Akira ransomware: an anatomy from initial access to the graph that catches it

Executive summary

Akira is a ransomware-as-a-service (RaaS) family first observed publicly in early 2023. It has remained one of the more consistently active double-extortion operations since — steal the data first, encrypt second, and pressure the victim with a leak site if the ransom is not paid. Across public reporting and our own engagements, the operation shows the hallmarks of a mature affiliate programme: a core group maintains the encryptors, negotiation infrastructure, and leak site, while affiliates carry out intrusions and share proceeds.

Two technical characteristics matter most for defenders. First, Akira ships in more than one flavour. A Windows encryptor targets file servers and workstations; a separate Linux/ESXi variant targets virtualisation hosts and encrypts virtual-machine disk images directly, which lets a single well-placed detonation take down dozens of guests at once. Public reporting has also noted lineage between the original C++ codebase and a later Rust-family encryptor — sometimes discussed under the "Megazord" name — but the operational tradecraft has stayed recognisably consistent across generations, and that tradecraft is what this piece is about.

Second, Akira is not a novel-exploit operation. Its edge is operational discipline against boring, well-known weaknesses: internet-exposed VPN and edge appliances that lack multi-factor authentication, valid credentials that are reused or brute-forceable, and the near-universal habit of leaving backup and virtualisation infrastructure in the same trust zone as everything else. The attack chain reads, stage by stage, like a checklist of things most enterprises already know they should have fixed. That is exactly why it works — and why the detection story is less about a single clever signature and more about seeing the whole path.

Initial access

Akira intrusions begin, overwhelmingly, at the network edge. The dominant pattern across public reporting is exploitation or abuse of remote-access services that sit directly on the internet: SSL VPN portals, remote-desktop gateways, and management interfaces of edge appliances.

VPN appliances without MFA (T1133)

The single most reported entry vector is a VPN concentrator reachable from the internet that either has a known unpatched vulnerability or — just as often — is fully patched but permits password-only authentication with no second factor. Where a vulnerability is involved it is typically a disclosed CVE in a mainstream SSL VPN product for which a public proof-of-concept already exists. Where no vulnerability is involved, the appliance simply accepts a valid username and password, and the attacker has both. This maps cleanly to MITRE ATT&CK T1133 — External Remote Services.

Valid-account abuse and brute force (T1078, T1110)

Credentials arrive by several routes: reuse of passwords exposed in unrelated breaches, credentials harvested by prior commodity infostealer infections, and straightforward password spraying or brute force against exposed remote services (T1110 — Brute Force). Once inside, the attacker is authenticating as a legitimate user against legitimate services — T1078 — Valid Accounts — which is precisely why so many of these intrusions survive traditional perimeter monitoring. There is no exploit payload to catch; the traffic looks like a user logging in, because it is.

Purchased access and web-facing exploitation (T1190)

A meaningful fraction of intrusions begin with access purchased from an initial-access broker who did the front-door work earlier. And in a minority of cases the entry is a directly exploited internet-facing application — T1190 — Exploit Public-Facing Application — rather than a VPN. The common denominator across all of these is that the attacker lands with either a valid identity or code execution on an internet-facing system, and rarely both from a novel zero-day.

"Nine out of ten of the Akira cases we've worked started at a VPN box with no MFA. The malware is almost the least interesting part. By the time the encryptor runs they've already owned the domain for two days, and the only reason nobody noticed is that every step used a real account doing a plausible thing."

— incident responder, Indian MSSP

Execution and discovery

After initial access the operation goes quiet and methodical. The defining trait of this phase is living-off-the-land: rather than dropping bespoke tooling that endpoint controls would flag, the attacker uses the administrative utilities already present on the estate.

Living off the land

PowerShell is the workhorse. Native Windows utilities such as net, nltest, whoami, ping, and net group "Domain Admins" are used to enumerate the domain. Legitimate remote-administration and remote-monitoring tools — the same kind an IT team installs deliberately — are frequently repurposed for persistence and remote control, precisely because they are signed, expected, and often allow-listed.

Credential access (T1003)

To move beyond the initial identity the operation harvests more credentials. The canonical technique is dumping credential material from the memory of the local security authority — LSASS-style dumping, T1003 — OS Credential Dumping — to recover cached domain credentials and, ideally, a privileged account. Kerberoasting-style extraction of service-account tickets and the harvesting of credentials from disk are also within the standard repertoire.

Discovery (T1087, T1018, T1482)

With elevated credentials the attacker maps the environment. Account discovery (T1087) enumerates users and privileged groups; remote-system discovery (T1018) inventories reachable hosts; and domain-trust discovery (T1482) maps the trust relationships that determine how far a given identity reaches. This is where the intrusion is at its most graph-like — the attacker is, in effect, building a mental model of the same reachability graph a defender should already have.

