# Akira Ransomware: What to Do in the First Hour, and How It Gets In URL: https://limehawk.io/reports/akira-ransomware Published: 2026-10-02 Author: Corey Watson, Managing Member Topic: Guides Read time: 7 min Hit by Akira? Disconnect affected machines, don't pay, keep the evidence, call IT and your insurer, and report to the FBI. Most Akira entries start at the VPN. > **TL;DR** Akira is a ransomware group that CISA and the FBI say mostly goes after small and mid-sized businesses. It steals your data, then encrypts your systems, and threatens to publish the data if you don't pay. If you see an Akira note, pull the network cable or Wi-Fi on affected machines, leave them powered on, don't contact the attackers, and call IT from a phone, not company email. Then call your cyber insurer and report to the FBI at IC3. The usual way in is a VPN login with no MFA or an unpatched Cisco or SonicWall firewall. Enforced MFA, patched edge devices, EDR, and immutable backups shut most of that down. - Fastest exfiltration CISA cites: Just over 2 hours ## What should I do in the first hour after an Akira ransomware attack? Isolate, don't erase. Unplug the network cable or turn off Wi-Fi on every machine showing the note, but leave them powered on. Don't wipe, reimage, or restore anything yet. Don't open the attackers' chat site. Call IT on a phone, then your cyber insurer. Coordinate everything by phone or text, not company email. Here's the order we'd want an office manager to follow, built on CISA's [#StopRansomware Guide](https://www.cisa.gov/stopransomware/ransomware-guide) response checklist: 1. **Disconnect, don't shut down.** CISA says to isolate affected systems right away. It only recommends powering devices off if you can't disconnect them, because shutting down destroys evidence held in memory. 2. **Get off company email and chat.** CISA advises "out-of-band communication methods such as phone calls" so you don't tip off the attackers. Assume they can read your mailbox. 3. **Call IT.** Whoever runs your network needs to know now, including after hours. If you don't have someone, this is the call to make before anything else. 4. **Don't wipe anything.** Reimaging a machine erases the trail that shows how they got in. Your insurer and investigators need that trail. 5. **Reset passwords from a clean device.** Use a phone or a personal computer that wasn't on the office network, not an infected workstation. Start with email, banking, and admin accounts. Have IT handle the network and VPN accounts, in the right order. 6. **Don't pay, and don't negotiate on your own.** The [CISA and FBI advisory](https://www.cisa.gov/news-events/cybersecurity-advisories/aa24-109a) says plainly: "FBI and CISA do not encourage paying ransom as payment does not guarantee victim files will be recovered." If you already have an [incident response plan](/reports/incident-response-plan-template), get it out now. If you don't, the steps above are the short version of one. ## Who do I tell: the insurer, the FBI, anyone else? Tell your cyber insurance carrier first, then the FBI. CISA's checklist puts the cyber insurance company on the list of people to engage early. Read your policy's notice section or call the claims line before you hire outside help, because the policy may set terms for who you can use. Then file with the FBI at [ic3.gov](https://www.ic3.gov) or call your local field office. The [Akira advisory](https://www.cisa.gov/news-events/cybersecurity-advisories/aa24-109a) lists what the FBI wants in a report: a point of contact, the status and scope of the infection, estimated loss, operational impact, transaction IDs, the date of infection, the date you found it, the initial attack vector, and any indicators from your systems. You can also report to [CISA](https://www.cisa.gov/report). Medical practices can report to HHS at the address listed in the advisory. If client data was taken, you may also have notification duties under your industry's rules or state law. That's a conversation for your attorney and insurer. Don't guess at it. ## What is Akira ransomware? Akira is a ransomware operation that CISA has tracked since March 2023. CISA and the FBI first published their [#StopRansomware advisory, AA24-109A](https://www.cisa.gov/news-events/cybersecurity-advisories/aa24-109a), on April 18, 2024, and most recently updated it on November 13, 2025. That update added new activity the agencies call "an imminent threat to critical infrastructure." The advisory says Akira "primarily target[s] small- and medium-sized businesses, but [has] also impacted larger organizations." As of late September 2025, it says Akira had claimed about $244.17 million in ransom proceeds. Akira runs double extortion. It copies your data out, then encrypts your systems, then threatens to leak the data. The advisory says that in some incidents, Akira pulled data out in just over 2 hours from initial access. By the time the ransom note shows up, assume the data is already gone. It encrypts Windows machines and VMware ESXi hosts, and in a June 2025 incident it also went after Nutanix AHV virtual machines. Encrypted files usually end in `.akira`, `.powerranges`, `.akiranew`, or `.aki`. On Windows, its encryptor uses PowerShell to delete Volume Shadow Copies, the built-in restore points people often count on. ## How does