Last Updated: February 25, 2026
Threat Actor Group: Gold Sahara / Howling Scorpius
Primary Targets: Windows Servers, VMware ESXi, and Nutanix AHV
As of February 2026, Akira has evolved from a mid-market nuisance into a Tier-1 threat to enterprise infrastructure. Moving beyond standard encryption, the group now utilizes the Megazord (Rust) engine to systematically dismantle virtualized environments. This guide outlines the 2026 threat profile and provides an incident response roadmap for IT leadership and security teams.
1. Technical Indicators of Compromise (IOCs)
If you detect any of the following file hashes or behaviors in your environment, assume an active breach is in progress.
A. Malicious File Hashes (SHA-256)
| Component | SHA-256 Hash | Description |
| Megazord Encryptor | ffd9f58e5fe8502249c67cad0123ceeeaa6e9f69b4ec9f9e21511809849eb8fc | Main Rust-based binary. |
| Akira_v2 (Linux/ESXi) | 3298d203c2acb68c474e5fdad8379181890b4403d6491c523c13730129be3f75 | Targeted at Nutanix AHV and ESXi. |
| VeeamHax.exe | aaa6041912a6ba3cf167ecdb90a434a62feaf08639c59705847706b9f492015d | Credential leaking tool for Veeam. |
| STONETOP Loader | 58359209e215a9fc0dafd14039121398559790dba9aa2398c457348ee1cb8a4d | Used to disable EDR/AV agents. |
B. Network & Persistence Indicators
- Encrypted Extensions:
.akira,.powerranges,.akiranew,.aki - Ransom Notes:
akira_readme.txt,powerranges.txt,fn.txt - Backdoor Tools: Presence of
rclone.exe,AnyDesk.exe,cloudflared.exe, orngrok.exein unauthorized directories (C:\Windows\Tempor%AppData%). - Log Tampering: Windows Event ID 1102 (The audit log was cleared) is a high-signal indicator of Akira clearing their tracks.
Ransom Note
akira_readme.txt
Hi friends,
Whatever who you are and what your title is if you’re reading this it means the internal infrastructure of your company is fully or partially dead, all your backups – virtual, physical – everything that we managed to reach – are completely removed. Moreover, we have taken a great amount of your corporate data prior to encryption.
Well, for now let’s keep all the tears and resentment to ourselves and try to build a constructive dialogue. We’re fully aware of what damage we caused by locking your internal sources. At the moment, you have to know:
- Dealing with us you will save A LOT due to we are not interested in ruining your financially. We will study in depth your finance, bank & income statements, your savings, investments etc. and present our reasonable demand to you. If you have an active cyber insurance, let us know and we will guide you how to properly use it. Also, dragging out the negotiation process will lead to failing of a deal.
- Paying us you save your TIME, MONEY, EFFORTS and be back on track within 24 hours approximately. Our decryptor works properly on any files or systems, so you will be able to check it by requesting a test decryption service from the beginning of our conversation. If you decide to recover on your own, keep in mind that you can permanently lose access to some files or accidently corrupt them – in this case we won’t be able to help.
- The security report or the exclusive first-hand information that you will receive upon reaching an agreement is of a great value, since NO full audit of your network will show you the vulnerabilities that we’ve managed to detect and used in order to get into, identify backup solutions and upload your data.
- As for your data, if we fail to agree, we will try to sell personal information/trade secrets/databases/source codes – generally speaking, everything that has a value on the darkmarket – to multiple threat actors at ones. Then all of this will be published in our blog – https://akiral2iz6a7qgd3ayp3l6yub7xx2uep76idk3u2kollpj5z3z636bad.onion.
- We’re more than negotiable and will definitely find the way to settle this quickly and reach an agreement which will satisfy both of us.
If you’re indeed interested in our assistance and the services we provide you can reach out to us following simple instructions:
- Install TOR Browser to get access to our chat room – https://www.torproject.org/download/.
- Paste this link – hxxps://akiralkzxzq2dsrzsrvbr2xgbbu2wgsmxryd4csgfameg52n7efvr2id.onion/d/9848450766-HEBKP
- Use this code – – to log into our chat.
Keep in mind that the faster you will get in touch, the less damage we cause.
1. The Anatomy of a 2026 Akira Attack
Modern Akira operations are characterized by a 4-to-12-hour “time-to-encryption.” Their focus has shifted from simple endpoint encryption to the destruction of the Operational Core.
A. Initial Access & The “Breach Window”
Akira affiliates actively scan for and exploit known vulnerabilities in edge infrastructure to gain an initial foothold:
- SonicWall VPN (CVE-2024-40766): The primary entry vector. Exploitation allows attackers to bypass MFA and hijack session cookies.
- Veeam Backup & Replication (CVE-2024-40711): Used for Unauthenticated Remote Code Execution (RCE). Attackers target the backup server to purge immutable backups and extract administrative credentials.
B. The “STONETOP” Loader & EDR Blindsiding
Unlike legacy malware, the 2026 Akira variant utilizes the STONETOP Loader. This utility employs BYOVD (Bring Your Own Vulnerable Driver) techniques to inject malicious code into the kernel. This “blinds” EDR solutions like CrowdStrike or SentinelOne, preventing them from detecting the ransomware process until after encryption is complete.
