Ransomware group profile · #3 by claimed victims
Akira ransomwarealso Megazord
High-volume operation that grew primarily by exploiting VPN appliances where multi-factor authentication was not enforced. Technically unremarkable and commercially very effective.
RussiaVictimology
Who Akira claims to have breached, from 1,658 leak-site posts recorded by VULONE.
Claims per month last 12 months
Top sectors
Top countries
Latest claimed victims 12 most recent
| Victim | Sector | Country | Claimed |
|---|---|---|---|
| FrenchCreek Production | Energy & Utilities | US | 30 Oct 2026 |
| Hudson & Hudson Sign Products | Manufacturing | US | 30 Oct 2026 |
| Service One Transportation | Transportation | - | 30 Oct 2026 |
| Trulife trulife.com | Healthcare | - | 28 Oct 2026 |
| Roberts Consulting Services jsrconsulting.com | Professional Services | - | 28 Oct 2026 |
| Insurance Services | Financial Services | - | 28 Oct 2026 |
| Bankruptcy Software Specialists | Professional Services | - | 23 Oct 2026 |
| Bravilor Bonamat | Manufacturing | NL | 23 Oct 2026 |
| SCHWAB-SYSTEM | Financial Services | DE | 23 Oct 2026 |
| Bethany Press International | Retail & E-Commerce | - | 22 Oct 2026 |
| Medienwerkstatt | Education | DE | 22 Oct 2026 |
| Annapath | Not Found | - | 22 Oct 2026 |
NLAll 1,658 Akira victims, searchable
Full victim list with claim posts, domains, timing and exports, plus the negotiation chats and leak-site screenshots VULONE archives for this crew.
Tactics, techniques and procedures
6 MITRE ATT&CK techniques mapped to Akira from public advisories and VULONE's own analysis.
| Tactic | Technique | Procedure | Confidence |
|---|---|---|---|
| Initial Access | T1078 Valid Accounts | Valid accounts obtained from brokers and infostealer logs. | Confirmed |
| Initial Access | T1133 External Remote Services | Cisco VPN appliances reached with valid credentials where MFA was absent, including exploitation of CVE-2023-20269. | Confirmed |
| Credential Access | T1003.001 LSASS Memory | Credential dumping to broaden access. | Confirmed |
| Exfiltration | T1567.002 Exfiltration to Cloud Storage | Rclone, FileZilla and WinSCP to move stolen data out. | Confirmed |
| Impact | T1486 Data Encrypted for Impact | ChaCha20 encryption, with a Rust build named Megazord aimed at ESXi datastores. | Confirmed |
| Defense Evasion | T1562.001 Disable or Modify Tools | PowerTool and similar utilities to terminate endpoint protection. | Confirmed |
Tooling observed
Indicators, detections and the full playbook
Hashes, C2 addresses, onion services, Sigma and YARA detections per technique, and the negotiation transcripts are available to signed-in analysts.
Attack playbook
How a typical Akira intrusion unfolds, section by section.
Initial access
One missing control, at scale - The overwhelming majority of Akira intrusions begin at a VPN account without a second factor. There is no clever tradecraft to emulate here, which is precisely the point: the control that stops them is unglamorous and fr…
Frequently asked
Is Akira ransomware still active?
How many victims has Akira claimed?
Which industries does Akira target?
Which countries are most affected by Akira?
Where does VULONE get Akira victim data?
Public sources
| Title | Publisher | Date |
|---|---|---|
| #StopRansomware: Akira Ransomware (AA24-109A) | CISA / FBI / Europol / NCSC-NL | 18 Apr 2024 |
Other ransomware groups
Qilin
Lockbit3
Clop
RansomhubVictim claims are collected from leak sites and enrichment partners (ransomware.live, RansomLook) and represent the group's own assertions, not confirmed breaches. Profile last updated 31 October 2026. Questions or corrections: research@vulone.com.
