1,400+ Victims, $244 Million Ransom: Revealing the 7-Stage Attack Playbook Behind Akira Ransomware's Success

If your environment suffered a ransomware attack today, at which stage would you detect it?

This is not a history question. Just in the week of this article's publication, new victims are still appearing on Akira's dark web leak site.

Since March 2023, this group has never stopped.

In January 2024, Tietoevry, one of the largest cloud service providers in Northern Europe, was attacked, forcing several supermarket chains in Sweden to close;

In April 2025, data protection solution provider Hitachi Vantara was forced to urgently take its servers offline;

In Q1 2026, Akira continued to rank among the top three most active ransomware groups globally with 176 victim targets, with its attack volume in March reaching the second-highest level in history.

The numbers are still growing. To date, there have been more than 1,400 known victims, with a cumulative ransom amount of approximately $244 million. The FBI has listed it as one of the current top five ransomware groups posing the highest threat to US enterprises.

According to research published by Halcyon in April 2026, Akira can typically complete the entire attack chain from initial access to network-wide encryption in less than four hours, and in some cases, even under an hour.

The reason for their high success rate is not complex — Akira possesses a highly stable TTP chain that has been polished through extensive real-world combat, whereas most defense systems have never actually undergone adversarial validation against this chain.

Based on the Howling Scorpius report and MITRE ATT&CK G1024, this article fully restores Akira's seven-stage attack playbook, with each stage labeled with its associated technique number, for security teams to evaluate against their own detection capabilities.

Group Profile

Howling Scorpius is the name of the operating entity of the Akira ransomware gang. MITRE ATT&CK catalogs it as Akira / G1024, with associated names including GOLD SAHARA, PUNK SPIDER, and Howling Scorpius.

The group has been active since March 2023 and belongs to a profit-oriented RaaS (Ransomware-as-a-Service) ecosystem. Its core model is double extortion: first stealing data, then encrypting systems, and threatening to publish the data on its Tor leak site.

The targets are primarily small and medium-sized enterprises, but also affect large organizations and critical infrastructure; key victim regions include North America, Europe, and Australia. Sectors preferred or significantly impacted by the group include manufacturing, education, information technology, healthcare and public health, financial services, food and agriculture.

01 Stage One: Initial Access

Attackers perform the initial breakthrough by sending carefully crafted spearphishing emails, enticing target interaction to gain initial access to the victim's network environment.

• T1566.001
  Phishing: Spearphishing Attachment

02 Stage Two: Local Environment Discovery & Reconnaissance

Attackers will perform extensive scanning and mapping of the victim's internal network. They mainly utilize third-party network scanning tools (such as NetScan, Advanced IP Scanner) combined with Windows' built-in PowerShell and native net commands for asset discovery and topology reconnaissance.

• T1018
  Remote System Discovery

• T1087
  Account Discovery

03 Stage Three: Credential Access & Privilege Escalation

After gaining initial privileges, attackers focus on harvesting high-privilege credentials to expand their control. They execute Mimikatz and LaZagne to obtain cleartext passwords by dumping LSASS process memory, perform Kerberoasting attacks, and directly export Active Directory database files (NTDS.dit) and SYSTEM registry hives.

• T1003.001
  OS Credential Dumping: LSASS Memory

• T1003.003
  OS Credential Dumping: NTDS

• T1558.003
  Steal or Forge Kerberos Tickets: Kerberoasting

04 Stage Four: Persistence

In the deep internal network phase, to achieve long-term and extremely hard-to-detect persistence, attackers directly create new domain accounts in the victim's environment, maintaining persistent access to the entire domain under the guise of a legitimate identity.

• T1136.002
  Create Account: Domain Account

05 Stage Five: Defense Evasion

To ensure subsequent core malicious operations (such as data theft and encryption) can be executed without being blocked, attackers implement destructive evasion strategies. They abuse vulnerable Zemana drivers to force-terminate security processes, thereby disabling Windows Defender, or even directly uninstalling enterprise-grade EDR (Endpoint Detection and Response) protection software.

• TA0005
  Defense Evasion

• T1562.001
  Impair Defenses: Disable or Modify Tools

06 Stage Six: Lateral Movement

After locating high-value targets in the internal network, attackers leverage built-in legitimate remote services to move laterally across the network. The primary protocols and tools utilized include RDP (Remote Desktop), SMB, WMI (Windows Management Instrumentation), and PsExec, thereby covertly executing commands across devices.

• T1021.001
  Remote Services: RDP

• T1021.002
  Remote Services: SMB/Windows Admin Shares

• T1047
  Windows Management Instrumentation

07 Stage Seven: Exfiltration and Impact

In this ultimate phase, attackers first exfiltrate the victim's confidential data on a large scale using data synchronization tools like RClone. Subsequently, they deploy encryptors such as Akira, Megazord, or Akira_v2 (covering Windows, Linux, and ESXi virtualization environments) to perform comprehensive encryption and destruction of local files, network shares, and virtual machines. Finally, they pressure the victim through leak sites on the Tor anonymous network and dedicated negotiation sites for double extortion. Associated MITRE ATT&CK Techniques:

• T1567.002
  Exfiltration Over Web Service: Exfiltration to Cloud Storage

• T1486
  Data Encrypted for Impact

Mitigation & Detection Recommendations

• Defense Evasion and Driver Monitoring

Closely monitor abnormal system driver loading behaviors, particularly calls targeting the Zemana driver known to be prone to abuse; set strict control rules to prevent unauthorized EDR uninstallation and Windows Defender service disabling operations.

• Credential Protection and Auditing

Enable Windows LSA protection (RunAsPPL) to prevent unauthorized LSASS memory reading; enforce strict access controls and monitoring on the NTDS.dit file on Domain Controllers (DCs), and detect abnormal high-frequency Kerberos ticket requests (Kerberoasting) targeting Active Directory at the network level.

• Lateral Movement and Tool Blocking

Audit and restrict unnecessary use of PsExec and WMI to execute remote commands within the network; trigger high-severity alerts for behaviors of running Advanced IP Scanner, NetScan, and RClone from non-standard paths on internal endpoints.

Review completed, now back to the very first question

At which stage can your environment detect it?

In November 2025, a global data storage enterprise suffered an Akira attack that lasted 42 days. It was not that there was no data throughout the process — the victim had deployed two sets of enterprise-grade EDR, and the logs fully recorded every single attack behavior, every lateral movement, and every file prepared for exfiltration. But the systems generated almost zero alerts.

The security team theoretically possessed complete visibility. But in actual combat, they saw nothing.

This is not an isolated case. This is a reality repeatedly proven in the industry: having tools does not equal having capability; having logs does not equal having detection; having detection does not equal being able to withstand real TTPs.

The value of intelligence lies in knowing how the opponent will strike. The value of validation lies in knowing whether you can withstand it. Lacking either, threat intelligence is just a document to be read and destroyed.

If you want to map against Akira's complete attack chain and related TTPs, and run a real-world simulation validation in your own environment, feel free to leave a comment in the comments section, or get in touch with us through the contact information at the end of the article.

Reference Articles:

Hitachi Vantara takes servers offline after Akira ransomware attack, April 28, 2025

Destructive Akira Ransomware Attack with a Single Click on CAPTCHA in Malicious Website, November 19, 2025

Akira Ransomware: Attack Methods, IOCs and Defence 2026, April 21, 2026