AKIRA Ransomware Gang: 3 New Victims in 24 Hours — US Manufacturing & Energy Targeting With Edge-Device Exploitation Analysis

Classification: TLP:CLEAR | Brief Date: 2026-09-16 | Source: ransomware.live dark web leak site monitoring

Security Arsenal's dark web monitoring team has confirmed three new victim postings to the AKIRA ransomware gang's TOR-based leak site within a single 24-hour window (2026-09-15). All three victims are US-based organizations, with confirmed targeting of the Manufacturing and Energy & Utilities sectors — a combination consistent with AKIRA's established preference for operationally-dependent mid-market enterprises where downtime pressure maximizes payment probability.

This bulletin provides detection engineering content mapped to AKIRA's observed tradecraft, hunt queries for pre-encryption staging, and prioritized containment actions for organizations in the targeted sectors.

Threat Actor Profile — AKIRA

Known Initial Access Methods (Priority Order)

1. VPN appliances without MFA — AKIRA's signature vector. Historically abused Cisco ASA/AnyConnect (CVE-2023-20269) and SonicWall SSLVPN (CVE-2024-40766). Any perimeter remote-access service lacking MFA is in scope.
2. Exploitation of edge/network devices — firewalls, virtualization management planes, remote access tools.
3. RDP brute force / exposed RDP — both externally and for internal lateral movement.
4. Phishing with macro or loader payloads — less frequent but observed.
5. Compromised credentials purchased from access brokers.

Post-Access Tradecraft

• Credential dumping (LSASS, NTDS.dit via Volume Shadow Copy abuse)
• Lateral movement via RDP, PsExec, WMI, and SMB admin shares
• AnyDesk / RMM tooling for persistence masquerading as legitimate admin software
• WinRAR archiving + Rclone/FileZilla/WinSCP for staged exfiltration to MEGA or attacker-controlled FTP
• vssadmin delete shadows and bcdedit recovery-disable prior to encryption
• Hypervisor targeting: ESXi variant encrypts VMFS volumes directly, maximizing impact per execution

Current Campaign Analysis

Victims Posted 2026-09-15

Key Observations

Sector concentration: Manufacturing remains AKIRA's highest-yield vertical — these organizations run flat networks, legacy OT-adjacent systems, and cannot tolerate production downtime. The Southern California Telephone Company posting is more concerning: telecommunications/utility-adjacent providers sit upstream of regional infrastructure, and compromise creates secondary exposure for downstream customers and potential OT pivot risk.

Geographic concentration: 100% US-focused in this posting window, consistent with AKIRA's long-standing US-centric victimology (>60% of lifetime postings).

Victim profile: Mid-market organizations, estimated revenue $10M–$500M. AKIRA deliberately avoids Fortune 100 targets (hardened, aggressive IR retainers) in favor of the mid-market sweet spot: enough revenue to pay seven figures, insufficient security maturity to detect a 3–10 day dwell.

Posting cadence: Three same-day postings suggests either a burst of completed negotiations/failed payments, or a recent intrusion wave reaching extortion stage simultaneously. Watch for a follow-on cluster within 7–14 days — AKIRA leak activity historically clusters around shared initial access campaigns.

Initial Access Vector Assessment — KEV Correlation

The CISA KEV entries below are confirmed ransomware-exploited and map directly onto AKIRA's documented edge-device-first intrusion doctrine:

Assessment: Organizations running Check Point gateways with IKEv1 enabled, unpatched Cisco FMC, or exposed vCenter instances should treat themselves as actively targeted. The vCenter CVE is particularly dangerous in AKIRA's hands — their ESXi variant turns hypervisor access into fleet-wide encryption in a single detonation.

Detection Engineering

The following Sigma rules target AKIRA's documented kill chain: VPN/edge initial access anomalies, pre-encryption shadow copy destruction, and data staging with their known toolset.

