AKIRA
AKIRA is a ransomware group with a financial motive, tracked by Brandefense. It targets 19 sectors, including Government and Technology, in 76 countries, including the United States and the United Kingdom. It uses 137 MITRE ATT&CK techniques and exploits 54 known CVEs.
- Megazord
- Akira Team
- GOLD SAHARA
- PUNK SPIDER
- Techniques
- 137
- Exploited CVEs
- 54
- First seen
- Mar 1, 2023
- Last seen
- Sep 8, 2026
- Record updated
Who They Target.
About AKIRA.
The Akira ransomware group is said to have emerged in March 2023, and there's much speculation about its ties to the former CONTI ransomware group. It's worth noting that with the end of CONTI's operation, several affiliates migrated to independent campaigns such as Royal, BlackBasta, and others. According to some reports, Akira affiliates also work with other ransomware operations, such as Snatch and BlackByte, as an open directory of tools used by an Akira operator was identified, which also had connections to the Snatch ransomware. The first version of the Akira ransomware was written in C++ and appended files with the '.akira' extension, creating a ransom note named 'akira_readme.txt,' partially based on the Conti V2 source code. However, on June 29, 2023, a decryptor for this version was reportedly released by Avast. Subsequently, a version was released that fixed the decryption flaw on July 2, 2023. Since then, the new version is said to be written in Rust, this time called 'megazord.exe,' and it changes the extension to '.powerranges' for encrypted files.
Last updated Sep 22, 2026. Compiled by Brandefense technologies from structured threat intelligence and reviewed by Brandefense analysts. Techniques follow the MITRE ATT&CK framework.