Akira Ransomware
Windows & ESXi; double extortion
Source Attribution
- Origin
- MITRE
- Source
- CISA advisory AA24-109A
- Verified
- 2026-08-26T16:07:01.550Z
- Confidence
- high
Source: CISA advisory AA24-109A · Verified: 2026-08-26T16:07:01.550Z · Confidence: high
Security Timeline
- discovered Akira Ransomware first observed
- updated Encyclopedia entry reviewed (Phase 45C)
Quick Answer
Akira is a RaaS observed since 2023 targeting Windows and VMware ESXi with double extortion. (attributes recorded from CISA advisory AA24-109A).
Definition
Akira is a RaaS observed since 2023 targeting Windows and VMware ESXi with double extortion.
Overview
Akira is a RaaS observed since 2023 targeting Windows and VMware ESXi with double extortion.
Behavior
- Data exfiltration before encryption
- ESXi variant
- Russia-oriented leak site
First Seen
2023-03
Target
Windows & ESXi; double extortion
Malware Intelligence
Family: Akira Ransomware
Techniques: T1486, T1567, T1078
Targets: Windows & ESXi; double extortion
Behavior:
- Data exfiltration before encryption
- ESXi variant
- Russia-oriented leak site
References
Have a follow-up question?
Ask AI about this Start an investigation Ask OpenTrojan's evidence-backed assistant about this topic — answers cite their sources.