Classification: TLP:CLEAR | Publication Date: 2026-11-13 | Source: ransomware.live leak-site monitoring (single-source for some listings — see Sourcing & Verification) | Nature of data: Unverified threat-actor claims

AKIRA Ransomware Gang: 6 New Leak-Site Claims — Sector Targeting Analysis & Detection Engineering

Executive Summary

Between 2026-11-11 and 2026-11-13, the AKIRA ransomware operation published six new victim listings on its dark web leak site. The claimed victims span Professional Services, Manufacturing, and Transportation, with a confirmed geographic focus on the United States. Five of the six listings were independently corroborated by a second leak-site crawler, confirming that AKIRA did publish these claims. One listing — Galorath — appears on a single source only.

It is critical to understand that these are unverified accusations by a criminal organization. AKIRA has listed these organizations and claims to have compromised them; no tier of this data confirms an actual breach occurred. Organizations named in this briefing may dispute the listings, and neither a denial nor silence constitutes proof either way.

The sectors represented — mid-market manufacturing, professional services, and transportation — align with AKIRA's historical victimology: organizations large enough to pay meaningful ransoms but often lacking mature security operations. Security teams in these sectors should treat this campaign as a forcing function to validate detection coverage against AKIRA's known playbook, detailed in the Detection Engineering section below.

Sourcing & Verification

This briefing is built from monitoring of AKIRA's .onion leak site via ransomware.live. Readers must understand the evidentiary limits of this data:

• 5 of 6 listings were independently observed by a second leak-site crawler, confirming the gang published those claims. 1 listing (Galorath) appears on a single source only — we cannot independently confirm the posting itself exists.
• Inclusion in this briefing reflects the threat actor's claim only. It is not confirmation that any breach, intrusion, or data theft occurred.
• A named organization may dispute the listing. A denial is likewise not proof the claim is false — disclosure obligations vary by jurisdiction and sector, and not every incident is reportable. Neither silence nor denial settles the underlying question.
• Security Arsenal will publish corrections as warranted and welcomes contact from any named organization at security@securityarsenal.com.

Claimed Victims (as listed on AKIRA's leak site)

Threat Actor Profile — AKIRA

Aliases: AKIRA; no widely attributed ties to prior ransomware families have been confirmed, though code overlap with the defunct Conti lineage has been reported by multiple researchers since the group's emergence in March 2023.

Operating model: AKIRA operates as a Ransomware-as-a-Service (RaaS) program, recruiting affiliates who conduct intrusions and deploy the encryptor in exchange for a revenue share, typically 70–85% to the affiliate. The group maintains a dedicated .onion leak site styled with a retro command-line aesthetic, publishing victim names, stolen data samples, and negotiation deadlines.

Ransom demands: Observed demands historically range from approximately $200,000 to $4 million USD, scaled to victim revenue. AKIRA negotiates and has been observed accepting substantially lower payments than the initial demand.

Initial access methods (known playbook):

• VPN appliance exploitation — Cisco ASA/AnyConnect and other SSL VPNs lacking MFA remain the most consistently reported vector. The group has historically exploited Cisco VPN vulnerabilities and brute-forced single-factor VPN accounts.
• RDP exposure — externally accessible RDP with weak or reused credentials.
• Phishing with malicious attachments/URLs delivering initial loaders.
• Compromised credentials purchased from initial access brokers.

Extortion model: Double extortion. AKIRA exfiltrates data before encryption and threatens publication on the leak site if payment is refused. Notably, the group has at times published data without deploying the encryptor, and has claimed some victims "paid for deletion only."

Dwell time: Reported dwell time ranges from under 24 hours to roughly two weeks, with many intrusions showing 2–5 days between initial access and detonation. Pre-encryption staging (reconnaissance, credential theft, exfiltration) is typically compressed, which makes early detection of lateral movement the highest-leverage defensive control.

