Podcasts
Ransomware Leak Sites
Akira
Active Since
March 2023
Total victims as of January 2024
182
Known Forum Aliases
N/A
Active Forum Accounts
N/A
Top Targeted Geographies
US, UK, Canada
Launched in march 2023, Akira has quickly become one of the most active ransomware groups
The gang quickly amassed noteworthy victims including Stanford University, Nissan Australia, and the US consulting firm Frost & Sullivan and in April 2024 the FBI, CISA, Europol’s European Cybercrime Centre (EC3), and the Netherlands’ National Cyber Security Centre (NCSC-NL) issued a joint advisory warning that the group has more than 250 victims, from which it has secured roughly $42 million in ransom payments. Some researchers have ranked Akira as the most prolific ransomware group in operation, following the disruption to LockBit.
Akira appears to be a novel ransomware, written in C++, with versions targeted both at Windows machines and Linux operating systems. It has at least one known variant, dubbed Megazord. It has been observed leveraging known vulnerabilities in VPN appliances to gain initial access to its targets, who typically reside in the commercial & professional services, capital goods, education, and software & services industries. It is also noteworthy for its aggressive tone in its dark web leak site posts.
The group is suspected to have ties to Conti, one of the largest ransomware operations, which disbanded in 2022.
Related Content
Videos
How can you identify ransomware operators targeting you on the dark web?
Knowledge Base
BlackBasta
BlackBasta is a ransomware operation that is notable for its high volume of attacks, use of custom tools, and suspected links to cybercriminal group FIN7.
Knowledge Base
8Base
8Base uses a variant of Phobos ransomware, modified to append a ".8base" extension. Researchers have also noted that 8Base's leak site bears similarities to the data extortion operation RansomHouse.
Knowledge Base
BlackCat
The RaaS group BlackCat (also known as ALPHV or Noberus) is believed to include developers and money launderers from the former DarkSide ransomware group, most infamous for the Colonial Pipeline attack.
Knowledge Base
Cl0p
Cl0p is notable for its approach of using vulnerabilities in supply chain software to target multiple organizations, announcing them in a batch at a later date.