---
title: AKIRA Ransomware - Volume Shadow Copy Deletion Pre-Encryption
id: 8f3a1c2e-4b7d-4e9a-a1f2-akira000001
description: Detects shadow copy deletion and recovery-disable commands consistently executed by AKIRA operators immediately before encryption detonation
status: production
author: Security Arsenal Threat Intel
logsource:
  category: process_creation
  product: windows
detection:
  selection_vssadmin:
    Image|endswith: '\vssadmin.exe'
    CommandLine|contains:
      - 'delete shadows'
      - 'Delete Shadows'
  selection_wmic:
    Image|endswith: '\wmic.exe'
    CommandLine|contains: 'shadowcopy delete'
  selection_bcdedit:
    Image|endswith: '\bcdedit.exe'
    CommandLine|contains:
      - 'recoveryenabled no'
      - 'ignoreallfailures'
  selection_powershell:
    Image|endswith:
      - '\powershell.exe'
      - '\pwsh.exe'
    CommandLine|contains:
      - 'Get-WmiObject Win32_Shadowcopy'
      - 'Remove-CimInstance'
  condition: 1 of selection_*
falsepositives:
  - Legitimate backup software maintenance
  - IT disaster recovery testing
level: critical
tags:
  - attack.impact
  - attack.t1490
  - akira
---
title: AKIRA Ransomware - Data Staging and Exfiltration Toolset
id: 8f3a1c2e-4b7d-4e9a-a1f2-akira000002
description: Detects execution of WinRAR archiving, Rclone, FileZilla, and WinSCP from non-standard locations consistent with AKIRA pre-encryption exfiltration staging
status: production
author: Security Arsenal Threat Intel
logsource:
  category: process_creation
  product: windows
detection:
  selection_tools:
    Image|endswith:
      - '\rclone.exe'
      - '\winscp.exe'
      - '\filezilla.exe'
      - '\rar.exe'
  filter_legitimate_paths:
    Image|startswith:
      - 'C:\Program Files\'
      - 'C:\Program Files (x86)\'
  selection_suspicious_args:
    CommandLine|contains:
      - 'copy '
      - 'sync '
      - '--transfers'
      - 'mega:'
      - ' a -r '
      - ' -hp'
  condition: (selection_tools and not filter_legitimate_paths) or (selection_tools and selection_suspicious_args)
falsepositives:
  - Administrators using WinRAR or WinSCP for legitimate transfers
level: high
tags:
  - attack.exfiltration
  - attack.t1567
  - attack.t1560.001
  - akira
---
title: AKIRA Ransomware - Anomalous VPN Authentication Followed by Internal RDP
id: 8f3a1c2e-4b7d-4e9a-a1f2-akira000003
description: Detects VPN logons from uncommon geolocations or new devices followed by internal RDP session establishment, matching AKIRA edge-access-to-lateral-movement pattern
status: experimental
author: Security Arsenal Threat Intel
logsource:
  product: windows
  service: security
detection:
  selection_rdp_logon:
    EventID: 4624
    LogonType: 10
  filter_known_admins:
    TargetUserName|contains:
      - 'svc-backup'
      - 'admin-vdi'
  selection_rdp_execution:
    EventID: 4688
    NewProcessName|endswith: '\mstsc.exe'
  condition: (selection_rdp_logon and not filter_known_admins) or selection_rdp_execution
timeframe: 1h
falsepositives:
  - Help desk remote sessions
  - VDI infrastructure
level: high
tags:
  - attack.lateral_movement
  - attack.t1021.001
  - attack.t1078
  - akira

The following KQL query hunts the full pre-ransomware staging window in Microsoft Sentinel — correlating shadow copy tampering, suspicious archive/exfil tooling, new scheduled tasks, and RMM installation within a 72-hour sliding window on the same device.

// AKIRA Pre-Ransomware Staging Hunt - 72h correlated window
let WindowStart = ago(72h);
let SuspiciousProcs = dynamic(["vssadmin.exe","bcdedit.exe","rclone.exe","winscp.exe","rar.exe","anydesk.exe","psexec.exe","wmic.exe"]);
let StagingEvents =
    DeviceProcessEvents
    | where TimeGenerated >= WindowStart
    | where FileName in~ (SuspiciousProcs)
    | where ProcessCommandLine has_any ("delete shadows","recoveryenabled","shadowcopy","copy ","sync "," -hp"," -r ","accepteula")
    | project StagingTime=TimeGenerated, DeviceName, FileName, ProcessCommandLine, AccountName, InitiatingProcessFileName;
let NewPersistence =
    DeviceProcessEvents
    | where TimeGenerated >= WindowStart
    | where FileName =~ "schtasks.exe" and ProcessCommandLine has "/create"
    | project PersistTime=TimeGenerated, DeviceName, TaskCmd=ProcessCommandLine, PersistAccount=AccountName;
let RDPInbound =
    DeviceNetworkEvents
    | where TimeGenerated >= WindowStart
    | where RemotePort != 3389 and LocalPort == 3389
    | project RDPTime=TimeGenerated, DeviceName, RemoteIP, RemoteIPType;
StagingEvents
| join kind=leftouter (NewPersistence) on DeviceName
| join kind=leftouter (RDPInbound) on DeviceName
| summarize
    StagingHits = count(),
    Tools = make_set(FileName),
    FirstSeen = min(StagingTime),
    LastSeen = max(StagingTime),
    Accounts = make_set(AccountName),
    TaskCreations = make_set(TaskCmd),
    InboundRDPSources = make_set(RemoteIP)
    by DeviceName
| where StagingHits >= 2 or array_length(Tools) >= 2
| extend RiskScore = StagingHits + (array_length(TaskCreations) * 2) + (array_length(InboundRDPSources) * 2)
| sort by RiskScore desc