Tooling: Known to use a mix of living-off-the-land techniques and common post-exploitation tooling: PsExec and WMI for lateral movement, AnyDesk/RMM tools for persistence, WinRAR/7-Zip for data staging, Rclone or FileZilla for exfiltration, and vssadmin delete shadows plus bcdedit modifications pre-encryption. Rust-based and C++ encryptor variants target Windows, Linux, and ESXi.

Current Campaign Analysis

Sector Targeting

The current posting wave skews heavily toward Manufacturing (4 of 6 claims), with single claims in Professional Services and Transportation. This is consistent with AKIRA's long-running preference for industrial and mid-market victims — organizations with operational uptime pressure, legacy infrastructure, and frequently flat network architectures. Construction-adjacent manufacturing (Paragon Mechanical, Leware Construction Company ofFlorida) and composite materials (R3 Composites) suggest supply-chain positioning that could create downstream pressure on larger customers.

Geographic Concentration

Where country data is available, all claimed victims are United States-based. Three listings lack country attribution in the source data; we make no assumptions about their location.

Victim Profile

The named organizations are characteristic of AKIRA's mid-market sweet spot: regional manufacturers, specialty contractors, and service firms. Based on sector norms, these organizations likely fall in the small-to-mid enterprise range (roughly 50–500 employees, revenue in the low tens of millions), where security staffing is thin, EDR coverage is often partial, and cyber-insurance-driven ransom payment is a realistic path. We do not have revenue figures for the specific named entities and do not speculate beyond sector-level characterization.

Posting Frequency & Escalation

Six postings in three days (2026-11-11 through 2026-11-13) represents a typical AKIRA batch-release pattern: the group accumulates victims and publishes them in waves to maximize pressure and media visibility. Two clusters are visible — a 2026-11-11 batch (3 claims) and a 2026-11-13 batch (3 claims) — suggesting either two affiliate crews working in parallel or staged negotiation failures being published as deadlines expire.

CVE Correlation (Hypothesis Only)

We have no evidence linking any specific named organization above to a specific CVE. However, AKIRA's known reliance on perimeter-device exploitation makes several currently KEV-listed vulnerabilities relevant as sector-level exposure hypotheses for organizations in the targeted industries:

• CVE-2026-20316 (Cisco Secure FMC hard-coded password) — Given AKIRA's historical abuse of Cisco remote-access infrastructure, unpatched Cisco firewall management planes represent a plausible entry vector consistent with the gang's tradecraft.
• CVE-2026-50751 (Check Point Security Gateway improper authentication) — VPN gateway authentication flaws map directly to AKIRA's most documented initial access pattern.
• CVE-2026-59310 (VMware vCenter path traversal) — AKIRA deploys ESXi-targeting encryptor variants; vCenter compromise is a force multiplier for hypervisor-level destruction.
• CVE-2026-63077 (JetBrains TeamCity deserialization) — CI/CD compromise provides both access and credential theft opportunities.
• CVE-2026-50751-adjacent supply chain risk (CVE-2026-48027, Nx Console malicious code) — Developer workstation compromise as an initial foothold.

Defensive action: If you operate any of the affected products, verify patch status against CISA KEV deadlines regardless of whether you are in a targeted sector.

Detection Engineering

The following detections target AKIRA's documented tradecraft: VPN/perimeter initial access, PsExec/WMI lateral movement, pre-encryption staging (shadow copy deletion, bcdedit), and data staging with archiving tools.

