Akira Ransomware Nutanix AHV Recovery

For years, Nutanix users felt relatively shielded from the “ESXi-fication” of ransomware, where groups like LockBit and BlackBasta focused almost exclusively on VMware. However, the tide has turned. Recent intelligence from CISA and the FBI confirms that the Akira ransomware group has officially expanded its arsenal to include custom tools designed to encrypt Nutanix Acropolis Hypervisor (AHV) environments.

This shift marks a significant evolution in the threat landscape, as Akira becomes the first major player to systematically target hyperconverged infrastructure (HCI) beyond the traditional big players.

Anatomy of an Akira Attack on Nutanix

Akira’s approach is methodical. They don’t just “hit” the hypervisor; they dismantle the security layers surrounding it first.

• The Infiltration: Attackers typically enter through unpatched VPNs (Cisco/SonicWall) or via vulnerabilities in backup software like Veeam (specifically CVE-2024-40711).
• The “Prism” Pivot: Once inside the network, Akira moves laterally to compromise Nutanix Prism. By gaining administrative control of the management plane, they can bypass VM-level security.
• The Shutdown: To ensure successful encryption, the group has been observed using Prism commands to power down Virtual Machines. This releases “file locks” on the virtual disks, allowing their Rust-based encryptor to lock the data without interference.
• The Double Extortion: Before the encryption begins, they use tools like rclone to exfiltrate sensitive data, threatening to leak it on their “Akira Leaks” site if the ransom isn’t paid.

How to Protect Your Nutanix Environment

If you are running AHV, your “set it and forget it” security posture needs an update. Here are the non-negotiables:

1. Isolate the Management Plane: Ensure Nutanix Prism is restricted to a dedicated management VLAN and is never accessible via the public internet.
2. Enforce Phishing-Resistant MFA: Password-only access for IT admins is an open door. Require hardware keys or certificate-based authentication for all infrastructure access.
3. Deploy Microsegmentation: Use Nutanix Flow to create “Zero Trust” boundaries. Even if a single VM is compromised, microsegmentation can prevent the attacker from reaching your AHV hosts.
4. Immutable Backups are Mandatory: Akira actively seeks out and deletes backups. Utilize WORM (Write Once, Read Many) storage or air-gapped offsite copies to ensure you have a “clean” restore point.

Pro Tip: Monitor your environment for the unauthorized installation of remote access tools like AnyDesk or Cloudflare Tunnel (Cloudflared). Akira frequently uses these to maintain persistence even after you think you’ve kicked them out.

How We Recover Nutanix AHV Environments

Our recovery protocol for Nutanix is unique and focused on data integrity:

• VDisk Header Repair: We utilize proprietary tools to repair the headers of encrypted Nutanix virtual disks, often allowing for partial or full recovery without a decryptor.
• Container Level Isolation: We help you use Nutanix Flow to create “Zero Trust” boundaries, ensuring the attacker cannot reach your AHV hosts even if they have credentials for a single VM.
• Immutable Snapshot Verification: We audit your Nutanix snapshots to ensure the “Shadow Hunt” didn’t delete your local protection before the attack began.

Public Decryption Tools for Akira Ransomware

There are several akira ransomware decryptors available for now. As you know, akira ransomware is active since 2023. They use several variants and they are updating their encryptors gradually. You can download several public decryptors from the links given below.

Avast Decryptor for Akira Ransomware (Windows and ESXi Servers)for Mid 2023 Version:

Download Link: https://decoded.avast.io/threatresearch/decrypted-akira-ransomware/

Steps to Use the Avast Akira Decryptor

1. Download the Decryptor: You would have needed to download the specific Akira decryptor from Avast’s official website or the No More Ransom Project website.
2. Run as Administrator: It was generally recommended to run the decryptor executable file as an administrator on your Windows system.
3. Follow the Wizard: The tool likely presented a wizard interface to guide you through the decryption process.
4. Select Encrypted Files/Folders: You would have needed to specify the locations on your computer where the Akira-encrypted files were stored.
5. Provide the File Pair: This was a crucial step. You would have been prompted to provide the path to an original, unencrypted file and its corresponding encrypted version.
6. Start the Analysis/Password Cracking: Once you provided the file pair, the decryptor would analyze them and attempt to find the decryption key. This process could take some time, potentially a few seconds to longer depending on the complexity.
7. Decrypt Your Files: If the tool successfully found the key, you would then be able to start the decryption process for all the encrypted files you selected.
8. Verify Decryption: After the process was complete, you would need to check if your files were successfully decrypted and accessible

Akira Decryptor for ESXI Servers (Linux only) Version :

Download link: https://github.com/yohanes/akira-bruteforce

Steps to Use Akira Decryptor by Yohanes

This is a technical process and requires a strong understanding of Linux command-line, Python, and potentially GPU computing.

