Akira

Executive Summary

Akira is a rapidly evolving ransomware-as-a-service operation using hybrid AES‑RSA encryption and multi-threading to speed up data lockout. It targets Windows and VMware ESXi environments in high‑profile sectors like manufacturing and education, demanding payments of $6,500–$10,000 for decryption. Organizations should prepare defensive measures even though the malware’s persistence details remain unclear.

Akira is a modern ransomware family that originated in C++ and later saw iterations written in Rust, such as the Megazord variant tailored for Windows environments and an Akira v2 version targeted at VMware ESXi hosts. The malware is distributed mainly through subscription‑based ransomware‑as‑a‑service (RaaS) platforms operated by a group identified as Akira. Once executed on victim systems—whether consumer or enterprise—it scans for valuable data assets before encrypting them with a dual‑layer scheme: an initial symmetric AES encryption followed by key encapsulation via RSA to accelerate throughput. The codebase employs multi‑threading and accepts runtime arguments, enabling attackers to customize the payload’s reach and behavior on individual campaigns. In operational use, Akira has been linked to ransomware attacks across North America, Europe, and Australia, targeting critical infrastructure sectors such as manufacturing, education, and IT services. The hybrid encryption strategy coupled with dynamic command‑line parameters considerably shortens the attack window and improves stealth by circumventing basic antivirus heuristics. After encryption, victims receive a ransom note that requests payment in cryptocurrency and typically demands a fee ranging between $6,500–$10,000 for the decryption key. While no evidence of data exfiltration has been observed to date, Akira’s RaaS model implies a potential for monetization through sale or resale of stolen credentials and system information. Overall, Akira represents a sophisticated threat that blends fast encryption performance with flexible delivery mechanisms, posing significant risk to organizations that maintain critical operational assets across multiple geographic regions.

Key Capabilities

• Hybrid symmetric/asymmetric encryption (AES + RSA)
• Multithreaded file‑system traversal for faster data locking
• Runtime command‑line arguments to customize attacks
• Ransomware-as-a-Service delivery model
• Targeting of Windows and VMware ESXi platforms
• Focus on critical infrastructure in manufacturing, education, and IT services

ATT&CK Techniques

Recommended Actions

• Implement strict application whitelisting and restrict execution rights for unknown binaries
• Use full‑disk or individual file encryption solutions with regular backups to isolate ransomware impact
• Apply least‑privilege permissions for account access to mitigate potential credential acquisition
• Deploy behavioral detection rules that flag sudden, multi‑threaded encryption activity
• Maintain up-to-date signatures for known Akira families across antivirus platforms
• Implement network segmentation and monitoring for anomalous outbound traffic from compromised hosts

Suggested Tags