---
title: AKIRA Pre-Encryption Defense Evasion — Shadow Copy Deletion and Boot Config Tampering
id: 8f2a1c4e-akira-2026-0001
status: production
description: Detects vssadmin/wmic shadow copy deletion and bcdedit recovery-disable commands consistent with AKIRA pre-encryption staging behavior.
author: Security Arsenal Threat Intelligence
date: 2026/11/13
references:
  - https://securityarsenal.com/darkside
logsource:
  category: process_creation
  product: windows
level: high
detection:
  selection_vssadmin:
    Image|endswith: '\vssadmin.exe'
    CommandLine|contains:
      - 'delete shadows'
      - 'resize shadowstorage'
  selection_wmic:
    Image|endswith: '\wmic.exe'
    CommandLine|contains: 'shadowcopy delete'
  selection_bcdedit:
    Image|endswith: '\bcdedit.exe'
    CommandLine|contains:
      - 'recoveryenabled no'
      - 'bootstatuspolicy ignoreallfailures'
  selection_powershell:
    Image|endswith:
      - '\powershell.exe'
      - '\pwsh.exe'
    CommandLine|contains:
      - 'Get-WmiObject Win32_Shadowcopy'
      - 'Remove-CimInstance'
      - 'Win32_ShadowCopy'
  condition: 1 of selection_*
falsepositives:
  - Legitimate backup maintenance windows
  - System administrators resizing shadow storage
fields:
  - Image
  - CommandLine
  - ParentImage
  - User
  - ComputerName
tags:
  - attack.impact
  - attack.t1490
  - attack.t1562.001
  - akira
---
title: AKIRA Lateral Movement — PsExec Service Install and Remote WMI Process Creation
id: 8f2a1c4e-akira-2026-0002
status: production
description: Detects PsExec-style service creation and remote WMI process execution patterns used by AKIRA affiliates for lateral movement across Windows estates.
author: Security Arsenal Threat Intelligence
date: 2026/11/13
references:
  - https://securityarsenal.com/darkside
logsource:
  category: process_creation
  product: windows
level: high
detection:
  selection_psexec:
    Image|endswith:
      - '\psexec.exe'
      - '\psexesvc.exe'
      - '\paexec.exe'
      - '\csexec.exe'
      - '\remcom.exe'
  selection_psexec_rename:
    CommandLine|contains:
      - ' -accepteula'
      - '\\ADMIN$\'
      - ' -s -d '
    CommandLine|contains: '\\'
  selection_wmi_remote:
    Image|endswith: '\wmiprvse.exe'
    ParentImage|endswith: '\svchost.exe'
    CommandLine|contains: '-secured -Embedding'
  selection_wmic_process:
    Image|endswith: '\wmic.exe'
    CommandLine|contains:
      - 'process call create'
      - '/node:'
  condition: selection_psexec or selection_psexec_rename or selection_wmic_process
falsepositives:
  - Legitimate administrative PsExec use — baseline and alert on new source hosts
  - SCCM and software deployment tooling
fields:
  - Image
  - CommandLine
  - ParentImage
  - User
  - ComputerName
tags:
  - attack.lateral-movement
  - attack.t1569.002
  - attack.t1047
  - akira
---
title: AKIRA Data Staging and Exfiltration — Archive Tool Execution with Rclone or Cloud Sync
id: 8f2a1c4e-akira-2026-0003
status: production
description: Detects compression-tool execution paired with known exfiltration utilities (rclone, MEGA sync, FileZilla CLI) indicative of AKIRA double-extortion staging.
author: Security Arsenal Threat Intelligence
date: 2026/11/13
references:
  - https://securityarsenal.com/darkside
logsource:
  category: process_creation
  product: windows
level: medium
detection:
  selection_archive:
    Image|endswith:
      - '\rar.exe'
      - '\7z.exe'
      - '\7za.exe'
      - '\winrar.exe'
    CommandLine|contains:
      - ' a '
      - ' -p'
      - ' -v'
  selection_exfil_tools:
    Image|endswith:
      - '\rclone.exe'
      - '\megacmd.exe'
      - '\MEGAsync.exe'
      - '\filezilla.exe'
      - '\winscp.exe'
      - '\curl.exe'
    CommandLine|contains:
      - 'copy'
      - 'sync'
      - 'move'
      - '--transfers'
      - 'mega.nz'
      - 'ftp://'
  selection_suspicious_dirs:
    CommandLine|contains:
      - '\ProgramData\'
      - '\Temp\'
      - '\Users\Public\'
    CommandLine|contains:
      - '.rar'
      - '.7z'
      - '.zip'
  condition: selection_archive or (selection_exfil_tools and selection_suspicious_dirs)
falsepositives:
  - Legitimate rclone/backup sync jobs — whitelist known service accounts and scheduled tasks
  - User-driven archiving
fields:
  - Image
  - CommandLine
  - User
  - ComputerName
tags:
  - attack.collection
  - attack.t1560.001
  - attack.exfiltration
  - attack.t1567.002
  - akira

The following Sentinel hunt query surfaces pre-ransomware staging chains: anomalous new administrative logons followed by shadow-copy tampering, archive creation, or known exfil tooling within a 6-hour window — the compressed window matching AKIRA's short dwell time.

