Threat intelligence / Malware

Akira _v2

[Akira _v2](https://attack.mitre.org/software/S1194) is a Rust-based variant of [Akira](https://attack.mitre.org/software/S1129) ransomware that has been in use since at least 2024. [Akira _v2](https://attack.mitre.org/software/S1194) is designed to target VMware ESXi servers and includes a new command-line argument set and other expanded capabilities.(Citation: CISA Akira Ransomware APR 2024)(Citation: Cisco Akira Ransomware OCT 2024)(Citation: Palo Alto Howling Scorpius DEC 2024)

Malware

TypeMalware

External ID—

First seen2026-08-14

Last seen2026-08-14

Confidence

—

[Akira _v2](https://attack.mitre.org/software/S1194) is a Rust-based variant of [Akira](https://attack.mitre.org/software/S1129) ransomware that has been in use since at least 2024. [Akira _v2](https://attack.mitre.org/software/S1194) is designed to target VMware ESXi servers and includes a new command-line argument set and other expanded capabilities.(Citation: CISA Akira Ransomware APR 2024)(Citation: Cisco Akira Ransomware OCT 2024)(Citation: Palo Alto Howling Scorpius DEC 2024)

Labels

malware

7 recorded

Relationships

uses

from Akira

Group

uses

to Create or Modify System Process

Technique

uses

to Data Encrypted for Impact

Technique

uses

to Execution Guardrails

Technique

uses

to File and Directory Discovery

Technique

uses

to Log Enumeration

Technique

uses

to Service Stop

Technique

4 external

References

mitre-attack

S1194

CISA Akira Ransomware APR 2024

https://www.cisa.gov/sites/default/files/2024-04/aa24-109a-stopransomware-akira-ransomware_2.pdf

Cisco Akira Ransomware OCT 2024

https://blog.talosintelligence.com/akira-ransomware-continues-to-evolve/

Palo Alto Howling Scorpius DEC 2024

https://unit42.paloaltonetworks.com/threat-assessment-howling-scorpius-akira-ransomware/