2. Multi-Platform Encryption: ESXi, Windows, and Nutanix AHV
Akira is platform-agnostic. By mastering the management layers of virtual environments, they force maximum operational downtime.
| Target Platform | Methodology | Impact |
| Windows | Megazord (Rust) + STONETOP Loader | System-wide encryption with service termination via Restart Manager API. |
| VMware ESXi | SSH/vCenter Pivot + vim-cmd | Hard power-down of VMs followed by raw .vmdk encryption. |
| Nutanix AHV | Prism Management Plane Hijack | Targeted encryption of VDisk files within the Distributed Storage Fabric. |
3. The “Shadow Hunt” Phase (Backup Destruction)
Before a single file is encrypted, Akira executes the Shadow Hunt routine. This procedure identifies and destroys local and cloud-based backups.
- Note: Unless backups are truly air-gapped or protected by Write Once, Read Many (WORM) hardware-level immutability, they are considered compromised.
4. Why Legacy Decryptors Are Dangerous
Early security tools (e.g., the 2023 Avast decryptor) are obsolete.
- The Reason: These tools were designed to exploit flaws in the original C++ code that Akira patched in 2024.
- The Risk: Applying these legacy tools to the 2026 Rust-based “Megazord” variant will corrupt file headers, rendering forensic recovery impossible. Do not attempt to use legacy decryptors on current Akira variants.
5. Incident Response Checklist (Triage)
If you suspect an active breach, follow these steps immediately to contain the impact:
- Sever Management Planes: Disconnect Nutanix Prism, vCenter, and Backup consoles from the internet. Do not power off hosts unless instructed by a forensic lead (to preserve volatile memory artifacts).
- Audit Logs: Search for Event ID 1102 (Windows Security Log cleared) and unauthorized additions to the “ESX Admins” group (CVE-2024-37085).
- Identify Persistence: Look for
Cloudflaredorrclone.exeinstances running in%AppData%orC:\Windows\Temp\. - Legal Compliance: Because Akira is operated by Gold Sahara (an entity under global sanction scrutiny), contact legal counsel to ensure any proposed recovery efforts meet OFAC/HM Treasury compliance standards.
6. Proactive Hardening for 2026
- Harden Remote Access: Replace standard VPNs with Zero-Trust Network Access (ZTNA) or enforce FIDO2-compliant phishing-resistant MFA.
- Segment the Management Plane: Use Nutanix Flow or VMware NSX to isolate your hypervisor management consoles from the general user network.
- Immutable Backups: Test your “restore” process quarterly. If your backup server’s admin account can be compromised, your backups are at risk.
Need Expert Assistance?
Recovery from 2026-era Akira variants often requires Forensic Header Repair rather than decryption. Our team provides specialized analysis for Nutanix AHV and VMware ESXi infrastructures.
Akira is a relatively new strain of ransomware, and to the best of our knowledge, publicly available decryptors may not cover all its evolving variants. Fortunately, Our reverse engineering experts have developed a suite of custom tools and proprietary techniques that have proven effective against numerous variants of Akira ransomware. Because each case is unique, we begin with a free assessment to determine the specific variant and the likelihood of successful data recovery.
The only way to know precisely how much ransomware response will cost is to contact us for a free consultation.
The cost of our decryption will depend on the number of files and data. It also depends on the number of infected systems.
Affordable and Easy to Use.
Simple User-Interface.
Refund Guarantee (Terms & Conditions) will be applied.
High success rate in data recovery.
Live Support.
Backup, Backup, Backup! In most cases, a fresh and secure backup of data can prevent ransomware attack from succeeding. For this reason, many attackers put in a lot of effort to find and encrypt backups. The best backup will be air-gapped, meaning physically disconnected from your main network. It is also important to have a regular backup schedule with robust security procedures.
Install a Next-Gen Antivirus. Next generation anti-virus software combines a classic signature-based antivirus with powerful exploit protection, ransomware protection and endpoint detection and response (EDR). Mcafee, Fireeye, and Sentinel One are all examples of antivirus software with these features.
Install a Next-Gen Firewall. A Next-Gen-Firewall is also called Unified threat management (UTM) firewall. It adds a layer of security at every entry and exit point of your company data communication. It combines classic network security with intrusion detection, intrusion prevention, gateway antivirus, email filtering and many other features.
If you can afford it, having staff or hiring a dedicated service to monitor network traffic can also help to detect unusual activity and prevent ransomware attacks. Ransomware attackers usually do a lot of surveillance on a network before attempting a hack. This “reconnaissance” phase has certain tell-tale signs. If you can catch these early, it’s possible to detect the attacker early and deny them access to the network.
If you get hit by ransomware, a professional Ransomware recovery service can help to identify and patch security gaps
In emergencies, we can start with the ransomware data recovery immediately. Since our support team operates 24/7, we can reduce your downtime to a minimum by working non-stop to recover your data.
Targeting VMware ESXi servers allows the attacker to encrypt multiple virtual machines at once, each of which possibly contains large amounts of company data. We have developed special Akira Decryptor by exploiting a flaw in the encryptor of Akira for Esxi Servers to decrypt all files such as vhdx, vmdk, and others.
Security Researcher, Malware Analyst, Tech Writer.
