Akira

Profile

Akira is an affiliate-operated ransomware family that combines system encryption with prior data theft to pressure victims (double extortion). Its operators gain access mainly in two ways: abusing corporate remote access (credential spraying against SonicWall SSL VPN without MFA, followed by RDP use) and distributing trojanized installers of legitimate software, such as a fake ManageEngine OpManager installer promoted through SEO poisoning. A documented July 2025 intrusion shows a fast chain: initial access with the BumbleBee loader, command and control via AdaptixC2, lateral movement, credential dumping and exfiltration, with ransomware deployed in roughly 44 hours. Affiliates rely on legitimate and administrative tooling to stay under the radar, and have even attempted to reboot machines into Safe Mode to disable EDR, a tactic that in at least one case caused the encryption to fail. Victim selection appears opportunistic rather than sector-specific; incidents have been observed involving victims in Ukraine.

Initial access

• Credential spraying against SonicWall SSL VPN without MFA
• RDP abuse with valid credentials
• SEO poisoning
• Trojanized ManageEngine OpManager installer

Tools

BumbleBee (loader), AdaptixC2 (command and control), RustDesk (remote access), FileZilla (exfiltration), s5cmd (cloud storage transfer), lsassy (credential dumping), wbadmin.exe, bcdedit, msconfig.exe

What defenders should watch

• Enforce MFA on all VPN access (especially SonicWall SSL VPN) and on RDP, apply account lockouts, and alert on bursts of failed authentications typical of credential spraying.
• Monitor and alert on bcdedit and msconfig.exe usage to configure Safe Mode boots: this is used to disable EDR before encryption.
• Watch wbadmin.exe and any deletion of backups or shadow copies; keep offline, immutable backups outside the domain.
• Detect unauthorized exfiltration and remote access tooling (FileZilla, s5cmd, RustDesk) and restrict execution via allow-listing.
• Control downloads of administration software (e.g. ManageEngine OpManager) by mandating official sources and signature verification, given the use of trojanized installers spread via SEO poisoning.
• Dwell time between initial access and encryption can be under 48 hours: prioritize early detection of credential dumping (lsassy, LSASS access) and C2 traffic.

Priority mitigations

MITRE ATT&CK mitigations that cover the most techniques used by this group.

1. Audit (6 techniques covered)
2. User Account Management (5 techniques covered)
3. Disable or Remove Feature or Program (5 techniques covered)
4. Privileged Account Management (4 techniques covered)
5. Execution Prevention (4 techniques covered)
6. User Training (3 techniques covered)
7. Network Segmentation (3 techniques covered)
8. Multi-factor Authentication (3 techniques covered)

MITRE ATT&CK techniques

Recent victims

Sources analysed

• Akira Affiliate Crashes Ransomware After Attempting EDR Evasion (Infosecurity Magazine, 8/13/2026)
• From Bing Search to Ransomware: Bumblebee and AdaptixC2 Deliver Akira (The DFIR Report, 6/29/2026)