Akira get into a small business network? Mostly through the front door: the VPN. The first initial-access method CISA lists is "VPN service without multifactor authentication (MFA) configured." A stolen or guessed password plus a VPN with no second factor is all it takes. The advisory also names known vulnerabilities in edge devices and backup software: - **Cisco** VPN flaws (CVE-2020-3259 and CVE-2023-20269). - **SonicWall** CVE-2024-40766, which CISA says Akira "likely abused" for initial access. - **Veeam Backup & Replication** flaws (CVE-2023-27532 and CVE-2024-40711). On SonicWall, the vendor's own [August 2025 notice](https://www.sonicwall.com/support/notices/gen-7-and-newer-sonicwall-firewalls-sslvpn-recent-threat-activity/kA1VN0000000RDG0A2) tied a wave of SSL VPN incidents to that same CVE-2024-40766. It said many involved migrations from Gen 6 to Gen 7 firewalls "where local user passwords were carried over during the migration and not reset." SonicWall's fix: update firmware, reset every local SSL VPN password, remove inactive accounts, and enforce MFA. CISA also lists spearphishing, valid credentials bought or stolen elsewhere, password spraying, and exposed Remote Desktop. We've found [RDP open to the internet](/reports/open-rdp-onboarding-discovery) during onboarding discovery before. Stolen passwords often come from [infostealer malware](/reports/infostealer-malware) on a home or work PC. ## Why do backups need to be offline or immutable? Because Akira looks for your backups. It deletes Windows shadow copies, and two of the vulnerabilities in the advisory are in Veeam, a common backup product. If the attackers can log into your backup server with the same admin account they stole, they can delete your restore points before they encrypt. CISA's mitigation is specific: keep backups offline, and "ensure all backup data is encrypted, immutable (i.e., cannot be altered or deleted), and covers the entire organization's data infrastructure." Immutable means even an admin account can't delete it before the retention period ends. That's the [3-2-1 backup rule](/reports/3-2-1-backup-rule) with a hard requirement on the "1": one copy the network can't touch. And a backup you've never restored from is a guess. Test it. ## What controls stop Akira's initial access? Most Akira entries fail against a short list of controls. These track the advisory's own mitigations: - **Enforced MFA on every remote login.** VPN, remote desktop gateways, email, and admin portals. CISA asks for phishing-resistant MFA. Our [phishing-resistant MFA guide](/reports/phishing-resistant-mfa) explains what that means and where to start. - **Patch the edge first.** Firewalls, VPN appliances, and backup servers get patched before workstations. CISA's first mitigation is to remediate known exploited vulnerabilities. - **Clean up VPN accounts.** Remove old users, reset passwords carried over from old hardware, and turn on account lockout. - **No RDP on the internet.** Put remote access behind the VPN, with MFA. - **EDR on every machine.** CISA lists endpoint detection and response. Plain antivirus isn't the same thing; see [EDR vs. antivirus](/reports/edr-vs-antivirus). - **Separate admin accounts.** CISA recommends long passwords (at least 15 characters) and time-limited admin access. Don't let the account that reads email also manage backups. - **Segment the network.** Keep the plant floor apart from the office. On a [manufacturing network](/industries/manufacturing), that's what keeps a ransomware note in accounting from stopping the line. Akira isn't the only group working this playbook. [Qilin](/reports/qilin-ransomware) goes after the same kinds of businesses, and the same controls apply. ## Key takeaways - If you see an Akira note: isolate the machine, leave it on, don't wipe it, don't contact the attackers, and call IT by phone. - Call your cyber insurer early and report to the FBI at ic3.gov. CISA and the FBI do not encourage paying. - Akira usually comes in through the VPN: no MFA, reused or carried-over passwords, or an unpatched Cisco or SonicWall device. - Akira deletes Windows shadow copies and goes after backup servers. A backup it can reach is a backup it can destroy. Keep one copy offline or immutable. - The fixes are boring and they work: enforced MFA on every remote login, patched firewalls, EDR on every machine, and a restore you've actually tested. ## What this looks like when we do it Our [managed IT and security](/services/managed-it-security) baseline covers most of the controls above: EDR on every managed machine, 24/7 monitoring, patching, and MFA enforced across Microsoft 365. Our managed firewall work keeps RDP off the internet, and our compliance and backup service keeps backups tested, not assumed. For plants, we keep production systems segmented and patch on the schedule the line allows. Our [manufacturing page](/industries/manufacturing) covers how we handle legacy Windows and SCADA without exposing them. When something does go wrong, our clients get a person on the phone in under 15 minutes for critical issues. We isolate first, preserve the evidence, and work with your insurer instead of around them. The details are on our [managed IT and security page](/services/managed-it-security). Worried your VPN is the open door? Book a call and we'll check it with you.