Also known as GOLD SAHARA, PUNK SPIDER, Howling Scorpius, Storm-1567
Tracked asG1024
Akira is a financially motivated ransomware-as-a-service operation active since March 2023. It uses credential abuse, remote services, phishing, and exploitation of internet-facing infrastructure before credential theft, lateral movement, data exfiltration, and encryption. Its Windows and Linux-family payloads have expanded from VMware ESXi to Hyper-V and Nutanix AHV environments.
A mature extortion operation that couples edge-device access and credential abuse with cross-hypervisor encryption and cloud-assisted data theft.
Actor class
Ransomware-as-a-service operation
Motivation
Financial
Facts
Akira primarily targets small and medium-sized businesses but has also impacted large organizations and critical infrastructure.
The November 2025 joint advisory associates Akira with Storm-1567, Howling Scorpius, PUNK SPIDER, and GOLD SAHARA.
The advisory reports possible connections to the defunct Conti ransomware group without treating Conti as an alias.
Activity timeline
First observed
March 2023
Status
Active
Status as of
2025-11-13
Facts
A Linux variant targeting VMware ESXi appeared in April 2023 after an initial Windows focus.
A June 2025 incident expanded observed encryption to Nutanix AHV virtual-machine disks.
The joint advisory reports approximately $244.17 million in ransomware proceeds as of late September 2025.
Attribution assessment
Facts
Government and vendor tracking names are preserved as source names for the same Akira operation.
A possible connection to Conti is an assessment and is not represented as an exact identity match.
Operational playbook
Stages
Access VPN, RDP, backup, firewall, or other internet-facing services through stolen credentials, phishing, brute force, or vulnerability exploitation.
Create local or domain accounts and gather credentials through Kerberoasting, LSASS access, registry-hive theft, browser data, and credential-dumping tools.
Disable security products and establish remote control or tunnels with common administration tools.
Archive and exfiltrate data through FTP, SFTP, cloud storage, and file-transfer tools.
Encrypt Windows and virtualization workloads, inhibit recovery, and direct the victim to a Tor negotiation site.
Initial access and identity targets
Methods
VPN access without MFA and abuse of valid credentials
RDP and other external remote services
Spearphishing attachments and links
Credential stuffing and brute force
Exploitation of Cisco, SonicWall, VMware, Veeam, and other internet-facing products
Capabilities and evasion
Facts
Akira, Megazord, and Akira_v2 variants cover Windows, Linux, VMware ESXi, Hyper-V, and Nutanix AHV targets.
Early C++ variants used the .akira extension; Rust-based Megazord variants used .powerranges.
Observed tradecraft includes BYOVD defense impairment, PowerShell, WMI, PsExec, credential dumping, shadow-copy deletion, and intermittent encryption.
Remote access and tunneling have included AnyDesk, MobaXterm, RustDesk, Ngrok, Cloudflare Tunnel, and OpenSSH.
Infrastructure patterns
Facts
Victim-specific codes in ransom notes direct affected organizations to a Tor-hosted negotiation service.
Akira has used commodity remote-management, tunneling, FTP, SFTP, and cloud-storage services, which require behavioral context before blocking.
Communication and pressure channels
Channels
Victim-specific ransom note
Tor negotiation site
Data-leak site
Observed targeting
Targeting, not victimization. Sector and regional patterns describe observed impact and targeting. Individual leak-site listings remain claims unless independently confirmed.
Facts
Observed regions include North America, Europe, and Australia.
Preferred sectors include manufacturing, education, information technology, healthcare and public health, financial services, and food and agriculture.
Defender guidance
Measures
Prioritize remediation of known exploited vulnerabilities on internet-facing firewalls, VPNs, virtualization platforms, and backup servers.
Require phishing-resistant MFA for remote access and administrative accounts.
Hunt for unexpected local or domain account creation, RDP or VPN logins, credential-dumping activity, and remote-management tools.
Restrict and monitor Rclone, WinSCP, FileZilla, Ngrok, Cloudflare Tunnel, and similar transfer or tunneling utilities.
Maintain offline backups and regularly test restoration across virtualization and identity dependencies.
Activity timeline
A dated ledger of actor-claimed victims, campaigns, indicators, identity mappings, relationships, and CVE links. Each date states what it measures. For extensive leak-site histories, victim entries are limited to the 100 most recent distinct listings.
Cataloged
IdentityTracking identifier: G1024
Reviewed identity mapping approved on this date.
