Akira showed up in April 2023 and moved quickly from a handful of victims to a long list across several industries. I tracked it through the summer of 2023 while new samples kept appearing.
Why it matters
The operators use double extortion: data is copied out first, then the environment is encrypted, and payment is demanded both for the decryptor and for not leaking or selling the stolen files. There are builds for Windows and for Linux, so virtualization hosts are in scope as well as desktops and file servers.
Behaviour I could repeat
1. drop and run the 64-bit encryptor
2. PowerShell is spawned to remove volume shadow copies
3. files are encrypted, a note is written into every folder
4. victim receives instructions for a negotiation portal
The shadow-copy removal step is the most reliable early signal. It tends to be launched through PowerShell rather than the old command-line tools, and one variant launched it through a signed Windows helper (the App-V publishing server) instead of the usual vssadmin route.
Credential tooling alongside it
One batch of samples also tripped a credential-dumping behaviour rule, which fits the usual pattern of affiliates gaining domain access before deployment. The encryptor itself is just the last stage.
Notes for defenders
- Alert on shadow-copy deletion launched from PowerShell or from child processes of unfamiliar executables.
- Treat the appearance of the same note file in many directories as a high-confidence trigger.
- Check Linux hosts that run virtual machines, not only Windows endpoints.
27009c0abd2709cd5cac4c0135b8f3bed3229b0921601638ba9e90713ede91ea
379ef7c4f6dfae8cc0c8556861ff41930b88c7d9b107a5de10ccd194e1bda0cb