Skip to main content
Meet us at Black Hat USA 2026— Las Vegas, August 1–6Book a Meeting
Mallory
2 malware familiesExploits CVEs in the wild

Akira

Also known asakiraakira_ransomwareakira_ransomware_actorsakira_ransomware_gangakira_ransomware_groupGOLD SAHARAHowling ScorpiusPUNK SPIDERStorm-1567

Akira is a financially motivated ransomware group active since at least March 2023. Known aliases in the provided content include Gold Sahara, Howling Scorpius, Punk Spider, and Storm-1567. The group released a Linux variant in June 2023 that has been used against VMware ESXi environments; reported incidents describe attackers gaining access to ESXi hypervisors, shutting down virtual machines, and encrypting .vmdk files. The content states that Akira’s Linux variant uses chunk-based partial encryption logic for large files and has been observed partially encrypting virtual machine-related file types such as VMDK, VHDX, and VDI. The group is linked in the content to exploitation of SonicWall SSLVPN appliances via CVE-2024-40766 since at least September 2024, including compromises of SSLVPN accounts on vulnerable devices. Akira is also mentioned in relation to Citrix brute-forcing activity reported by Rapid7 that ultimately led to Akira and LockBit 3.0 ransomware intrusions. Akira appears in multiple reports as part of broader ransomware ecosystems supplied by the initial access broker Woodgnat, also known as KongTuke. Those reports state that Woodgnat sells compromised network access to ransomware groups including Akira, Qilin, Interlock, Rhysida, 8Base, and Black Basta, and that tools such as ModeloRAT and Mistic have been observed in activity linked to access later used by Akira-associated operations. Victimology in the provided content indicates substantial activity in the United States, with one report stating that Akira, alongside Qilin and DragonForce, draws close to half of its publicly claimed victims from the US. The content also notes continued attacks across Asia, Europe, and North America, identifies Akira as one of the more active groups affecting healthcare in June 2026, and lists it among representative ransomware groups capable of targeting major-event-related organizations. The content does not attribute Akira to a nation state.

Share:
Are they targeting you?

Know when an actor pivots toward your sector

Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.

MITRE ATT&CK

Tradecraft

45 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.

13 of 15 tactics63 techniques×N= number of intelligence reports citing this technique
MITRE ATT&CK
TA0042
Resource Development
1 technique
T1584
Compromise Infrastructure
T1584.006
Web Services
TA0001
Initial Access
4 techniques
T1078×4
Valid Accounts
T1078.001×2
Default Accounts
T1133×9
External Remote Services
T1190×9
Exploit Public-Facing Application
T1566
Phishing
TA0002
Execution
3 techniques
T1047
Windows Management Instrumentation
T1059
Command and Scripting Interpreter
T1059.001×4
PowerShell
T1203×2
Exploitation for Client Execution
TA0003
Persistence
6 techniques
T1078×4
Valid Accounts
T1078.001×2
Default Accounts
T1098
Account Manipulation
T1112
Modify Registry
T1133×9
External Remote Services
T1136
Create Account
T1543
Create or Modify System Process
T1543.003
Windows Service
TA0004
Privilege Escalation
4 techniques
T1068×2
Exploitation for Privilege Escalation
T1078×4
Valid Accounts
T1078.001×2
Default Accounts
T1098
Account Manipulation
T1543
Create or Modify System Process
T1543.003
Windows Service
TA0005
Stealth
6 techniques
T1014
Rootkit
T1027
Obfuscated Files or Information
T1027.002
Software Packing
T1036
Masquerading
T1036.005
Match Legitimate Resource Name or Location
T1070
Indicator Removal
T1070.001×2
Clear Windows Event Logs
T1070.004
File Deletion
T1078×4
Valid Accounts
T1078.001×2
Default Accounts
T1564
Hide Artifacts
T1564.002
Hidden Users
TA0112
Defense Impairment
1 technique
T1112
Modify Registry
TA0006
Credential Access
5 techniques
T1003
OS Credential Dumping
T1003.001
LSASS Memory
T1003.003
NTDS
T1110×3
Brute Force
T1111
Multi-Factor Authentication Interception
T1555
Credentials from Password Stores
T1558
Steal or Forge Kerberos Tickets
T1558.003×2
Kerberoasting
TA0007
Discovery
3 techniques
T1016
System Network Configuration Discovery
T1087×2
Account Discovery
T1482×2
Domain Trust Discovery
TA0008
Lateral Movement
2 techniques
T1021
Remote Services
T1021.001×2
Remote Desktop Protocol
T1021.002
SMB/Windows Admin Shares
T1550
Use Alternate Authentication Material
T1550.002
Pass the Hash
TA0011
Command and Control
2 techniques
T1105
Ingress Tool Transfer
T1219×2
Remote Access Tools
TA0010
Exfiltration
2 techniques
T1041
Exfiltration Over C2 Channel
T1537×2
Transfer Data to Cloud Account
TA0040
Impact
5 techniques
T1485
Data Destruction
T1486×16
Data Encrypted for Impact
T1490×3
Inhibit System Recovery
T1529
System Shutdown/Reboot
T1657
Financial Theft
WEAPONIZED