Claimed
Victim claimBankruptcy Software Specialists listed by Akira
Actor-claimed victim evidence. This listing is not independent confirmation of compromise.
Actor Claimed
Claimed
Victim claimBravilor Bonamat listed by Akira
Actor-claimed victim evidence. This listing is not independent confirmation of compromise.
Actor Claimed
Claimed
Victim claimSCHWAB-SYSTEM listed by Akira
Actor-claimed victim evidence. This listing is not independent confirmation of compromise.
Actor Claimed
Claimed
Victim claimMedienwerkstatt listed by Akira
Actor-claimed victim evidence. This listing is not independent confirmation of compromise.
Actor Claimed
Claimed
Victim claimAnnapath listed by Akira
Actor-claimed victim evidence. This listing is not independent confirmation of compromise.
Actor Claimed
Claimed
Victim claimFlextron Circuit Assembly listed by Akira
Actor-claimed victim evidence. This listing is not independent confirmation of compromise.
Actor Claimed
Claimed
Victim claimCascade Flooring America listed by Akira
Actor-claimed victim evidence. This listing is not independent confirmation of compromise.
Actor Claimed
Claimed
Victim claimBethany Press International listed by Akira
Actor-claimed victim evidence. This listing is not independent confirmation of compromise.
Actor Claimed
Claimed
Victim claimVidek listed by Akira
Actor-claimed victim evidence. This listing is not independent confirmation of compromise.
Actor Claimed
Claimed
Victim claimBoyle, Pecharich, Cline, Whittington and Stallings listed by Akira
Actor-claimed victim evidence. This listing is not independent confirmation of compromise.
Actor Claimed
Claimed
Victim claimSvd (Sun Valley Dairy) listed by Akira
Actor-claimed victim evidence. This listing is not independent confirmation of compromise.
Actor Claimed
Claimed
Victim claimFOODMatch listed by Akira
Actor-claimed victim evidence. This listing is not independent confirmation of compromise.
Actor Claimed
Claimed
Victim claimShediac Lobster Shop listed by Akira
Actor-claimed victim evidence. This listing is not independent confirmation of compromise.
Actor Claimed
Claimed
Victim claimTorns Enterprises listed by Akira
Actor-claimed victim evidence. This listing is not independent confirmation of compromise.
Actor Claimed
Claimed
Victim claimAAA Architectural Hardware listed by Akira
Actor-claimed victim evidence. This listing is not independent confirmation of compromise.
Actor Claimed
Claimed
Victim claimLouis Fusco listed by Akira
Actor-claimed victim evidence. This listing is not independent confirmation of compromise.
Actor Claimed
Claimed
Victim claimYarema listed by Akira
Actor-claimed victim evidence. This listing is not independent confirmation of compromise.
Actor Claimed
Claimed
Victim claimDesign Electric listed by Akira
Actor-claimed victim evidence. This listing is not independent confirmation of compromise.
Actor Claimed
Claimed
Victim claimTigerPress (DCC) listed by Akira
Actor-claimed victim evidence. This listing is not independent confirmation of compromise.
Actor Claimed
Claimed
Victim claimMichael K Shelby, CPA listed by Akira
Actor-claimed victim evidence. This listing is not independent confirmation of compromise.
Actor Claimed
Claimed
Victim claimHygrade listed by Akira
Actor-claimed victim evidence. This listing is not independent confirmation of compromise.
Actor Claimed
First listed
Victim claimThe Official Collegeof Architects of León (COAL) listed by Akira
Actor-claimed victim evidence. This listing is not independent confirmation of compromise.
Actor Claimed
Claimed
Victim claimThe Official College of Architects of León (COAL) listed by Akira
Actor-claimed victim evidence. This listing is not independent confirmation of compromise.
Actor Claimed
Claimed
Victim claimPacific Tank Lines listed by Akira
Actor-claimed victim evidence. This listing is not independent confirmation of compromise.
Actor Claimed
The interactive view includes 109 dated events with category filters and paging.
Identity and attribution
Exact names and tracking identifiers resolve to this canonical profile. Rebrands, affiliations, and overlapping clusters remain separate confidence-rated relationships.
Name map
AkiraCanonical Name
GOLD SAHARAAlias
Howling ScorpiusAlias
PUNK SPIDERAlias
G1024Tracking Id
Storm-1567Alias
Loading CVEs, techniques, indicators, malware, victims, and activity...