CISA, FBI, and Partners Issue Critical Guidance on Akira Ransomware in Joint Statement

On November 13, 2025, the Cybersecurity and Infrastructure Security Agency (CISA), FBI, and international partners released an updated joint advisory warning of the escalating threat posed by Akira ransomware. This advisory, part of the #StopRansomware initiative, provides urgent technical guidance, indicators of compromise, and actionable mitigations for organizations, especially those in the financial sector, which has become a prime target for Akira’s evolving tactics.

NETBankAudit experts have over 25 years of experience in ransomware risk assessments, incident response, and regulatory compliance for financial institutions. If you have any questions after reading this guide, please reach out to our team.

Akira Ransomware: A Rapidly Evolving Threat to Financial Institutions

Background and Scale of the Threat

Since its emergence in March 2023, Akira ransomware has compromised at least 342 organizations worldwide, with ransom payments exceeding $244 million as of late September 2025. The financial sector is a key target: between April 2024 and April 2025, Akira attacked 34 financial organizations, making it one of the most active ransomware threats to banks and credit unions. Akira’s operators, linked to the defunct Conti gang, have demonstrated advanced technical capabilities and a willingness to exploit newly discovered vulnerabilities at speed.

Key Characteristics of Akira Ransomware

• Dual-Platform Capability: Akira targets both Windows and Linux/VMware ESXi environments, enabling it to encrypt entire virtual machine clusters, a critical risk for financial institutions reliant on virtualized infrastructure.
• Double-Extortion Model: Akira exfiltrates sensitive data before encryption, threatening public release on rotating Tor-based leak sites if ransoms are not paid.
• Rapid Exploitation of Vulnerabilities: The group aggressively exploits VPN and remote access vulnerabilities, including recent SonicWall and Cisco flaws, often within days of public disclosure.
• Operational Sophistication: Akira employs advanced credential harvesting, lateral movement, and defense evasion techniques, and has demonstrated the ability to exfiltrate large volumes of data in just hours.

Technical Details: How Akira Attacks Financial Institutions

Initial Access and Exploitation

Akira’s primary entry points are unpatched VPN appliances and remote access infrastructure lacking multifactor authentication (MFA). The group has exploited a series of high-profile vulnerabilities, including:

• Cisco VPN flaws (CVE-2020-3259, CVE-2023-20269, CVE-2020-3580, CVE-2023-28252, CVE-2024-37085)
• SonicWall SSL VPN vulnerabilities (CVE-2024-40766, CVE-2025-40596 through CVE-2025-40599)
• Veeam Backup and Replication bugs (CVE-2023-27532, CVE-2024-40711)

Akira also leverages spear phishing, credential abuse, password spraying, and brute-force attacks to gain access, often using initial access brokers to purchase compromised credentials.

Post-Compromise Operations

Once inside, Akira operators move quickly to establish persistence, escalate privileges, and conduct network reconnaissance. They use tools such as Mimikatz, LaZagne, Advanced IP Scanner, and AnyDesk for credential dumping, lateral movement, and remote access. The group disables security software, deletes backups, and targets Veeam and VMware infrastructure to maximize impact.

Data Exfiltration and Encryption

Akira exfiltrates sensitive data using tools like WinRAR, FileZilla, WinSCP, and RClone, often transferring data to cloud storage or via secure tunnels (e.g., Ngrok). The ransomware then encrypts files using a hybrid ChaCha20/RSA scheme, appending .akira, .powerranges, .akiranew, or .aki extensions. Ransom notes direct victims to contact the attackers via Tor, with no initial demand specified,  allowing Akira to tailor demands based on the victim’s profile.

Recent Developments: New Tactics and Expanding Capabilities

2025 Activity and SonicWall Exploitation

The November 2025 CISA advisory highlights Akira’s aggressive exploitation of SonicWall SSL VPN vulnerabilities, with a campaign beginning in July 2025 that targeted financial institutions’ remote access infrastructure. Akira also demonstrated the ability to encrypt Nutanix AHV VM disk files, expanding its reach beyond VMware and Hyper-V environments.

