scorpius, Punk Spider, and Storm-1567. The group released a Linux variant in June 2023 that has been used against VMware ESXi environments; reported incidents describe attackers gaining access to ESXi hypervisors, shutting down virtual machines, and encrypting .vmdk files. The content states that Akira’s Linux variant uses chunk-based partial encryption logic for large files and has been observed partially encrypting virtual machine-related file types such as VMDK, VHDX, and VDI. The group is linked in the content to exploitation of SonicWall SSLVPN appliances via CVE-2024-40766 since at least September 2024, including compromises of SSLVPN accounts on vulnerable devices. Akira is also mentioned in relation to Citrix brute-forcing activity reported by Rapid7 that ultimately led to Akira and LockBit 3.0 ransomware intrusions. Akira appears in multiple reports as part of broader ransomware ecosystems supplied by the initial access broker Woodgnat, also known as KongTuke. Those reports state that Woodgnat sells compromised network access to ransomware groups including Akira, Qilin, Interlock, Rhysida, 8Base, and Black Basta, and that tools such as ModeloRAT and Mistic have been observed in activity linked to access later used by Akira-associated operations. Victimology in the provided content indicates substantial activity in the United States, with one report stating that Akira, alongside Qilin and DragonForce, draws close to half of its publicly claimed victims from the US. The content also notes continued attacks across Asia, Europe, and North America, identifies Akira as one of the more active groups affecting healthcare in June 2026, and lists it among representative ransomware groups capable of targeting major-event-related organizations. The content does not attribute Akira to a nation state.
Know when an actor pivots toward your sector
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Tradecraft
45 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
Associated malware families
2 malware families attributed to this actor across reporting.
Associated vulnerabilities
14 CVEs this actor has used in observed campaigns. 14 of them exploited in the wild.
For instance, the Akira ransomware gang has been actively exploiting CVE-2024-40766, a year-old critical-severity vulnerability, to hack into SonicWall firewalls since September 2024.
In one case, the threat actors likely exploited CVE-2023-20269 in an organization’s Cisco ASA to establish an unauthorized remote access VPN session into the victim’s infrastructure.
Akira has been observed exploiting vulnerabilities in Cisco devices (CVE-2020-3259; CVE-2023-70766) and has recently been observed exploiting a vulnerability in SonicWall Firewall devices (CVE-2024-40766).
This detection identifies instances where Windows Explorer.exe spawns PowerShell or cmd.exe processes, particularly focusing on executions initiated by LNK files. This behavior is associated with the ZDI-CAN-25373 Windows shortcut zero-day vulnerability, where specially crafted LNK files are used to trigger malicious code execution through cmd.exe or powershell.exe. This technique has been actively exploited by multiple APT groups in targeted attacks through both HTTP and SMB delivery methods.
This analytic identifies potential exploitation attempts of ProxyShell (CVE-2021-34473, CVE-2021-34523, CVE-2021-31207) and ProxyNotShell (CVE-2022-41040, CVE-2022-41082) vulnerabilities in Microsoft Exchange Server.
9 more CVEs tied to this actor tracked in Mallory.
Observables
4 indicators attributed to this actor: domains, IPs, hashes, and other artifacts pulled from reporting. View more in app.
Recent activity
20 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Referenced as a downstream ransomware operation that may purchase access from Woodgnat.
Named as a ransomware crew that purchases or uses access brokered by KongTuke/Woodgnat.
Named as a ransomware crew previously linked to attacks involving KongTuke-provided access.
Referenced as one of the ransomware groups whose attacks have involved ModeloRAT.
The version that knows your environment.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.