// AKIRA pre-encryption staging hunt — correlates suspicious admin logons
// with defense-evasion and staging commands within a 6-hour window.
let Window = 6h;
let Lookback = 7d;
let SuspiciousLogons =
    SecurityEvent
    | where TimeGenerated > ago(Lookback)
    | where EventID == 4624 and LogonType in (3, 10)
    | where Account !endswith "$"
    | where IpAddress !startswith "10." and IpAddress !startswith "192.168." or LogonType == 10
    | summarize FirstLogon=min(TimeGenerated) by Account, Computer, IpAddress;
let StagingEvents =
    union isfuzzy=true
    (SecurityEvent
        | where TimeGenerated > ago(Lookback)
        | where EventID == 4688
        | where CommandLine has_any (
            "vssadmin delete shadows", "shadowcopy delete",
            "bcdedit", "recoveryenabled no",
            "rclone", "megacmd", "process call create", "/node:")
        | project StagingTime=TimeGenerated, Computer, Account=NewProcessName,
                  ActorAccount=SubjectAccount, CommandLine, ParentProcessName),
    (DeviceProcessEvents
        | where TimeGenerated > ago(Lookback)
        | where ProcessCommandLine has_any (
            "vssadmin delete shadows", "shadowcopy delete", "bcdedit",
            "rclone", "megasync", "7z.exe a", "rar.exe a")
        | project StagingTime=TimeGenerated, Computer=DeviceName,
                  ActorAccount=AccountName, CommandLine=ProcessCommandLine,
                  ParentProcessName=InitiatingProcessFileName);
StagingEvents
| join kind=inner SuspiciousLogons on Computer
| where StagingTime between (FirstLogon .. FirstLogon + Window)
| summarize Commands=make_set(CommandLine, 5),
            FirstStaging=min(StagingTime), LastStaging=max(StagingTime)
    by Computer, ActorAccount, IpAddress, FirstLogon
| extend HoursAfterLogon = datetime_diff("hour", FirstStaging, FirstLogon)
| sort by FirstStaging asc

The following PowerShell script is a rapid triage sweep for AKIRA pre-detonation indicators: exposed RDP, shadow copy health, recently created scheduled tasks, suspicious RMM tooling, and local admin drift. Run elevated on suspect hosts or deploy via your EDR/Intune.

#requires -RunAsAdministrator
# AKIRA Rapid Triage Sweep — Security Arsenal Threat Intelligence (2026-11-13)
# Surfaces pre-detonation indicators on a single host. Read-only; makes no changes.

$report = [ordered]@{}
$now = Get-Date

Write-Host "=== AKIRA Rapid Triage Sweep — $($env:COMPUTERNAME) — $now ===" -ForegroundColor Cyan

# 1. RDP exposure
$rdpEnabled = (Get-ItemProperty 'HKLM:\SYSTEM\CurrentControlSet\Control\Terminal Server').fDenyTSConnections -eq 0
$nla = (Get-ItemProperty 'HKLM:\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp' -ErrorAction SilentlyContinue).SecurityLayer
$report['RDP_Enabled'] = $rdpEnabled
$report['RDP_NLA_Enforced'] = ($nla -eq 2)
Write-Host "[1] RDP Enabled: $rdpEnabled | NLA Enforced: $($nla -eq 2)" -ForegroundColor ($rdpEnabled -and $nla -ne 2 ? 'Red' : 'Green')