Lateral movement (T1021)

Movement between hosts uses the protocols an administrator would use: RDP and SMB (T1021 — Remote Services). The attacker walks from the initial foothold toward high-value targets — domain controllers, file servers, the backup infrastructure, and the virtualisation management plane — hopping via valid credentials over expected ports. Every hop looks, in isolation, like normal administrative traffic.

Defense evasion and recovery inhibitors

Before detonation the operation works to blind the defender and destroy their ability to recover without paying. This phase is where intent becomes unmistakable, and where a well-instrumented environment gets its clearest shot at catching the intrusion before impact.

Disabling and evading endpoint tooling

Akira affiliates routinely attempt to disable, uninstall, or otherwise neutralise endpoint protection. Techniques reported publicly include stopping security services, deleting or corrupting agent components, and — where a vulnerable signed driver is available — bring-your-own-vulnerable-driver (BYOVD) approaches that terminate protected processes from the kernel. The tell is not the specific technique but the timing: security tooling going dark on multiple hosts within a short window, shortly before anything else happens.

Volume Shadow Copy deletion (T1490)

Almost every Akira encryption event is preceded by deletion of Windows Volume Shadow Copies to inhibit local recovery — T1490 — Inhibit System Recovery. The canonical form is a PowerShell one-liner invoking WMI to enumerate and delete shadow copies, or repeated calls to vssadmin delete shadows. This is one of the highest-fidelity single signals in the entire chain: legitimate administrators very rarely mass-delete shadow copies across many hosts in a compressed time window.

Targeting backups directly

Beyond shadow copies, the operation actively hunts backup infrastructure — backup servers, backup catalogues, and the credentials the backup service account holds. If the attacker can delete or encrypt the backups themselves, the victim's recovery option collapses and the negotiating leverage swings entirely to the attacker. From a graph standpoint the backup server is one of the most consequential nodes in the estate, and it is a primary Akira objective, not an afterthought.

Exfiltration and impact

Akira is a double-extortion operation, so exfiltration precedes encryption. Data theft gives the operators leverage even against a victim who can restore from backups, and it is the mechanism behind the leak-site pressure that defines the family's public face.

Staging and exfiltration (T1567, T1048)

Sensitive data is located, staged, and moved out. Reported tooling favours legitimate file-transfer and synchronisation utilities — the kind of tool a real user might have — used to push archives to cloud storage or attacker-controlled infrastructure. This maps to T1567 — Exfiltration Over Web Service and, where a non-standard channel is used, T1048 — Exfiltration Over Alternative Protocol. The volume and destination are the anomaly: gigabytes leaving a file server toward a cloud endpoint it has never spoken to before (say, 203.0.113.x — illustrative only).

Encryption (T1486)

Only then does the encryptor run — T1486 — Data Encrypted for Impact. On Windows the encryptor targets file shares and workstations, appending a distinctive extension and dropping a ransom note in affected directories. The published cryptography is a hybrid scheme typical of modern ransomware — a fast symmetric stream cipher for file contents, per-file keys wrapped under an embedded public key — and it uses partial/intermittent encryption on larger files to maximise throughput across a volume. It is engineered for speed, and by the time file-modification volume becomes obvious the damage is already substantial.

The ESXi/Linux variant and blast radius

The variant that inflicts the most damage per action is the Linux/ESXi encryptor. Rather than encrypting individual files inside guests, it encrypts the virtual-machine disk images on the hypervisor host directly. A single detonation on a well-chosen ESXi host can take down every VM it runs — often the majority of an organisation's production estate — in one stroke. This is why the virtualisation management plane is such a coveted lateral-movement destination, and why its blast radius should be modelled continuously rather than discovered during an incident.

The leak-site model

Victims who do not pay are named on the operation's leak site, with stolen data published in tranches as a pressure tactic. The ransom note typically states no fixed figure; it directs the victim to a TOR negotiation portal where the amount is set after the operator gauges the victim's size and sensitivity. The double-extortion model means that even a victim with flawless backups faces a data-disclosure decision, which is precisely the outcome the exfiltration phase is designed to enable.

The Akira kill chain, mapped to telemetry

The table below maps each stage of a representative Akira intrusion to the ATT&CK technique, the telemetry that reveals it, and the Netgraph module that carries that telemetry. The point of the mapping is that no single row is decisive — an attacker doing any one of these things is plausibly benign — but the path through them is not.

