• First observed: March 2023
  • Believed origin: Successor group with ties to the Conti ransomware operation
  • Model: Closed Ransomware-as-a-Service (RaaS), double extortion
  • Status: Active

 

Origin

Barracuda Networks' threat research team, in a retrospective on the group's rise, stated that, "Akira's story starts with the Conti ransomware group, which conducted attacks from December 2019 through May 2022, ” a group whose internal chat logs leaked in 2022, exposing a business-like criminal enterprise that had extorted hundreds of organizations, including numerous hospitals, before it dispersed into successor operations. Akira is believed to be one of those successors, carrying forward both tooling and operational know-how from Conti's collapse.

Barracuda's research pinpointed Akira's public emergence and documented its fast climb, noting that, "The Akira ransomware group emerged in March 2023 and quickly established itself as a formidable threat actor targeting multiple industries, primarily in the United States and allied countries; by January 1, 2024, Akira had impacted over 250 organizations and claimed approximately $42 million in ransomware proceeds.”

 

A focus on hospitals

Unlike some ransomware groups that only later found healthcare as an opportunistic target, Akira's interest in the sector showed up almost immediately, early enough that federal health authorities issued a formal warning within a year of the group's first appearance. Paubox reported that, "The HHS Health Sector Cybersecurity Coordination Center issued the ‘Akira Ransomware Analyst Note’ on February 7, 2024, identifying Akira as "a relatively new ransomware gang that has demonstrated aggressive and capable targeting of the U.S. health sector in its short lifespan." According to that same article, "Akira was first identified in May 2023, though some sources indicate earlier activity, and in less than a year had claimed at least 81 victims.”

Hospitals are attractive Akira targets because these entities face high levels of risk from Akira for several reasons, health data is among the most sensitive and valuable information on the black market, and its exposure can directly compromise patient privacy and care. Akira's operations normally begin with compromised credentials, and the group maintains persistence by abusing legitimate remote access tools such as AnyDesk and LogMeIn, frequently deleting Volume Shadow Copy Service backups through PowerShell commands, leaving organizations with limited recovery options if they refuse to pay.

 

Case study: Michael Garron Hospital, Toronto

One of Akira’s best-documented hospital incidents came in the group’s first year. Michael Garron Hospital in Toronto discovered a cyberattack on October 23, 2023. The hospital declared a Code Grey, which signals a serious IT systems crisis, and began investigating what it called a data security incident. It said its programs and patient care services kept running normally.

The hospital later confirmed that patient and donor data had been exposed without authorization, in addition to data on employees and medical staff. It offered affected staff and clinicians two years of free credit monitoring. Akira’s leak-site listing claimed 775 GB of files, about 882,000 documents in total. The hospital did not give in to the extortion. It stated that it did not pay a ransom and knew the stolen data might be published.

Arctic Wolf investigated cases in which victims of ransomware gangs, including Akira, were later approached by other actors. These actors offered to hack the gangs’ servers and delete the stolen data. Michael Garron was one of the victims discussed in this reporting. This shows that a hospital that refuses to pay can still face secondary extortion attempts.

 

From Windows-only to VMware, and now Nutanix

Akira's technical capability has expanded steadily since its debut, tracking closely with where healthcare and enterprise IT infrastructure has moved. CISA's joint "#StopRansomware" advisory documented the group's expanding reach across virtualization platforms, "Since March 2023, Akira ransomware threat actors have impacted a wide range of businesses and critical infrastructure entities in North America, Europe, and Australia; in April 2023, following an initial focus on Windows systems, Akira deployed a Linux variant targeting VMware ESXi virtual machines.”

CISA's most recent update to that advisory flagged an even newer capability. As of late 2025, the agency reported that, "Akira threat actors deployed payloads to target Nutanix Acropolis Hypervisor systems in a June 2025 incident, likely abusing CVE-2024-40766, a SonicWall vulnerability, for initial access.” That same advisory noted a technically notable escalation within a single incident, "Trusted third-party investigations revealed that Akira threat actors deployed two distinct ransomware variants against different system architectures during one attempted compromise.” By late 2024 and into 2025, the group again modernized its codebase to an update, known as Akira_v2, with the group moving away from its earlier C++ approach to a Rust-based payload.

Paubox reported that, "A joint cybersecurity advisory released on November 13, 2025 warned that the Akira ransomware group had sharply escalated its attacks on infrastructure, with the alert coming jointly from the FBI, CISA, the Defense Cyber Crime Center, HHS, and several international partners.” The financial figures cited were that, “Officials reported that Akira had collected more than $244 million in ransom payments since the group first appeared in March 2023.”

Paubox's report added that, "Agencies warned Akira poses an urgent threat to healthcare, education, financial services, manufacturing, and food and agriculture, and urged organizations to patch known vulnerabilities.”

 

The most prolific ransomware group of 2025

By 2025, Akira had eclipsed even long-established names like LockBit and Qilin in sheer output. On-chain analysis firm TRM Labs, which specializes in tracking cryptocurrency flows tied to ransomware payments, described Akira's dominance, "Akira is one of the most consequential ransomware groups operating globally, and the most prolific by total ransom proceeds in 2025, an active RaaS enterprise using double extortion that has demonstrated a consistent capacity to adapt its targeting, tooling, and on-chain laundering infrastructure in response to law enforcement pressure.”

TRM's victim-count data placed Akira at the top of the leaderboard, "The group posted approximately 980 victims on its leak site between January 1 and December 11, 2025, alternating with Agenda/Qilin for the top position by victim count, while significantly outpacing Qilin in total ransom proceeds.”

SOS Ransomware's analysis noted how sudden Akira's dominance became. The group's disclosure of stolen data reached an unprecedented single-day scale, with the outlet noting, "This dominance was sadly illustrated in November 2024, when the group disclosed the data of over 30 victims in a single day, an unprecedented event that testifies to the scale of their operations.” That momentum carried directly into the new year, "No fewer than 72 attacks were recorded in January 2025 and 77 in February, with January 2025 security reports identifying Akira as the most active ransomware group globally.”

Read also:

 

Laundering the money and possible ties to other groups

Akira has also shown unusual discipline in how it moves stolen ransom payments through cryptocurrency to avoid seizure. TRM Labs' financial forensics team found that, "Akira has undergone at least four distinct evolutions in its post-payment laundering tactics since 2023, a pattern of continuous rotation that reflects a deliberate effort to stay ahead of monitoring and law enforcement.”

That same analysis found possible links between Akira and other ransomware brands operating in the same period. TRM found that, ”The Fog ransomware group employed the same laundering infrastructure as Akira during one operational phase, reinforcing indications of cooperation or shared resources, while the Frag ransomware group may represent an extension of Akira itself, both groups utilize a shared two-address wallet cluster and the same bridge and payment service that Akira used almost exclusively between late 2024 and June 2025.”

 

FAQs

What does “Ransomware-as-a-Service” (RaaS) mean?

It is a business model in which the core developers build and maintain the ransomware, while affiliates carry out attacks and share the proceeds with them.

 

Why does deleting Volume Shadow Copy backups matter?

Those copies are built-in Windows restore points, so removing them leaves victims with fewer ways to recover their files without paying.

 

What can healthcare organizations do to reduce their risk?

Federal guidance recommends strong password policies, user training, multifactor authentication, and regular patching of systems.

 

Why does Akira’s link to Conti matter for healthcare?

Conti was also known for targeting healthcare organizations, so Akira inheriting its tooling and know-how raises the concern that the same attacks on hospitals will continue.