Akira Ransomware Decryption & Data Recovery

Akira surfaced publicly in March 2023. Its operators are tracked as Storm-1567, Howling Scorpius, Punk Spider and Gold Sahara, and both code and personnel are assessed to have links to the defunct Conti syndicate. It runs as a ransomware-as-a-service business: a core team maintains the encryptor and leak site, affiliates handle intrusion and deployment, and proceeds are split. The retro green-on-black terminal styling of its leak site is one of the family's most recognisable signatures.

CISA, the FBI, DC3 and international partners first published the #StopRansomware advisory AA24-109A in April 2024 and issued a substantial update on 13 November 2025, reporting roughly USD 244 million in claimed ransom proceeds and describing Akira as an imminent threat to critical infrastructure. Public tracking put Akira's 2025 leak-site postings close to a thousand organisations, and through 2026 it has stayed in the top tier of global operations alongside Qilin and DragonForce.

By sector, Akira concentrates on manufacturing, education, information technology, healthcare, financial services and food and agriculture, with a clear preference for small and mid-sized firms — organisations that typically run a full virtualisation stack but lack MFA, log retention and offline backups.

For organisations in China and the wider region the relevance is in the attack surface rather than the branding: Akira's favoured entry points (VPN accounts without second-factor authentication, unpatched Cisco/SonicWall/Fortinet edge devices, exposed Veeam backup servers) map closely onto common enterprise network designs, and its ability to encrypt VMware ESXi and even Nutanix AHV matches the widespread "one hyperconverged cluster runs everything" pattern in manufacturing and hospitals. Chinese vendors and community outlets have tracked Akira's Cisco VPN intrusions since 2023.

Extensions. Most samples rename files to the original name plus .akira; the Megazord branch uses .powerranges, and .akiranew / .aki also appear. The Linux/ESXi encryptor appends .akira as well, concentrating on .vmdk, .vmx and .vmsn virtual-machine files.

Ransom note. akira_readme.txt is dropped in the root and user directories; some builds use fn.txt. The text opens casually, claims data theft, and notably supplies no email address and no wallet address — only a Tor onion URL and a victim-specific login code. That is a clear differentiator from mail-based families such as Phobos or GlobeImposter.

Host-side artefacts.

• PowerShell calls against Win32_ShadowCopy to delete volume shadow copies; event logs cleared.
• Security software plus database and backup services stopped; PsExec, AnyDesk, RustDesk, Radmin and Cloudflared frequently present.
• Exfiltration typically via Rclone, WinSCP, FileZilla or MEGA clients.
• BYOVD to disable AV (seen since July 2025): rwdrv.sys (the legitimate ThrottleStop driver) and hlpdrv.sys registered as services, with Defender's DisableAntiSpyware registry value rewritten.
• Safe Mode to evade EDR (first observed August 2026): hosts rebooted into Safe Mode with Networking, where most EDR agents do not load, and AnyDesk added to the Safe Mode registry keys so it starts after the reboot.
• On ESXi: virtual machines going offline en masse, snapshots removed, ransom notes under /vmfs/volumes.

Caution. The unrelated 2017 malware also named "Akira" is a different family; early tooling for one does not apply to the other.

Akira affiliates concentrate on edge devices and identity, rarely relying on user clicks.

1. VPN and remote access without MFA. This is the first entry vector listed in the CISA advisory: credential stuffing, brute force, or accounts bought from initial access brokers used to log straight into SSL VPN, followed by lateral movement. Associated flaws include Cisco ASA/FTD CVE-2020-3259 and CVE-2023-20269, and SonicWall SSL VPN CVE-2024-40766. MFA alone is not immunity: in September 2025 Arctic Wolf observed Akira logging into SonicWall SSL VPN accounts that had OTP enabled, most likely reusing credentials and OTP seeds stolen before the appliance was patched. Any device that was exposed needs all VPN credentials and OTP seeds reset — patching alone is not enough.

2. Backup and virtualisation component flaws. Veeam Backup & Replication CVE-2023-27532 and CVE-2024-40711 are exploited repeatedly — take the backup server first, destroy backups, then encrypt. This is the classic Akira path to "production and backups gone together".

3. Exposed RDP and weak credentials. Internet-facing 3389 and a shared local administrator password across the domain are both exploited quickly.

4. Phishing and remote-tool abuse. A minority of cases start with phishing delivery or abuse of legitimate remote tools such as AnyDesk and RustDesk.

Once inside, the pattern is consistent: harvest credentials with Mimikatz or LaZagne, map the domain and network with AdFind, Advanced IP Scanner and SoftPerfect, create a domain admin account, push the encryptor through PsExec or Group Policy, exfiltrate with Rclone, then encrypt everything outside business hours. On ESXi, Akira uses vim-cmd to power off guests and delete snapshots before encrypting the VMDKs, maximising the blast radius.

Algorithms. The CISA advisory describes a hybrid scheme: ChaCha20 for file (or block) data, with the ChaCha20 key wrapped by the attacker's RSA public key and appended to the file. Because the private key never leaves the operators, recovering keys from ciphertext alone is not mathematically feasible.

Intermittent / partial encryption. The encryptor chooses full or partial encryption based on file type and size. Small files are encrypted end to end; large files get a subset of blocks encrypted with stretches skipped in between. That is why Akira can finish an entire virtualisation cluster in hours — and it is also what leaves room for recovery: in large .vmdk, .mdf/.ndf or .dbf files, untouched ranges still hold original data. The exact ratio depends on build and command-line switches and must be measured per case, never assumed.

Destructive actions.

• Deletes all volume shadow copies via PowerShell against Win32_ShadowCopy.
• Stops and disables database, Exchange and backup-agent services so files can be opened exclusively.
• Clears event logs and deletes itself.
• On Linux/ESXi, powers off guests and deletes snapshots before encrypting; since June 2025 it has also been observed encrypting Nutanix AHV environments, the first publicly reported case for this group.

Double extortion. Data is exfiltrated before encryption, so negotiation covers both decryption and non-publication; non-payers are posted to the leak site and released in stages.