Akira

☆ pin

Also known as Akira v2

Reports

121

First seen

May 22, 2024

Last seen

Aug 14, 2026

Motivation

Financial

Relationships

Filled ◆ = CVE exploited in the wild. Entities that appear together in Signalis reporting — co-mention, not confirmed collaboration. Reports naming many actors at once (weekly roundups) are excluded from relationship edges.

Targeting

Sectors

Manufacturing ×13 Other ×10 Professional Services ×6 Hospitality ×6 Financial Services ×5 Retail & E-commerce ×5 Media & Entertainment ×3 Transport & Logistics ×3

Victim regions

×1

×33

United States×33

Germany×2

Guyana×2

Czechia×1

United Kingdom×1

Japan×1

Victim country, only when stated. Corpus is predominantly English-language reporting, so US/EU coverage is overweighted relative to true victim distribution.

Top ATT&CK techniques

T1486 Data Encrypted for Impact ×20T1566 Phishing ×13T1021 Remote Services ×9T1190 Exploit Public-Facing Application ×9T1021.001 Remote Services: Remote Desktop Protocol ×8T1133 External Remote Services ×8T1219 Remote Access Software ×8T1110 Brute Force ×7T1078 Valid Accounts ×7T1562.001 Impair Defenses: Disable or Modify Tools ×7T1562 Impair Defenses ×6T1195 Supply Chain Compromise ×6

Indicators

domain ×134filename ×127cve ×50ip_v4 ×39hash_sha256 ×12registry_key ×4hash_sha1 ×4hash_md5 ×3

Indicator values are available on Pro and via the API.

Recent reports

High

Akira

Relationships

Targeting

Top ATT&CK techniques

Indicators

Associated CVEs

Recent reports

Akira ransomware gang publishes Keystops as new victim

Akira ransomware gang publishes Cozad Asset Management as victim

Akira ransomware affiliate disables EDR via Safe Mode, steals data but fails encryption

ThreatsDay: GhostJacking AI Attacks, EtherHiding ClickFix, Cursor CLI Flaw + 17 More Stories

Akira ransomware gang publishes CF Supply as new victim

Akira Ransomware Operators Abuse Safe Mode to Bypass EDR Defenses

Akira ransomware gang claims new victim: Alcast

Akira ransomware publishes One Vision Imaging as new victim

Akira ransomware claims new victim: i4 Solutions

IT threat evolution in Q2 2026: Ransomware, miners, and vulnerability exploitation

CrowdStrike Threat Hunts for Shell Command Obfuscation on VMware ESX

Akira ransomware publishes Basic Grain Products as victim

Akira ransomware publishes Pharma Test Apparatebau AG as victim

Akira ransomware claims University SprinklerSystems victim

Akira ransomware gang publishes Albers Mechanical Contractors as victim

Akira ransomware publishes Belasco Electric as victim

Akira ransomware gang publishes Northwood Country Club as extortion victim

Akira ransomware gang claims Franz Krause artworksgroup as victim

Akira ransomware gang publishes Emerge2 Digital as victim

Akira ransomware gang publishes Kruse Construction as victim

Akira ransomware claims University Sprinkler Systems as victim

Akira ransomware gang publishes Novasport s.r.o. as victim

Akira ransomware gang publishes Finer & Finer as new victim

Akira ransomware claims McKeever, Varga & Senko victim

Akira ransomware gang publishes L&A Transport as victim

Akira ransomware gang publishes Westcoast Communication Services as victim

Akira ransomware publishes Nesco Bus Maintenance as victim

Akira ransomware claims Plumley Engineering as victim

Akira ransomware gang publishes Pioneer Construction as victim

Akira publishes Transworld Signs as ransomware victim