Akira posted 84 new victims to its leak site in March 2026 alone, its second-busiest month on record, and threat intelligence firm Halcyon has clocked its refined attack chain moving from initial access to full network encryption in under four hours. It now sits at or near the top of every active-group ranking for 2026, trailing only Qilin in total victim count. For a ransomware-as-a-service operation that emerged in March 2023 out of the wreckage of Conti, that is a remarkably long and productive run. Most ransomware brands burn out, rebrand, or get disrupted within eighteen months. Akira has done neither, and the reason is instructive: it has stayed disciplined about a small number of initial access techniques and iterated on speed rather than novelty.

This is a technical walkthrough of how an Akira intrusion actually unfolds, mapped to the CISA/FBI joint advisory (AA24-109A) and more recent reporting on its 2025-2026 campaigns against SonicWall and Cisco VPN appliances. The goal is not a how-to — it is a defender's read of the attack chain: where Akira gets in, what it does once inside, and where the detection opportunities actually sit before encryption starts.

Who Akira Is and Why It Still Matters in 2026

Akira operates as ransomware-as-a-service: a core group develops the encryptor and leak-site infrastructure, and affiliates run the intrusions in exchange for a cut of the ransom. Blockchain analysis and TTP overlap have linked Akira's origins to former Conti operators, which explains why its post-exploitation tradecraft — LSASS credential dumping, Advanced IP Scanner for network discovery, disabling of security tooling before encryption — looks so mature for a group barely three years old. It inherited a playbook rather than building one from scratch.

The group has claimed more than 1,400 victims since 2023 and is estimated to have collected over $245 million in ransom payments, according to Halcyon's 2026 tracking. Manufacturing, professional services, financial services, and technology are its heaviest-hit sectors, and roughly half of its attacks land on organizations in the United States. It also runs both Windows and Linux/VMware ESXi encryptors, which is why virtualization and hosting environments — not just office networks — are squarely in scope.

Initial Access: The VPN Is Still the Front Door

Akira's initial access patterns have been consistent enough that they double as a checklist of what not to leave exposed. The CISA advisory and subsequent vendor research converge on three primary vectors.

Unpatched and MFA-less VPN appliances

Cisco documented Akira affiliates targeting Cisco ASA and FTD VPNs lacking multi-factor authentication as early as August 2023, with exploitation tied to older Cisco vulnerabilities including CVE-2020-3259 and CVE-2023-20269. The pattern repeated in 2025 against SonicWall: Arctic Wolf and Darktrace both reported Akira affiliates abusing CVE-2024-40766, an improper access control flaw in SonicOS management on Gen 5, Gen 6, and older Gen 7 firewalls, to compromise SSLVPN accounts even on devices that had since been patched — because credentials harvested before the patch remained valid afterward. CISA added the CVE to its Known Exploited Vulnerabilities catalog, and by late 2025 it was still showing up in fresh Akira intrusions, a reminder that patching an appliance does not retroactively invalidate credentials an attacker already has.

Valid credentials and RDP

Where a VPN flaw isn't available, Akira affiliates fall back on stolen or brokered credentials against exposed RDP and VPN portals, sometimes sourced from initial access brokers rather than harvested directly. Remote access tools including AnyDesk are used both for initial footholds and to maintain access that looks like legitimate remote administration to an under-tuned SIEM.

Spear phishing

A smaller share of intrusions still start with phishing, though it is no longer the dominant vector for this group — VPN exploitation and credential abuse have proven more reliable and more scalable for an affiliate model that needs a steady intrusion pipeline.

The throughline for defenders: Akira does not rely on zero-days. Every documented initial access vector in the CISA advisory and subsequent reporting is either a known, patchable vulnerability or a control gap (no MFA on remote access) that predates the attack by months or years. This is an unglamorous but accurate statement about most ransomware in 2026 generally — initial access is rarely the sophisticated part.

Post-Compromise: Discovery, Persistence, and Credential Theft

Once inside, Akira affiliates move quickly to establish persistence and expand access. Documented techniques include creating new domain or local administrator accounts — CISA's advisory specifically calls out account names such as itadm — and using them as a fallback foothold independent of the original entry point. Credential theft leans on dumping LSASS process memory, and on commodity tools including Mimikatz and LaZagne to harvest cached credentials from memory and browser stores. Network discovery typically runs through Advanced IP Scanner to map hosts, shares, and backup infrastructure.

