Akira
MITRE ATT&CK: S1129 View on attack.mitre.org
Aliases: Megazord, Akira
- First seen
- 2023-01-01 00:00:00
- Malware type
- ransomware
- Family
- Malware family
- Operating systems
- windows
- Related IoCs
- 96 (95 malicious)
- Last IoC activity
- 2026-10-17 01:59:09
- Profile updated
- 2026-07-07 13:23:35
Targeted industries: manufacturing education-and-nonprofits technology-and-telecommunications
Targeted regions: country_code:us country_code:ca country_code:au country_code:fr country_code:de
Context
Akira ransomware, written in C++, is most prominently (but not exclusively) associated with the ransomware-as-a-service entity Akira. Akira ransomware has been used in attacks across North America, Europe, and Australia, with a focus on critical infrastructure sectors including manufacturing, education, and IT services. Akira ransomware employs hybrid encryption and threading to increase the speed and efficiency of encryption and runtime arguments for tailored attacks. Notable variants include Rust-based Megazord for targeting Windows and Akira _v2 for targeting VMware ESXi servers.
Recent IoC activity
95 malicious indicators in Maltiverse are attributed to Akira (S1129). The 20 most recently updated:
Detection coverage
- 4 YARA rules
- 360 Sigma rules
Malware & tools used
- File and Directory Discovery (attack-pattern)
- System Information Discovery (attack-pattern)
- PowerShell (attack-pattern)
- Windows Management Instrumentation (attack-pattern)
- Windows Command Shell (attack-pattern)
- Network Share Discovery (attack-pattern)
- Native API (attack-pattern)
- Inhibit System Recovery (attack-pattern)
- Process Discovery (attack-pattern)
- Data Encrypted for Impact (attack-pattern)
Used by threat actors
- Akira (threat-actor)
Detection rules
- SIGNATURE_BASE_MAL_WIN_Megazord_Apr25 (yara-rule)
- SIGNATURE_BASE_MAL_WIN_Akira_Apr25 (yara-rule)
- DITEKSHEN_MALWARE_Linux_Akira (yara-rule)
- MALPEDIA_Win_Akira_Auto (yara-rule)
Reports & references
- Cisco Talos — Akira Ransomware Continues To Evolve (report)
- CISA — Aa24 109A Stopransomware Akira Ransomware 2 (report)
- ransomlook.io — Akira (report)
- github.com — Akira (report)
- ransomlook.io — Megazord (report)
- sentinelone.com — Akira Ransomware Attacks Vpn Appliances (report)
- bleepingcomputer.com — Akira Ransomware Now Targets Linux Vmware Esxi Servers (report)
- CISA — Akira Ransomware (report)
- MITRE ATT&CK — S1129 (report)
- trellix.com — Akira Ransomware (report)