Stage	Technique (ID)	Telemetry that catches it	Netgraph module
Initial access	External Remote Services (T1133)	VPN auth from new geo/ASN; first-seen source for a user; auth to appliance with no MFA assertion	SIEM auth-failure / auth-anomaly detections
Initial access	Valid Accounts (T1078)	Account authenticating outside its behavioural baseline — new host, new hours, new access pattern	UEBA valid-account anomaly
Initial access	Exploit Public-Facing App (T1190)	Post-exploit child process on an edge/web host; matched exploit indicators	NDR east-west + TIP indicator-match
Execution	Command & Scripting: PowerShell (T1059.001)	Encoded/obfuscated PowerShell; anomalous parent-child (e.g. VPN service → powershell)	EDR process-tree
Credential access	OS Credential Dumping — LSASS (T1003.001)	Non-standard process opening a handle to the LSASS process; credential-store access	EDR process-tree
Discovery	Account / Domain-Trust Discovery (T1087, T1482)	Burst of net/nltest/AD enumeration from a single host in a short window	EDR process-tree + SIEM detections
Lateral movement	Remote Services: RDP/SMB (T1021)	Internal RDP/SMB fan-out from one source to many hosts; admin protocol from a non-admin host	NDR east-west
Defense evasion	Impair Defenses / BYOVD (T1562, T1211)	Security service stopped/uninstalled; vulnerable-driver load; agent going dark across hosts	EDR process-tree + tamper-protection alerts
Recovery inhibition	Inhibit System Recovery — VSS (T1490)	vssadmin delete shadows / WMI shadow-copy deletion; mass shadow deletion across hosts	Backup/VSS-deletion detection
Recovery inhibition	Backup targeting (T1490 / T1078)	Interactive access to the backup server/console from an unusual identity or host	DSPM sensitive-host + UEBA
Collection	Data from Network Shares (T1039)	Anomalous read volume from file shares; access to sensitive stores by a new principal	DSPM sensitive-data-on-host
Exfiltration	Exfil Over Web Service / Alt Protocol (T1567, T1048)	Large outbound transfer to a first-seen cloud/file-transfer destination	NDR east-west + egress monitoring
Impact	Data Encrypted for Impact (T1486)	Mass file-rename/modification; ransom-note write pattern; ESXi datastore write burst	EDR process-tree + NDR (ESXi)
Validation	Coverage of the full chain	Replaying the Akira playbook end-to-end and reading back which stages fired	Attack-simulation coverage validation

The modules above are the ones Netgraph actually ships: EDR process-tree telemetry, NDR east-west visibility, UEBA baselining of accounts, SIEM detection content, DSPM sensitive-data discovery, TIP indicator matching, and the attack-simulation harness that validates the chain end-to-end. See EDR, NDR, and attack simulation for the module-level detail.

An illustrative detection: mass shadow-copy deletion

Of every signal in the chain, the mass deletion of Volume Shadow Copies is among the highest-fidelity. Below is an illustrative Netgraph NQL detection — a worked example, not a query against real telemetry — that fires when shadow-copy deletion is observed across more than a small number of hosts within a short window. The multi-host threshold is what separates a routine admin action from an intrusion inhibitor.

# ILLUSTRATIVE — Akira recovery-inhibition (VSS mass deletion)
# NQL detection example; not run against real telemetry.

FROM logs
  WHERE ingest_time > now() - INTERVAL 30 MINUTE
    AND event.category = "process"
    AND (
          process.name IN ("vssadmin.exe", "wmic.exe", "powershell.exe")
      AND (
            process.command_line CONTAINS "delete shadows"
         OR process.command_line CONTAINS "Win32_ShadowCopy"
         OR process.command_line CONTAINS "shadowcopy delete"
      )
    )
  | STATS
        distinct_hosts = count_distinct(host.name),
        first_seen     = min(ingest_time),
        last_seen      = max(ingest_time)
      BY rule = "AKIRA-VSS-DELETE"
  | WHERE distinct_hosts >= 3
  | ALERT
        severity = "critical",
        title    = "Mass Volume Shadow Copy deletion — ransomware pre-encryption",
        mitre    = "T1490"

# Tuning notes:
#   - Threshold distinct_hosts >= 3 suppresses single-host admin activity.
#   - Pair with the EDR process-tree parent (e.g. a non-admin parent
#     spawning powershell.exe) to raise confidence further.
#   - On the graph, pivot from any matched host to its reachable
#     crown-jewel set to gate response by blast radius.

A single host running vssadmin delete shadows during a maintenance window is unremarkable; three or more hosts doing it inside thirty minutes, with PowerShell parents that trace back to a VPN service account, is an intrusion in progress. The detection is deliberately simple — the discrimination comes from the multi-host aggregation and the graph pivot, not from a clever regex.