1. Access the GitHub Repository: Locate Yohanes Nugroho’s GitHub repository for the Akira Linux V3 decryptor. The specific link was not directly provided in the search results, but searching GitHub for “Akira decryptor Linux GPU” or similar terms should help you find it.  
2. Understand the Requirements and Instructions: Carefully read the documentation and instructions provided in the GitHub repository. This will outline the necessary software, dependencies (like Python and potentially CUDA for GPU acceleration), and how to prepare your system.
3. Gather Necessary Data:
   • Obtain the timestamps of your encrypted files. Linux tools like ls -l can provide modification times, but you might need more precise timestamps if available.
   • Identify a known plaintext and its corresponding ciphertext (encrypted version). The larger the file, the better.
   • Determine your server’s timing offsets: The repository likely provides tools or scripts to help you test your server’s timing to narrow down the range of nanosecond offsets to brute-force.
4. Set Up Your Environment:
   • Ensure you have Python installed on your Linux system.
   • Install any required libraries or dependencies mentioned in the repository (e.g., for GPU processing).
   • If using GPUs, ensure you have the necessary drivers installed (e.g., NVIDIA drivers for CUDA).
5. Configure the Decryption Tool: You will likely need to configure the provided scripts with the paths to your encrypted files, the plaintext/ciphertext pair, and potentially the determined timing offsets.
6. Run the Brute-Force Script: Execute the Python script designed to brute-force the KCipher2 and ChaCha8 encryption keys using your CPU or (preferably) your GPUs. This process can take a significant amount of time, ranging from days to weeks depending on the GPU power available and the range of timestamps to check.
7. Run the Decryptor: Once the script successfully finds the decryption keys, you should be able to use another script in the repository (or modify the brute-force script) to decrypt your Akira-encrypted files using the found keys.

Others

You can look more available decryptors for this ransomware from the link given below.

Akira Decryptors by Nomoreransom: https://www.nomoreransom.org/en/decryption-tools.html

The Critical Role of Backups Against Akira

Akira operators, like most modern ransomware groups, actively hunt for and attempt to delete or encrypt backups to increase pressure on victims to pay. This makes a robust backup strategy absolutely essential:

• Follow the 3-2-1 Rule: Maintain at least 3 copies of your important data, on 2 different types of media, with 1 copy stored offsite or offline.
• Ensure Offline/Immutable Backups: Your most critical defense is having backups that are inaccessible from the main network. This could be:
  • Offline Backups: Physically disconnected storage (e.g., rotated external hard drives, tapes).
  • Immutable Backups: Cloud storage or appliances configured so backups cannot be altered or deleted for a set period, even by an administrator account (which could be compromised).
  • Air-Gapped Backups: Systems that are only connected to the network for brief periods to perform the backup.
• Test Your Backups Regularly: Backups are useless if they can’t be restored. Regularly test your restore process to ensure data integrity and that the process works as expected. Don’t wait for a disaster to discover your backups are corrupted or incomplete.

Reporting an Akira Attack & Legal Considerations

Dealing with a ransomware attack goes beyond technical recovery. There are important reporting steps and potential legal obligations:

• Report to Law Enforcement: File a report with your national cybercrime authority (e.g., the FBI’s Internet Crime Complaint Center (IC3) in the US, Action Fraud in the UK, or your country’s equivalent).
  • Why? It helps authorities track ransomware groups, potentially links your case to others, provides an official record, and in some rare instances, law enforcement might recover decryption keys later.
• Notify Relevant Agencies: Depending on your location and industry, you may need to report the incident to specific agencies like CISA (Cybersecurity and Infrastructure Security Agency) in the US.
• Assess Data Breach Obligations: Crucially, since Akira performs data theft (double extortion), determine if sensitive data was accessed or stolen (Personal Identifiable Information – PII, Protected Health Information – PHI, financial data, intellectual property).
  • If sensitive data was compromised, you may have legal obligations under regulations like GDPR, HIPAA, CCPA, etc., to notify affected individuals and regulatory bodies.
  • Consult Legal Counsel: It is highly recommended to engage legal counsel specializing in cybersecurity and data privacy to understand your specific obligations based on your jurisdiction and the nature of the potentially stolen data.

Cyber Insurance and Akira Ransomware

If your organization has a cyber insurance policy:

• Notify Your Insurer Immediately: Most policies have strict notification deadlines. Contact your insurer or broker as soon as possible after discovering the incident. Failure to do so could jeopardize your coverage.
• Understand Policy Requirements: Be aware that your policy likely dictates specific steps you must take. Often, insurers require you to use pre-approved (“panel”) vendors for incident response, forensic analysis, legal counsel, and ransom negotiation/payment. Using non-approved vendors might not be covered.

Beyond Encryption: The Threat of Akira’s Data Leaks

Remember, Akira employs double extortion. Paying the ransom to decrypt files does not guarantee they won’t leak your stolen data. The consequences of a data leak can be severe and long-lasting, including:

• Regulatory Fines: Significant penalties under data protection laws (like GDPR).
• Lawsuits: Legal action from customers, employees, or partners whose data was exposed.
• Reputational Damage: Loss of customer trust and public goodwill.
• Competitive Disadvantage: Exposure of trade secrets, intellectual property, or strategic plans.

After Akira: Securing Your Network Post-Recovery

Successfully recovering your data, whether through backups or decryption, isn’t the final step. You need to ensure Akira (or another threat) can’t easily get back in:

• Conduct a Root Cause Analysis: Work with incident response professionals to determine exactly how the attackers gained initial access, how they moved through your network, and what vulnerabilities were exploited. This is critical to prevent recurrence.
• Securely Rebuild Systems: Affected systems should ideally be rebuilt from clean backups or known-good images, not just decrypted. Ensure they are fully patched and hardened before reconnecting to the network.
• Reset Credentials: Change passwords for all accounts, especially administrator and service accounts, that could potentially have been compromised. Implement MFA wherever possible if not already done.
• Implement Lessons Learned: Use the findings from the incident response and root cause analysis to strengthen your security posture. This might involve deploying new tools, changing security policies, or enhancing user training.