# 2. Volume Shadow Copy status — AKIRA deletes these pre-encryption
$shadows = Get-CimInstance Win32_ShadowCopy -ErrorAction SilentlyContinue
$report['ShadowCopy_Count'] = ($shadows | Measure-Object).Count
Write-Host "[2] Volume Shadow Copies present: $(($shadows | Measure-Object).Count)" -ForegroundColor ((($shadows | Measure-Object).Count) -eq 0 ? 'Red' : 'Green')

# 3. vssadmin service tampering check
$vss = Get-Service VSS -ErrorAction SilentlyContinue
$report['VSS_Service_Status'] = $vss.Status

# 4. Scheduled tasks created in the last 7 days (persistence vector)
$recentTasks = Get-ScheduledTask | Where-Object {
    $_.Date -and ([datetime]$_.Date) -gt $now.AddDays(-7)
} | Select-Object TaskName, TaskPath, Date
$report['Recent_Scheduled_Tasks'] = $recentTasks.TaskName -join '; '
Write-Host "[3] Scheduled tasks created in last 7 days: $(($recentTasks | Measure-Object).Count)" -ForegroundColor Yellow
$recentTasks | Format-Table -AutoSize

# 5. Known AKIRA-abused RMM / exfil tooling presence
$toolPatterns = 'anydesk','rclone','megasync','megacmd','teamviewer','screenconnect','filezilla','winscp'
$foundTools = foreach ($p in $toolPatterns) {
    Get-ChildItem 'C:\Program Files','C:\Program Files (x86)','C:\ProgramData','C:\Users\Public' -Recurse -Filter "$p*.exe" -ErrorAction SilentlyContinue -Depth 3 |
        Select-Object -First 3 FullName, LastWriteTime
}
$report['RMM_Exfil_Tools_Found'] = ($foundTools.FullName -join '; ')
Write-Host "[4] RMM/exfil binaries found: $(($foundTools | Measure-Object).Count)" -ForegroundColor (($foundTools) ? 'Red' : 'Green')
$foundTools | Format-Table -AutoSize

# 6. Local administrator drift (accounts added in last 14 days)
$admins = Get-LocalGroupMember -Group 'Administrators' -ErrorAction SilentlyContinue
$report['Local_Admins'] = ($admins.Name -join '; ')
Write-Host "[5] Local admin members: $(($admins | Measure-Object).Count)" -ForegroundColor Yellow
$admins | Select-Object Name, ObjectClass | Format-Table -AutoSize

# 7. Recent failed logon bursts (brute force sign) — last 24h
$failed = Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4625; StartTime=$now.AddDays(-1)} -ErrorAction SilentlyContinue
$failBySource = $failed | Group-Object { $_.Properties[19].Value } | Sort-Object Count -Descending | Select-Object -First 5 Name, Count
Write-Host "[6] Failed logons (24h): $(($failed | Measure-Object).Count)" -ForegroundColor ((($failed | Measure-Object).Count) -gt 200 ? 'Red' : 'Green')
$failBySource | Format-Table -AutoSize

$report | ConvertTo-Json | Out-File "$env:TEMP\akira_triage_$($env:COMPUTERNAME).json"
Write-Host "Report saved to $env:TEMP\akira_triage_$($env:COMPUTERNAME).json" -ForegroundColor Cyan

Incident Response Priorities

T-Minus Detection Checklist (Before Encryption Fires)

AKIRA's compressed dwell time means these signals often appear within 24–72 hours of detonation:

1. Unexplained shadow copy deletion or VSS service manipulation on servers — the single highest-fidelity pre-ransomware signal.
2. New or renamed remote-access tooling (AnyDesk, ScreenConnect, TeamViewer) on hosts that don't normally run it.
3. Bulk archive creation — large .rar/.7z files appearing in C:\ProgramData, C:\Users\Public, or user temp directories, especially with password-protected archive flags.
4. Rclone/MEGAsync processes or configs anywhere in the estate.
5. PsExec service installation events (7045) or remote WMI process creation from a single source host fanning out laterally.
6. New local administrator accounts or unexpected group membership changes.
7. VPN logon anomalies — single-factor VPN authentications from new geographies or ASNs, especially outside business hours, followed by internal SMB/RDP activity.
8. LSASS access by non-standard processes (credential dumping preceding lateral spread).

