CISA Issues Advisory Update on Akira Ransomware Threats
5 companies named across 21 categories, one of 312 articles referencing Cybersecurity and Infrastructure Security Agency (CISA). Previous coverage: Daily Intelligence Brief: Eviden and Baidu Introduce Enhanced AI Solutions - November 13, 2025 (Nov 2025).
Companies mentioned
Best suited for
- Persona
- Security Operations Leader
- Decision stage
- Which to buy
- Adoption curve
- Early Majority
Our classification, not the publisher's statement. Best suited for, not only for.
Today, Cybersecurity and Infrastructure Security Agency (CISA), in collaboration with the Federal Bureau of Investigation, Department of Defense Cyber Crime Center, Department of Health and Human Services, and international partners, released an updated joint Cybersecurity Advisory, #StopRansomware: Akira Ransomware, to provide network defenders with the latest Indicators of Compromise (IOC), tactics, techniques, and procedures, and detection methods associated with Akira ransomware activity.
This advisory reflects new findings as of Nov. 13, 2025, highlighting Akira ransomware’s evolution and continued threat to critical infrastructure sectors. Akira ransomware threat actors, associated with groups such as Storm-1567, Howling Scorpius, Punk Spider, and Gold Sahara, have expanded their capabilities, targeting small and medium-sized businesses as well as larger organizations across sectors including Manufacturing, Educational Institutions, Information Technology, Healthcare, Financial, and Food and Agriculture.
Key Updates:
- Initial Access: Threat actors exploit vulnerabilities in edge devices and backup servers, such as authentication bypass, Cross-Site Scripting (XSS), buffer overflow, and compromise credentials through brute-force techniques.
- Discovery: Threat actors use command line techniques to accomplish network and domain discovery.
- Defense Evasion: Threat actors use remote management and monitoring tools such as Anydesk and LogMeIn to mimic administrator activity, and modify firewall settings, terminate antivirus processes and uninstall Endpoint Detection And Response (EDR) systems.
- Privilege Escalation: Threat actors deploy POORTRY malware to modify BYOVD configurations on vulnerable drivers, create administrator accounts, steal administrator login credentials, and bypass VMDK protections, as well as exploit Veeam vulnerabilities.
- Lateral Movement: Threat actors use remote access tools and protocols like Remote Desktop Protocol (RDP), Secure Shell (SSH), and steal Kerberos authentication tickets to move within networks.
- Command and Control (C2): Threat actors use Ngrok to establish encrypted sessions, SystemBC malware as a remote access trojan, and STONETOP malware to deploy Akira payloads.
- Exfiltration and Impact: Threat actors use protocols such as File Transfer Protocol (FTP), SSH File Transfer Protocol (SFTP), and cloud services to exfiltrate data.
- Encryption: Threat actors use a new Akira_v2 ransomware variant that enables faster encryption speeds and further inhibits system recovery.
CISA and its partners strongly encourage organizations to apply patches for known vulnerabilities, especially those affecting Virtual Private Network (VPN) products and backup servers, and enforce Multifactor Authentication (MFA) for all remote access services. Organizations should monitor unauthorized domain account creation and unusual network activity while deploying EDR solutions to enhance security.
For more information, see CISA’s updated #StopRansomware Guide.
Blog post, originally published by CISA at cisa.gov.