Unmasking Akira: The Ransomware Tactics You Can’t Afford to Ignore

The ransomware group Akira has been ravaging UK businesses since at least 2023. This brief goes over what Solace Cyber have seen in the past two years. Solace Cyber have seen devastating impacts to UK businesses from the same group affecting the industries of retail, finance, manufacturing and medical organisations. Solace Cyber have encountered over 30 businesses impacted by Akira during digital forensics and incident response (DFIR) engagements.

These key observations are based on over 16 cases performed by the DFIR teams of Solace Cyber.

Attack Stage – Key Findings

Initial access

All initial access methods identified by Solace Cyber have resulted in the threat actor leveraging enterprise gateways for access to the wider estates in all cases observed.

Between 2023 to late 2024, the main method of entry seen by Solace Cyber was the abuse of Cisco ASA firewalls to gain initial access. In the majority of the cases, this was either due to the lack of MFA on accounts and exploitable firewalls vulnerable to a remote “brute force” vulnerability (CVE-2023-20269) and CVE-2020-3259, a memory disclosure vulnerability which can be used to retrieve credentials without authentication.

From late 2024 to the present day, the most common initial access method by Akira is the abuse of SonicWall SSLVPNs, primarily the same methods are used with this line of firewall product. Password-based attacks against local VPN accounts and accounts linked to Active Directory. The use of CVE-2024-40766 is a high contributing factor.

During 2025, the first cases were observed originating from the SSLVPNs of Watchguard appliances, indicating that Watchguard appliances are now on Akira’s scopes going forward.

Discovery

The most common discovery utilities seen in use by Akira:

1. Netscan seen in over 31% of cases.
2. Advanced Port Scanner 25% of intrusions
3. Advanced IP Scanner 12.5%
4. Powershell discovery methods:

• • In the incidents where PowerShell use was observed for discovery, the following commands were run to collect information on all AD users, Computers, Groups, Subnets, Organisational Units, AD trusts and domain controllers.  Due to this, the following TXT files were created by the threat actor in these cases: AdSubnets.csv, AdGroups.txt, AdOUs.csv, AdComputers.txt, AdUsers.txt and AdTrusts.txt.

In less than <6% of cases, the use of the following utilities was witnessed to be utilised by Akira:

1. Powerview – Invoke ShareFinder module
2. Sharpshares for Share discovery.
3. Grixba to collect information on remote systems, installed security products and software. Browsing history, processes and network information. The creation of the file ExportData.db was seen in cases where the utility was run. Initially seen to be used by the PLAY ransomware group as reported by Symantec.
4. AD enumeration tools that can be used to find weaknesses in Active Directory were also seen in the form of Pingcastle and Sharphound with the creation of multiple JSON files such as DATE_gpos.json, DATE_users.json and the DATE_BloodHound.zip.
5. Virtual machine enumeration was observed with the use of a utility called RvTools to enumerate VMware virtual machines' configuration, hostname and network configuration.

Akira are well known at Solace Cyber to use methods of command and control, with the most common method being the use of the RMM tool AnyDesk, which was seen in more than 43% of Akira incident response cases. The second method is the use of OpenSSH for remote access, which was seen in at least 18.75% of cases.

In the minority <6% of cases the following tools were utilised:

1. The use of Chrome Remote Desktop was observed, where the following PowerShell Command was run to configure remote access.

2. Akira has been seen to use reverse shells on ESXi hosts for remote access.

3. In at least two cases, the protocol tunnelling utility called “Ligolo-ng” was utilised by executing a base-64 encoded command. The tool allows the threat actor group to access the network just like if they were connected over the VPN, allowing their machines access to the organisation's network directly, as well as potential protocol tunnelling of FTP traffic to the threat actor's tunnelled server.

4. In a small number of cases, the threat actor was observed to use CobaltStrike beacons to remain in the environment.

Where C2 methods were absent, the window of the incident is usually short; thus, in these cases, it is probable that the threat actor didn’t deem it necessary to deploy methods of remote access into the environment and remained connected via the SSL VPN. Alternatively, the forensics was damaged by encryption upon all retrieval.

Where the threat actor is targeting the Windows operating system for later encryption, the majority have manual removal and disablement of security tooling where the threat actor has obtained sufficient administrator privileges and where no password protection measures preventing the removal of Antivirus products or EDR products were seen. The simple use of the control panel and pressing uninstall is enough in sadly a large portion. Additionally, in 48.57% of cases, Windows Defender was inhibited manually or via automated methods. In multiple cases, the PowerShell commands to disable defender protection measures were observed:

In less than 6% of cases:

1. Manual defender exclusions were found where the threat actor excluded the ransomware payload from detection by adding the exclusions of the ransomware payload and the whole C:\ drive.
2. Where EDR / AV protection measures hindered the threat actor, the creation of virtual machines to encrypt via SMB was seen in a small number of cases that were Hyper-V environments. In these cases, the ransomware payload was executed within the newly created Virtual Machine to impact systems with EDR / AV.
3. In cases where NAS devices were used as file systems rather than being primarily used for backups, the threat actor disabled malware protection features via the web portal on the NAS devices.