Assets AKIRA Prioritizes for Exfiltration

Based on the gang's historical double-extortion playbook, prioritize protection and monitoring around:

• File servers and NAS containing HR records, financials, and contracts
• Backup infrastructure (Veeam, backup admin credentials) — targeted for both destruction and data theft
• Finance/executive mailboxes and document management systems
• Engineering/CAD repositories — highly relevant given the current manufacturing focus; design files and IP carry strong extortion leverage
• Customer databases and PII stores that trigger regulatory notification obligations

Containment Actions — Ordered by Urgency

1. Isolate the affected segment at the switch/VLAN level — do not power off hosts (preserves memory evidence and avoids tipping off the operator prematurely if you're still scoping).
2. Disable compromised accounts and force enterprise-wide credential resets, prioritizing VPN, domain admin, and service accounts. AKIRA affiliates reuse harvested credentials aggressively.
3. Block egress for known exfil tooling (rclone endpoints, MEGA, unmanaged FTP/SFTP) at the proxy/firewall immediately.
4. Kill persistence: suspend recently created scheduled tasks, remove unauthorized RMM agents, and revoke any newly created local/domain accounts.
5. Protect backups: take backup infrastructure offline or into immutable/air-gapped mode before the operator targets it.
6. Preserve evidence: capture memory and triage images from patient-zero and the highest-activity lateral-movement sources before remediation wipes artifacts.
7. Engage IR counsel and determine notification posture early — leak-site publication creates public and regulatory pressure on a clock.

Hardening Recommendations

Immediate (24 Hours)

1. MFA on all remote access — VPN, RDP gateways, and any web-facing SSO. Single-factor VPN access is AKIRA's most reliable door in. No exceptions for service accounts or "temporary" vendor access.
2. Patch KEV-listed perimeter devices — verify remediation status for CVE-2026-20316 (Cisco Secure FMC), CVE-2026-50751 (Check Point Gateway), and CVE-2026-59310 (vCenter). If patching is blocked, take the management interface off reachable networks.
3. Block or alert on shadow copy deletion commands estate-wide via EDR custom detections (the Sigma rules above).
4. Inventory and remove unauthorized RMM tools — AnyDesk, ScreenConnect, TeamViewer on hosts without a business justification.
5. Restrict RDP to jump hosts with NLA enforced; confirm no host exposes 3389 directly to the internet (run the triage script above across critical assets).
6. Verify backup immutability and offline copies — assume the operator will find and target online backups.

Short-Term (Two Weeks)

1. Segment the network — isolate manufacturing/OT-adjacent systems, engineering workstations, and backup infrastructure into separate security zones with deny-by-default lateral traffic. The current campaign's manufacturing focus makes flat networks an existential risk.
2. Deploy the detections in this briefing — import the Sigma rules into your SIEM and operationalize the Sentinel hunt as a scheduled analytics rule with a 24-hour lookback.
3. Implement egress filtering and DLP — alert on archive-tool execution followed by outbound transfers above baseline; block unsanctioned cloud storage and file-transfer services.
4. Credential hygiene program — tiered administration, LAPS for local admin passwords, and rotation of any credential that has ever traversed a Tier-0 asset.
5. CI/CD and developer tooling review — given TeamCity (CVE-2026-63077) and Nx Console (CVE-2026-48027) exposure, audit build servers and developer extensions as initial-access surface, not just production systems.
6. Tabletop the leak-site scenario — rehearse decision-making for a double-extortion event: who approves communication, what the disclosure thresholds are, and how you respond when your name appears on a .onion site before you've confirmed anything internally.

Security Arsenal monitors ransomware leak sites and translates criminal claims into defensive intelligence. Leak-site listings are unverified accusations; we report what threat actors claim, not what is confirmed. Named organizations are encouraged to contact us at security@securityarsenal.com.

Related Resources

Security Arsenal Incident Response Managed SOC & MDR Services AlertMonitor Threat Detection From The Dark Side Intel Hub