Rapid triage script for suspected AKIRA exposure — enumerates recently created scheduled tasks, validates shadow copy integrity, and checks for exposed RDP configuration changes:

# AKIRA Rapid Triage - Run elevated on suspected hosts or via remote sweep
# Checks: scheduled tasks (7d), shadow copies, RDP exposure, suspicious tooling

$Report = @()
$Cutoff = (Get-Date).AddDays(-7)

Write-Host "[1/4] Scheduled tasks created in last 7 days..." -ForegroundColor Cyan
$NewTasks = Get-ScheduledTask | Where-Object {
    $_.Date -gt $Cutoff -and
    $_.TaskPath -notlike "\Microsoft*"
} | Select-Object TaskName, TaskPath, Date, @{N='Action';E={$_.Actions.Execute}}
$Report += [PSCustomObject]@{Check='NewScheduledTasks'; Count=$NewTasks.Count; Detail=($NewTasks | Out-String)}

Write-Host "[2/4] Volume Shadow Copy integrity..." -ForegroundColor Cyan
$Shadows = Get-CimInstance Win32_ShadowCopy -ErrorAction SilentlyContinue
$ShadowStatus = if ($null -eq $Shadows -or $Shadows.Count -eq 0) {
    "CRITICAL: No shadow copies present - possible pre-encryption deletion"
} else { "OK: $($Shadows.Count) shadow copies present" }
$Report += [PSCustomObject]@{Check='ShadowCopies'; Count=($Shadows | Measure-Object).Count; Detail=$ShadowStatus}

Write-Host "[3/4] RDP exposure check..." -ForegroundColor Cyan
$RdpEnabled = (Get-ItemProperty 'HKLM:\SYSTEM\CurrentControlSet\Control\Terminal Server').fDenyTSConnections -eq 0
$NlaEnabled = (Get-ItemProperty 'HKLM:\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp' -ErrorAction SilentlyContinue).UserAuthentication -eq 1
$RdpListeners = Get-NetTCPConnection -LocalPort 3389 -State Listen -ErrorAction SilentlyContinue
$Report += [PSCustomObject]@{Check='RDPExposure'; Count=($RdpListeners | Measure-Object).Count
    Detail="RDP Enabled: $RdpEnabled | NLA Required: $NlaEnabled | Listeners: $($RdpListeners.Count)"}

Write-Host "[4/4] Suspicious staging tools in user-writable paths..." -ForegroundColor Cyan
$ToolHits = Get-ChildItem -Path "$env:TEMP","$env:PUBLIC","C:\Users" -Recurse -Depth 3 -ErrorAction SilentlyContinue |
    Where-Object { $_.Name -match '^(rclone|winscp|filezilla|rar|anydesk|psexec)\.exe$' } |
    Select-Object FullName, CreationTime
$Report += [PSCustomObject]@{Check='StagingTools'; Count=$ToolHits.Count; Detail=($ToolHits | Out-String)}

$Report | ForEach-Object {
    $color = if ($_.Count -gt 0 -and $_.Check -ne 'ShadowCopies') {'Red'} elseif ($_.Detail -like 'CRITICAL*') {'Red'} else {'Green'}
    Write-Host "`n=== $($_.Check) [$($_.Count)] ===" -ForegroundColor $color
    Write-Host $_.Detail
}
$Report | Export-Csv -Path ".\AKIRA_Triage_$(Get-Date -Format 'yyyyMMdd_HHmm').csv" -NoTypeInformation
Write-Host "`nReport exported to working directory." -ForegroundColor Yellow

Incident Response Priorities

T-Minus Detection Checklist (Before Encryption Fires)

AKIRA's dwell window is short — treat any two of the following as an active intrusion requiring immediate escalation:

