Akira, the ransomware that walks in through the door left open

A group two years old, and still effective

In the daily telling of ransomware there is a bias: chase the new name. Akira is a reminder of why that is a mistake. It has been active since March 2023, runs as ransomware-as-a-service — a core that builds the malware and affiliates who run the attacks for a cut — and has never stopped. The joint advisory from CISA, the FBI and the Netherlands' National Cyber Security Centre, in its version updated to 13 November 2025, lines up the figures: more than 342 organisations hit since the start, around 244 million dollars in estimated proceeds as of late September 2025. This is no newcomer. It is an industry.

How it gets in: almost always the same door

The technically interesting part of Akira is how uninteresting it is. According to the advisory, initial access comes mostly from poorly protected remote services: VPNs without multi-factor authentication, exploiting known vulnerabilities such as Cisco's CVE-2020-3259 and CVE-2023-20269, or phishing campaigns and already-compromised credentials used against the Remote Desktop Protocol. It is the portrait of an intruder who does not break locks but tries the handles: wherever it finds a remote door reachable without a second factor, it walks in.

Once inside, the script is double extortion: data is exfiltrated first and encrypted afterwards, so the victim has two reasons to pay — to get the files back and to stop their publication. Since April 2023 there has been a Linux variant aimed at VMware ESXi virtual machines, which shifts the target from individual computers to the heart of a company's virtualisation.

1. 01
   Exposed VPN or RDP

   without MFA, or with already-stolen credentials
2. 02
   Movement and exfiltration

   data leaves before encryption
3. 03
   Double extortion

   ransom to decrypt and to prevent publication

July's claims, with due caution

In July 2026 Akira's leak site added new names, including — according to services that monitor leak sites — a US mechanical-construction contractor and a transport company, with the usual threat to publish the data absent a negotiation. Here the same discipline applies that we apply to every leak site: these are the criminal group's assertions, not confirmations from the victims. A name on an extortion site means someone claims an attack, not that the attack has been independently verified. We report them as claims, and as such they should be read until direct confirmations emerge.

What is not in doubt is the method, and that is where the useful lesson lies. The MITRE ATT&CK identifiers in this dossier (T1190, T1133, T1486, T1567) are those documented in the advisory, not our deduction. And they point to a defence that requires no exotic technology: multi-factor authentication on every remote access, patches on exposed VPNs, monitoring for exfiltration, and backups an attacker cannot reach. Akira thrives where these things are missing. It is a two-year-old group that keeps cashing in because the door, in too many places, is still open.