Backup infrastructure gets particular attention. Multiple incident reports describe Akira affiliates specifically targeting Veeam backup servers, in some cases using PowerShell to extract credentials directly from the Veeam configuration database, and Finland's NCSC-FI issued a specific warning about Akira wiping NAS and tape backup devices before encryption begins. This is a deliberate sequencing choice: destroy or degrade the victim's ability to recover before they ever see a ransom note, which maximizes leverage in the negotiation that follows.

Defense Evasion: Clearing the Runway Before Encryption

Akira affiliates use tools like PowerTool to disable or kill security processes ahead of encryption, and the group has iterated its encryptor payload across multiple variants — including a build researchers have referred to as "Megazord" and a refreshed "Akira_v2" — partly in response to public decryptor releases that undercut earlier versions. Shadow copy deletion via vssadmin or equivalent commands is standard practice to block local recovery, consistent with the MITRE ATT&CK technique for inhibiting system recovery (T1490). The Linux/ESXi variant specifically targets virtual machine disk files, which is what makes Akira a genuine concern for hosting providers and any organization running production workloads on VMware — encrypting a handful of datastores can take down dozens of guest VMs in one pass, which is a materially different blast radius than encrypting individual endpoints.

Exfiltration Before Encryption: The Double Extortion Sequence

Akira runs a standard double extortion model: steal data, then encrypt, then threaten publication on its Tor leak site if the victim doesn't pay. Exfiltration tooling includes FileZilla, WinSCP, and Rclone, moving data out over FTP, SFTP, or directly to cloud storage providers — traffic that, on an under-monitored network, looks like legitimate file transfer activity unless someone is watching for volume and destination anomalies. Some reporting describes exfiltration windows as short as two hours when Akira affiliates are pulling from Veeam repositories specifically, which puts real pressure on organizations that don't have egress monitoring tuned to catch large, fast transfers to unfamiliar destinations.

The ransom note itself, typically dropped as a file named fn.txt, withholds the specific demand until the victim makes contact — a psychological tactic that forces engagement before the victim has full information, and one CISA and the FBI have both advised against responding to. Demands have ranged from roughly $200,000 into the millions depending on victim size and perceived ability to pay, and Akira affiliates have been reported to lower demands for victims who don't need a decryptor and just want to avoid a leak-site posting.

Detection Opportunities: Where This Attack Chain Is Actually Catchable

None of the above is exotic tradecraft, and that is the good news for defenders — most of Akira's attack chain maps to well-understood detection surfaces if the right telemetry is in place and someone is actually looking at it. A few points in the chain are disproportionately valuable:

The common thread is that Akira's post-compromise behavior is loud if you're instrumented to hear it, and it moves fast enough — sub-four-hour breakout in documented cases — that alert triage speed matters as much as alert accuracy. A detection that fires correctly but sits in a queue for six hours is functionally the same as no detection for this threat actor. This is the practical argument for managed detection and response over unmonitored EDR licenses: the tooling generating the alert and the team acting on it need to be the same continuously-staffed operation, not two separate purchases that only meet during an incident.

Building a Defensible Posture Against Akira-Style Intrusions

Every documented Akira initial access vector maps to a specific, achievable control. Enforce MFA on every remote access path without exception — VPN, RDP gateways, and remote administration tools alike — since the absence of MFA on VPN appliances is Akira's single most consistently exploited gap. Maintain a patch cadence for perimeter devices that treats VPN and firewall CVEs as urgent regardless of vendor, and assume that credentials exposed before a patch remain compromised after it; a post-patch credential rotation is not optional cleanup, it's part of the remediation. Segment backup infrastructure onto its own authentication domain with MFA and restricted network reachability, since Veeam and other backup consoles are a named, repeated Akira target rather than incidental collateral. Follow the 3-2-1 backup rule with at least one copy genuinely offline or immutable, because Akira's playbook explicitly includes wiping connected backups before encryption. And deploy EDR/XDR tooling that is actually monitored — CISA's own advisory recommends endpoint detection specifically because Akira's post-compromise behavior is detectable, but only for organizations with the telemetry and staffing to see it in near-real time.

None of this requires exotic technology. It requires consistent execution of controls that have been considered best practice for years, applied without the exceptions and expired projects that accumulate in most environments over time. That gap between documented best practice and actual production configuration is exactly where Akira, and groups like it, continue to find their way in.

CloudSilicon manages Bitdefender GravityZone deployments — including EDR/XDR, patch management, and 24/7 monitoring — for organizations that need this level of control enforced and actively watched, not just licensed. If you want a technical review of your current remote access, backup, and endpoint detection posture against attack chains like Akira's, start here or book a 30-minute consult to walk through your specific environment.