Organizations should fix VPN logins first, then RDP movement paths and Active Directory exposure. Akira ransomware is a double-extortion operation that steals data before encrypting systems and virtual machines. CISA reports Akira affiliates claimed about $244.17 million by late September 2025 in its updated joint advisory. The FBI's 2024 Internet Crime Report named Akira among the five most-reported ransomware variants.
Table of Contents
- How does Akira get inside?
- How does it spread after login?
- Why do backups fail?
- What should you fix next?
How does Akira get inside?
CISA says affiliates gain initial access by stealing VPN credentials or exploiting VPN flaws. That makes remote access the first system to fix, not the last.
In an Aug. 4, 2025 intrusion described by Huntress, the affiliate entered through a SonicWall SSL VPN without MFA after credential spraying, according to its Huntress analysis. CISA also assesses likely abuse of SonicWall flaw CVE-2024-40766 for initial access.
How does it spread after login?
After entry, CISA says affiliates use RDP for lateral movement and enumerate Active Directory before extortion. In the August 2025 case, the intruder pivoted to the domain controller over RDP.
That pattern points to three concrete fixes. Limit RDP between workstations, servers, and domain controllers. Remove stale accounts, tighten privileged groups, and watch for unusual directory queries.
Why do backups fail?
Akira exfiltrates data before encryption, so restoring files does not remove the leak threat. The operation first hit Windows systems, then deployed a Linux variant against VMware ESXi virtual machines starting in April 2023.
The target list keeps widening. CISA reports a June 2025 incident encrypted Nutanix AHV virtual-disk files, beyond VMware ESXi and Hyper-V. Separate virtual-machine backups from the main domain, test restores, and monitor large outbound transfers.
What should you fix next?
CISA, the FBI, EC3, and NCSC-NL urge recovery plans, MFA everywhere especially on VPNs, traffic filtering, disabled unused ports, system-wide encryption, and testing against listed MITRE ATT&CK techniques in its CISA alert on the advisory. In the August 2025 attack, the affiliate rebooted into Safe Mode with Networking to disable EDR and Defender. Encryption still failed from low virtual memory, but Huntress warns affiliates can retool, so do not count on that failure repeating.
- Enforce MFA on VPN and all remote accounts
- Patch VPN appliances quickly, including CVE-2024-40766
- Block or gate RDP and disable unused ports
- Harden EDR against Safe Mode tampering and test recovery plans
You Might Also Like
- Cybersecurity — Salt Typhoon: What Organizations Should Fix Next
- BlackCat Ransomware: Common Scams and Follow-Up Threats
- Ransomware as a Service for Consumers: Warning Signs and Protective Steps