Akira RaaS Sets Sight on Nutanix VMs, Poses Threat to Key Organizations

Multiple American and European government agencies warned that recent Akira ransomware activity poses an “imminent threat” to critical infrastructure.

As with most cybercrime groups, the Akira ransomware-as-a-service (RaaS) operation likes to punch down by extorting small and medium-sized businesses (SMBs). It has also gone at bigger fish, in often critical sectors like healthcare, manufacturing, and agriculture.

Highlighting its ongoing threat to critical sectors, the Cybersecurity and Infrastructure Security Agency (CISA), the Department of Health and Human Services (HHS), the FBI, and law enforcement bodies from France, Germany, the Netherlands, and Europol released a joint advisory on Thursday regarding Akira’s latest indicators of compromise (IoC) and tactics, techniques, and procedures (TTPs). Most notably, they pointed out how quickly the group has been exfiltrating victim data, using a variety of new malware tools and software vulnerabilities it has been using, and shifting to a whole new hypervisor attack surface hardly touched by threat actors before it.

In times past, “many observers were slower to recognize Akira as a major threat because an ineffective decryptor released early in its life cycle created a false sense of security, even as the group continued to expand its capabilities and accelerate its operational tempo,” says Cynthia Kaiser, former deputy director of the FBI’s Cybersecurity Division and now senior vice president of Halcyon’s Ransomware Research Center. For at least a couple of years now, though, it has been a top-tier operation, and “one of the faster moving ransomware groups we track,” she says.

Related:Google Looks to Dim ‘Lighthouse’ Phishing-as-a-Service Op

Attackers Discover Nutanix AHV

In its time studying Akira, the team at Arctic Wolf Labs recalls that “what really sets Akira apart is how quickly they can stage a compromised environment for encryption.”

A key enabler, they say, “is their early focus on virtual infrastructure. By gaining control of virtual machine (VM) storage and hypervisor platforms, they can disrupt multiple critical systems at once.” And in this respect, over recent months, Akira has only doubled down.

Historically, Akira has attacked the market-leading hypervisors ESXi (VMware) and Hyper-V (Microsoft). In a June 2025 attack, though, the group encrypted virtual machine disk files associated with a smaller competitor, Nutanix’s Acropolis Hypervisor (AHV).

On its website, Nutanix claims to serve more than 27,000 customers, including organizations in some critical sectors, like the US Navy, Nasdaq, London’s Gatwick airport, and more. Its customers are spread globally, and financial analysts have noted that the company has grown consistently in recent years. They’ve also noted that AHV adoption among those customers sits just shy of 90%. In other words, AHV is a lesser-known but substantial market player, serving more than a few critical organizations.

Related:Data Leak Outs Hacker Students of Iran’s MOIS Training Academy

Not only is AHV a potentially lucrative target for ransomware actors, but it’s also not a place where cybersecurity defenders might be inclined to look. Where ESXi is frequently targeted by hackers — and, to a lesser extent, Hyper-V — Akira appears to be the first major threat actor to aim its sights at AHV.

What Else Is New with Akira

Authorities also recorded a number of other new developments in Akira’s tactics. For instance, it’s been exploiting a handful of known, fixable vulnerabilities in edge devices, including the critical CVE-2024-40711 (Veeam, deserialization of untrusted data) and CVE-2024-40766 (SonicWall, improper access control).

It’s been using commercial remote management and monitoring (RMM) tools like AnyDesk and LogMeIn to perform administrator-type actions in victim networks, primarily for the purpose of undermining security programs like firewalls, antivirus engines, and endpoint detection and response (EDR) platforms.

Related:North Korea’s BlueNoroff Expands Scope of Crypto Heists

A few random malware tools have been cropping in its arsenal, too. Akira actors have been seen using “SystemBC” both as a proxy bot and remote access Trojan (RAT), and the dual threat of “StoneStop” and “PoorTry” — a Windows utility and malicious driver, respectively — for process termination.

As evidence of Akira’s tactical success, authorities noted that the group has sometimes exfiltrated victims’ data in just over two hours’ time. And by late September 2025 — without counting its latest activity — Akira had already collected just shy of $245 million in ransom payments.

The Arctic Wolf Labs team adds that “publicly, more than a thousand total Akira victims are known throughout their tenure. The real number is almost certainly higher.”