• vssadmin delete shadows or bcdedit recovery-disable execution on ANY server
• New scheduled tasks or services created outside change control, especially with SYSTEM privileges
• WinRAR/Rclone/WinSCP/FileZilla execution from non-standard paths (TEMP, Public, user profiles)
• AnyDesk, ConnectWise, or other RMM binaries installed outside your approved RMM stack
• LSASS memory access by non-system processes; NTDS.dit access via ntdsutil or shadow copy mount
• VPN logons from new ASN/geography followed by RDP or SMB admin-share access within 1 hour
• ESXi host SSH enabled unexpectedly, or vCenter logons from non-jumpbox sources
• Large outbound transfers to MEGA, anonymous FTP, or unfamiliar cloud storage

Assets AKIRA Prioritizes for Exfiltration

• Financial records, payroll, and banking details
• HR/PII databases (leverage for regulatory pressure)
• Contracts, legal documents, and M&A material
• Engineering files, schematics, and IP — especially in Manufacturing victims
• Customer records and call/billing data in telecom victims
• Backup catalogs (to identify and destroy recovery options)

Containment Actions — Ordered by Urgency

1. Isolate at the edge, not just endpoints: Force-disable suspect VPN sessions, revoke all active VPN/SSLVPN tokens, and block attacker infrastructure at the firewall. AKIRA frequently retains edge access even after endpoint isolation.
2. Disable compromised accounts globally — assume domain-level credential compromise if LSASS or NTDS access was observed; initiate enterprise-wide password resets starting with privileged and service accounts (watch for Kerberoasting artifacts).
3. Segment the hypervisor layer: Isolate vCenter/ESXi management interfaces immediately. If the ESXi locker hasn't fired yet, this is your last window.
4. Block exfil channels: Egress-filter MEGA, personal cloud storage, and outbound FTP/SFTP not explicitly whitelisted.
5. Preserve volatile evidence before any reimage: VPN logs, firewall auth logs, vCenter events, EDR telemetry for the full dwell window.
6. Protect backups: Take backup infrastructure offline or immutable-lock immediately — AKIRA actively enumerates and destroys backup catalogs.

Hardening Recommendations

Immediate (24 Hours)

• Patch the perimeter stack: Check Point gateways (CVE-2026-50751 — disable IKEv1 if unused), Cisco Secure FMC (CVE-2026-20316), VMware vCenter (CVE-2026-59310), ConnectWise ScreenConnect (CVE-2024-1708). These are confirmed ransomware-exploited per CISA KEV.
• Enforce MFA on every remote access service — VPN, RDP gateways, RMM consoles. This single control would have blocked the majority of AKIRA's historical intrusions.
• Disable or restrict RDP externally; require NLA internally. Audit for internet-facing 3389 today.
• Deploy the Sigma rules above and validate alerting on vssadmin execution in a test window.
• Block Rclone/WinSCP/FileZilla execution from user-writable paths via AppLocker or WDAC policy.
• Remove Nx Console pending vendor remediation guidance (CVE-2026-48027); audit developer workstations for compromise.

Short-Term (2 Weeks)

• Architectural segmentation between IT and OT/hypervisor planes — vCenter management reachable only from dedicated jump hosts with just-in-time access.
• Immutable, air-gapped, or logically isolated backups with restoration tested within the last 30 days. Assume AKIRA will find and target online backups.
• Decommission legacy VPN concentrators in favor of ZTNA with device posture checks; AKIRA's entire intrusion model collapses without a password-only VPN to brute force.
• RMM allowlisting: inventory every remote access tool in the environment and block all non-approved binaries at the endpoint and proxy.
• Egress filtering with TLS inspection on server VLANs — exfil staging is your last reliable detection opportunity before detonation.
• Tabletop an AKIRA scenario with a 48-hour dwell assumption: can your team detect, contain, and preserve evidence inside that window?

Analyst Note: AKIRA remains one of the most operationally disciplined mid-tier ransomware operations because of its Conti lineage and repeatable playbook: edge device in, credentials out, stage, exfiltrate, encrypt — all inside a week. The defensive advantage is that this playbook is loud if you're watching the right telemetry. The detections above target exactly those seams. Manufacturing and energy-adjacent organizations should consider themselves in an elevated threat window for the next 30 days.

Related Resources

Security Arsenal Incident Response Managed SOC & MDR Services AlertMonitor Threat Detection From The Dark Side Intel Hub