Associated vulnerabilities

14 CVEs this actor has used in observed campaigns. 14 of them exploited in the wild.

CVE-2024-40766Improper Access Control in SonicWall SonicOS Management Access and SSLVPNIn the wildEvidence13

For instance, the Akira ransomware gang has been actively exploiting CVE-2024-40766, a year-old critical-severity vulnerability, to hack into SonicWall firewalls since September 2024.

CVE-2023-20269Unauthorized Access and Credential Brute Force in Cisco ASA/FTD Remote Access VPNIn the wildEvidence4

In one case, the threat actors likely exploited CVE-2023-20269 in an organization’s Cisco ASA to establish an unauthorized remote access VPN session into the victim’s infrastructure.

CVE-2020-3259Information Disclosure in Cisco ASA and FTD Web Services InterfaceIn the wildEvidence3

Akira has been observed exploiting vulnerabilities in Cisco devices (CVE-2020-3259; CVE-2023-70766) and has recently been observed exploiting a vulnerability in SonicWall Firewall devices (CVE-2024-40766).

CVE-2025-9491Microsoft Windows LNK File UI Misrepresentation Remote Code Execution VulnerabilityIn the wildEvidence2

This detection identifies instances where Windows Explorer.exe spawns PowerShell or cmd.exe processes, particularly focusing on executions initiated by LNK files. This behavior is associated with the ZDI-CAN-25373 Windows shortcut zero-day vulnerability, where specially crafted LNK files are used to trigger malicious code execution through cmd.exe or powershell.exe. This technique has been actively exploited by multiple APT groups in targeted attacks through both HTTP and SMB delivery methods.

CVE-2021-31207Post-auth Arbitrary File Write in Microsoft Exchange Server (ProxyShell)In the wildEvidence1

This analytic identifies potential exploitation attempts of ProxyShell (CVE-2021-34473, CVE-2021-34523, CVE-2021-31207) and ProxyNotShell (CVE-2022-41040, CVE-2022-41082) vulnerabilities in Microsoft Exchange Server.

9 more CVEs tied to this actor tracked in Mallory.

IOCS

Observables

4 indicators attributed to this actor: domains, IPs, hashes, and other artifacts pulled from reporting. View more in app.

IOC values are gated. View more in Mallory for domains, IPs, hashes, and other artifacts, or pipe them straight into your SIEM.

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: sector and geo overlap with your footprint, the IOCs they’re burning right now, detection coverage, and what to do next.
Target overlap

Match sector + geo + tech-stack targeting against your real footprint.

Tradecraft mapping45

Every observed MITRE ATT&CK technique, grouped by tactic.

Malware arsenal2

Families this actor is known to deploy, with IOCs and behavior.

Exploited CVEs14

CVEs this actor has used in known campaigns.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

Observables4

Domains, IPs, and hashes tied to this actor, refreshed continuously.