Indicators of Compromise (IOCs) and Tools

The advisory provides extensive IOCs, including file hashes, malicious scripts, and command-line activity. Akira’s toolkit includes both custom malware and legitimate administrative tools, making detection challenging. Financial institutions should review the full list of IOCs and MITRE ATT&CK mappings in the advisory to update their detection and response playbooks.

Mitigation Strategies: CISA and FBI Recommendations

Critical Controls for Financial Institutions

Given Akira’s focus on exploiting remote access and backup infrastructure, CISA, FBI, and partners recommend the following priority actions:

• Enforce Phishing-Resistant MFA: Require MFA for all remote access, VPN, and administrative accounts. Hardware-based MFA is strongly recommended for critical systems.
• Patch Management: Immediately remediate known exploited vulnerabilities, especially those affecting VPNs, remote access, and backup systems. Implement regular vulnerability scanning and ensure critical patches are deployed within 30 days.
• Backup and Recovery: Maintain offline, immutable backups of all critical data. Regularly test backup restoration procedures and ensure backups are segmented from production networks.
• Credential Hygiene: Enforce strong password policies, disable unused accounts, and audit for unauthorized changes. Implement just-in-time and time-based access controls for administrative privileges.
• Network Segmentation: Isolate remote access infrastructure from core business systems. Implement zero-trust principles and restrict lateral movement.
• Detection and Response: Deploy endpoint detection and response (EDR) tools, monitor for abnormal network activity, and establish behavioral baselines. Use SIEM systems to correlate events and alert on suspicious activity.
• Email Security: Add banners to external emails, disable hyperlinks, and deploy advanced phishing detection.
• Security Testing: Conduct regular penetration tests and red team exercises focused on remote access and credential compromise scenarios.

Incident Reporting and Response

If your institution detects suspicious activity or a ransomware incident, promptly report it to the FBI’s Internet Crime Complaint Center (IC3), your local FBI field office, or CISA’s 24/7 Operations Center at contact@cisa.dhs.gov or 1-844-Say-CISA (1-844-729-2472). Include as much detail as possible, such as incident date, affected systems, and contact information. CISA and FBI do not recommend paying ransoms, as payment does not guarantee data recovery or prevent data release, and may encourage further attacks.

Operational and Compliance Implications for Financial Institutions

Business and Regulatory Impact

Akira attacks can result in significant financial losses, operational downtime, and regulatory penalties. Financial institutions face unique risks due to the sensitivity of customer data, the criticality of payment processing, and strict regulatory reporting requirements. Data breaches may trigger notification obligations and expose institutions to fines and reputational harm.

Sector-Specific Vulnerabilities

Banks and credit unions are particularly vulnerable due to their reliance on virtualized infrastructure, remote access systems, and the need for continuous operations. Akira’s ability to target both Windows and Linux/ESXi environments, destroy backups, and exfiltrate sensitive data makes it a formidable threat to the sector.

Strategic Recommendations for Financial Sector Defenders

Proactive Steps for Resilience

To reduce risk and ensure compliance, financial institutions should:

• Implement all CISA/FBI recommended controls and regularly review the latest advisories and IOCs.
• Engage with sector-specific information sharing organizations (e.g., FS-ISAC) to stay informed of emerging threats.
• Test and update incident response and business continuity plans to address ransomware scenarios.
• Ensure all staff, especially IT and security teams, receive ongoing training on ransomware tactics and phishing defense.
• Monitor regulatory developments and maintain readiness for increased scrutiny during audits and examinations.

How NETBankAudit Can Help

Navigating the evolving ransomware landscape requires specialized expertise. NETBankAudit offers tailored ransomware risk assessments, incident response readiness reviews, and regulatory compliance audits for banks and credit unions. Our team’s deep experience with FFIEC, GLBA, and state-level regulations ensures your institution remains resilient and audit-ready, even as threats like Akira continue to evolve.

Contact NETBankAudit today to strengthen your ransomware defenses and ensure your compliance program is prepared for any challenge.