Akira G1024
Also known as: GOLD SAHARA, PUNK SPIDER, Howling Scorpius
Updated at source on Jul 31, 2026 · View on MITRE ATT&CK
Akira is a ransomware variant and ransomware deployment entity active since at least March 2023. Akira uses compromised credentials to access single-factor external access mechanisms such as VPNs for initial access, then various publicly-available tools and techniques for lateral movement. Akira operations are associated with "double extortion" ransomware activity, where data is exfiltrated from victim environments prior to encryption, with threats to publish files if a ransom is not paid. Technical analysis of Akira ransomware indicates variants capable of targeting Windows or VMWare ESXi hypervisors and multiple overlaps with Conti ransomware.
Ransomware operations linked to this group ransomware.live
akiraExploited vulnerabilities
CVEs cited by MITRE ATT&CK for this group, with the source excerpt. Records not yet published here appear without a link.
ATT&CK does not cite CVEs for this group.
Techniques by tactic
© The MITRE Corporation. ATT&CK® content reproduced and distributed with the permission of The MITRE Corporation.