H3XAOperational intelligence
Live analytical pictureEvidence before assessment
TypeMalware
External ID—
First seen2026-08-14
Last seen2026-08-14

Confidence

—

[Akira](https://attack.mitre.org/software/S1129) ransomware, written in C++, is most prominently (but not exclusively) associated with the ransomware-as-a-service entity [Akira](https://attack.mitre.org/groups/G1024). [Akira](https://attack.mitre.org/software/S1129) ransomware has been used in attacks across North America, Europe, and Australia, with a focus on critical infrastructure sectors including manufacturing, education, and IT services. [Akira](https://attack.mitre.org/software/S1129) ransomware employs hybrid encryption and threading to increase the speed and efficiency of encryption and runtime arguments for tailored attacks. Notable variants include Rust-based [Megazord](https://attack.mitre.org/software/S1191) for targeting Windows and [Akira _v2](https://attack.mitre.org/software/S1194) for targeting VMware ESXi servers.(Citation: Kersten Akira 2023)(Citation: CISA Akira Ransomware APR 2024)(Citation: Cisco Akira Ransomware OCT 2024)

Labels

malware
11 recorded

Relationships

uses
from Akira
Group
usesTechnique
usesTechnique
usesTechnique
usesTechnique
usesTechnique
usesTechnique
4 external

References

mitre-attack
S1129
open
CISA Akira Ransomware APR 2024
https://www.cisa.gov/sites/default/files/2024-04/aa24-109a-stopransomware-akira-ransomware_2.pdf
open
Kersten Akira 2023
https://www.trellix.com/blogs/research/akira-ransomware/
open
Cisco Akira Ransomware OCT 2024
https://blog.talosintelligence.com/akira-ransomware-continues-to-evolve/
open