Akira is a ransomware-as-a-service (RaaS) operation that first emerged in March 2023, rapidly gaining notoriety for its targeted attacks against organizations globally. The group's operational model evolved from an initial focus on Windows systems to deploying a Linux variant targeting VMware ESXi virtual machines in April 2023, and later expanding to Nutanix AHV systems. While the current Akira group is distinct from an older ransomware variant sharing the same name from 2017, it is assessed with moderate confidence to be of Russian or broader post-Soviet origin, evidenced by observations of the group communicating in Russian on dark web forums. Akira's primary motivation is financial gain through its double extortion scheme. A distinctive characteristic of Akira is the retro aesthetic of its data leak site, designed to resemble 1980s green-screen consoles. The group is notably efficient, capable of moving from initial access to full network encryption in under four hours. Akira ransomware threat actors are associated with other groups known as Storm-1567, Howling Scorpius, Punk Spider, and Gold Sahara, and have suspected connections to the defunct Conti ransomware group based on technical and operational similarities.

This profile is generated from the same canonical actor-card record used by the Threat Actor Cards directory, so aliases, targeting fields, activity notes, and source links stay aligned as the database is enriched.