Akira (ELF)
Aliases: REDBIKE
- First seen
- 2023-04-01 00:00:00
- Malware type
- ransomware
- Family
- Malware family
- Last IoC activity
- 2026-07-18 22:16:58
- Profile updated
- 2026-07-07 13:12:03
Targeted industries: education-and-nonprofits financial-services government-and-public-sector healthcare-and-pharmaceutical manufacturing technology-and-telecommunications
Context
Akira is a ransomware strain designed to attack various industries by encrypting data on Linux (ELF) systems. Known under the alias REDBIKE, it is typically deployed in targeted campaigns and demands ransom payments for decryption keys.
Reports & references
- services.google.com — M Trends 2025 En (report)
- trellix.com — Akira Ransomware (report)
- malpedia.caad.fkie.fraunhofer.de — Elf.Akira (report)
- tinyhack.com — Decrypting Encrypted Files From Akira Ransomware Linux Esxi Variant 2024 Using A Bunch Of Gpus (report)
- Microsoft — Automatic Disruption Of Human Operated Attacks Through Containment Of Compromised User Accounts (report)
- labs.k7computing.com — Akiras Play With Linux (report)
- loginsoft.com — Akira Ransomware The Evolution Of A Major Threat (report)
- research.checkpoint.com — Inside Akira Ransomwares Rust Experiment (report)
- arcticwolf.com — Arctic Wolf Labs Observes Increased Fog And Akira Ransomware Activity Linked To Sonicwall Ssl Vpn (report)
- arcticwolf.com — Smash And Grab Aggressive Akira Campaign Targets Sonicwall Vpns (report)
- zensec.co.uk — Unmasking Akira The Ransomware Tactics You Cant Afford To Ignore (report)
- malwareanalysisspace.blogspot.com — Akira Ransomware Expands To Linux (report)
- medium.com — Unransomware From Zero To Full Recovery In A Blink 8A47Dd031Df3 (report)
- security-chu.com — Entidades Negociando Con El Grupo Akira Ransomware (report)