Why the graph catches Akira that a flat SIEM misses

Every individual Akira technique can be written as a flat SIEM rule, and mature SOCs have most of them. The problem is that Akira's tradecraft is specifically designed to keep each individual event beneath the threshold of suspicion — a valid login, an administrative protocol, a signed tool, a plausible file transfer. What makes the intrusion legible is the relationship between the events, and relationships are exactly what a flat, row-oriented event store discards.

Lateral movement as a path pattern

A flat SIEM sees a login on host A, a login on host B, and a login on host C as three unrelated rows. A property graph sees a path: identity X moved from A to B to C, and each hop inherited the credential harvested at the previous one. The path is the signal. Detecting "an account authenticated to a host" is nearly useless at Akira's volume of legitimate administrative traffic; detecting "an account traversed six hosts it has never touched before, terminating at the backup server" is decisive. That traversal is a native graph query and an expensive, brittle self-join in a flat store.

Blast radius: what the compromised host can reach

When an analyst triages the first Akira alert, the question that determines the response is not "what has this host done?" but "what can this host reach?" On the graph that is a bounded traversal outward from the compromised node across privileged edges — service-account bindings, cached credentials, RDP reachability, backup and hypervisor management access. The answer tells the responder in seconds whether this foothold is one hop from the crown jewels or safely isolated, and lets them gate containment accordingly. A flat SIEM cannot answer the question at all; it has no representation of reachability. The mechanics are laid out in blast radius as a first-class concept.

# Anti-Akira reachability triage, in pseudocode
# Given a host or identity that tripped any lifecycle detection,
# answer "what could the intruder reach from here?" — not just "what happened?"

START FROM suspect_node n
WITH edges_of_interest = {AUTHENTICATES_AS, BIND_SVC, CAN_ACCESS,
                          HOSTS, READS_SECRET, READS_DB}
WITH depth_limit = 4

FOR each edge e OUT OF n IN edges_of_interest:
    target t = head(e)
    record (n, e, t, depth=1)
    IF t IS in {domain_controller, hypervisor_mgmt,
                backup_mgmt, secret_store, data_store}:
        FLAG as critical reachability          # pre-position monitoring here
    RECURSE from t WITH depth+=1 UNTIL depth_limit

RETURN sorted reachable_set BY criticality DESC

Retro-replay: "were we already hit?"

Akira's TTPs evolve, and every time a fresh advisory publishes new indicators or a new encryptor build, the honest question is whether the estate was already touched before the detection existed. A graph substrate over retained raw telemetry lets a defender author the new detection the day it publishes and replay it against the preceding weeks or months — answering "were we already hit?" instead of only "will we catch it next time?" Given that Akira's dwell time between initial access and encryption is frequently measured in days, retro-replay is the difference between catching an intrusion mid-dwell and reading about yourself on a leak site. See retrospective detection.

The ESXi variant's blast radius, pre-computed

Because the Linux/ESXi encryptor detonates on the hypervisor, its blast radius is the set of guests each ESXi host runs — a fact the graph already holds as HOSTS edges. That means the most catastrophic Akira outcome can be modelled before any incident: which hypervisor hosts, if reached, would take down which production services, and how many hops separate each of them from the nearest internet-facing foothold. The graph turns the ESXi blast radius from a post-mortem discovery into a standing risk metric. The conceptual underpinning is covered in the graph-native correlation whitepaper.

Detection and hardening checklist

The controls below are ordered roughly by leverage. None are exotic; the Akira operation persists precisely because they remain unevenly implemented. Validate each one against the actual Akira playbook rather than assuming coverage — the attack-simulation harness exists to run exactly that test.

For the wider ransomware landscape this operation sits within, see our review of the top ransomware attacks of H1 2026. For the module-level treatment of the detections referenced throughout, see EDR, NDR, and attack simulation; for the substrate that makes path and blast-radius detection possible, the graph-native correlation whitepaper. Practitioner questions are answered in the Netgraph FAQ.

About this research

Authored by Autocops Desk. Akira is a real, publicly-documented ransomware-as-a-service family first observed in 2023; this anatomy synthesises widely-corroborated public reporting patterns with generalised incident-response experience. First published 14 August 2026.

Disclosure ethics: all techniques described here are documented in public threat reporting. Indicators, hashes, and addresses shown are illustrative placeholders, not real observables — apply current threat intelligence for live IOCs. Where technique specifics could enable opportunistic harm we have summarised categorically rather than published step-by-step detail. Apply available vendor patches and the structural controls above before relying on any detection pattern in isolation.