In the remaining cases where no hindrance to the threat actor was observed, defence evasion techniques were not observed and were likely considered unnecessary, as the ransomware was executed directly and exclusively on the hypervisors’ datastores containing the virtual machine disks. This limited the need for traditional evasion, with encryption occurring directly on the ESXi hosts or Hyper-V hosts.

In all Akira cases, by incident responders at Solace Cyber, encryption was observed in 100% of all incidents.

During incidents, it has been observed that Akira targets backup devices and systems relating to backups, including QNAP devices or other generic NAS devices that were linked to backup servers. It is common to see the group perform a format/wipe the disks and perform a factory reset of these devices. Usually, the source of the credentials is either due to the Veeam password credential dumping or due to the devices being AD joined, where the account is compromised and leveraged to perform the format. In cases where NAS devices are used as a file store, the network share can be encrypted or directly encrypted with the Akira payload via SSH.

Due to Akira predominantly targeting hypervisors, it isn’t always necessary for the group to disable security products on hosts. Once on ESXi hosts with SSH enabled, there aren’t many measures that will stop Akira from running the Linux variant.

The method of encryption can vary, where scenarios can include:

• Virtual Disk–Level Encryption (Endpoints Unaffected)
  • Core virtual machines are encrypted at the virtual disk level (VMDKs and VHDXs)
  • Endpoints (laptops/desktops) are typically left unencrypted
• Full Environment Encryption
  • Both servers/endpoints at the OS layer (Applications and data) and virtual disks within Hyper-V or ESXi are encrypted (VMDKs and VHDXs).
• In-Guest Encryption Only / Physical Devices
  • Virtual disks remain untouched
  • Instead, the ransomware operates within the VMs, physical servers, and endpoints, encrypting their contents (Applications and data)

The following names for the ransomware payload have been identified, usually with short names that are generic across multiple incidents. w.exe, akira.exe, lck.exe, lock.exe, locker.exe, pr.exe, n.exe, s.exe, aki.exe, win.exe, esx, winlocker.exe and hello.exe.

The ransomware payload has been seen to run directly on the hosts of one or more categories within incidents:

• Hyper-V Disks and Hyper-V OS - >43.75%
• Physical Servers, Laptops and Desktops running Windows OS - >43.75%
• VMware ESXi Datastores - > 31.25%
• NAS - > 6.25%

ESXI

Common execution commands for the ransomware payload on ESXi include the threat actor using “chmod +x” to make the file executable before running the encryptor. Then running the encryptor with multiple command line switches.

The redacted entry is the payload name.

Encryption Switches

Throughout cases, the percentage of encryption instructed can vary.

Windows

The method of execution can vary, where the threat actor predominantly runs the encryptor using PowerShell or Command Prompt as an administrator account. The execution of the Akira payload on Windows devices provides a forensic artefact where the encryptor leaves multiple log files usually within the same directory from which the encryptor was run, in the naming convention of:

“Log-DD-MM-YYYY-HH-MM-SS.txt”.

The Akira ransomware payload for Windows uses many of the same switches, where “-p” denotes the path for the encryptor to target. Here you can see the ransomware payload running from “C:\PerfLogs” targeting virtual machine disks of a Hyper-V host and the whole D and E drives. In this scenario, the threat actor left the command prompt window open, leaving the evidence on the active RDP session window.

Upon encryption, the ransomware payload appends files with “.akira” and within each folder where the encryptor has run, it dumps a TXT file called “akira_readme.txt”. This applies in both ESXi and Windows environments.

In the same intrusion on another Command Prompt window, the threat actor instructed the ransomware payload to encrypt endpoint devices, laptops, and desktops remotely with the command line switch “-remote” followed by the network path of the system to target.

In more than 6.25 % of cases, Akira have been observed to run the ransomware payload via GPOs (Group Policy Objects) to attempt to achieve a wider impact if and when new systems come online, for example, Monday morning when employees first get to the office.

Upon encryption, the ransomware payload appends the file with “.akira” and within each folder where the encryptor has run, it dumps a TXT file called “akira_readme.txt”. This applies in both ESXi and Windows environments.

After the encryption has set its course, occasionally the victim organisation is contacted. In most cases, this is a mass email to all employees or to the senior leadership teams. Interestingly, every observed case by Solace Cyber where Akira sent emails used Gmail accounts (e.g., [email protected]).

Solace Cyber has observed this email-contact scenario in about 18.75% of intrusions. These emails usually repeat the same information found in the ransom note left on infected systems.

Occasionally, the attackers will follow up with a link to a “proof of life” package, a set of stolen sample data intended to prove they really have the victim’s files.

Akira, in most cases, where the exfiltrated data is acquired, will list the organisation first within the news section of the DLS. After a varied amount of time, after the company is listed within the news section, usually 2 weeks to up to 8 weeks, but can be longer, the victim will then be listed within the leak section of the site. Some do not appear at all as a company name and are bundled with multiple organisations in a single leak post.

Instead of hosting the files directly, Akira shares magnet or torrent links.

This makes it very difficult to take down the leaked data, since torrents are hosted by many “seeders” on public trackers, making them widely and persistently available.

Known Hostnames

Hostname of TA Machine – Source of Hostname

ASNs Observed

ASN – Organisation

File-based IOCs

ASN – Organisation