The Akira ransomware operation has moved into the first rank of global ransomware threats, according to a newly updated joint advisory from the Cybersecurity and Infrastructure Security Agency (CISA), the Federal Bureau of Investigation (FBI), the Department of Defense Cyber Crime Center, the Department of Health and Human Services, and international partners. The advisory, published November 13, is part of the ongoing StopRansomware campaign and consolidates the latest indicators of compromise and tactics, techniques, and procedures associated with Akira.
The document notes that as of late September 2025, Akira has generated roughly 244.17 million US dollars in ransomware proceeds, a sharp increase from the 42 million dollars cited in earlier government reporting on the group’s activity through early 2024. The advisory reiterates that Akira operates as a ransomware as a service program and has primarily targeted small and medium-sized organizations across manufacturing, education, information technology, health care, financial services, and agriculture.
Speaking to reporters about the updated guidance, Brett Leatherman, assistant director at the FBI’s Cyber Division, underlined the threat’s significance. “For the FBI, it is within the top five variants that we investigate,” said Leatherman. “It is consequential. This group is very consequential that they fall likely within our top five.”
The advisory describes Akira operators as opportunistic, with a pattern of exploiting exposed remote access services and VPN appliances, leveraging stolen or weak credentials, and conducting double extortion through data theft prior to encryption. While many techniques are consistent with previous Akira reporting, the updated document emphasizes recent campaigns focused on vulnerable SSL VPN endpoints and other edge devices, along with the continued use of commodity tools for lateral movement and data staging.
CISA and its partners recommend a layered approach to defense. The advisory urges organizations to enforce multi-factor authentication across remote access services, harden and closely monitor VPN and other internet-facing infrastructure, disable unused ports and services, and segment networks to restrict lateral movement. It also highlights the importance of maintaining offline, immutable backups, regularly testing restoration procedures, and ensuring that incident response plans explicitly account for data theft and extortion scenarios.
For security leaders, the updated advisory formalizes what many incident responders have already observed over the past year. Akira is no longer a second-tier ransomware brand. It is a mature, resilient operation with a growing victim list, significant revenue, and a track record of targeting mid-sized organizations that often lack the resources of large enterprises. With the FBI now publicly ranking Akira among its most significant active variants, the StopRansomware guidance effectively sets a baseline for how US and allied agencies expect network defenders to prepare for, detect, and respond to the group’s activity.
Sources: CISA, IC3, CyberScoop
—
By the ID Tech Editorial Team
