The Cybersecurity and Infrastructure Security Agency, the FBI, other U.S. agencies and international partners have issued new guidance identifying new methods used by the Akira ransomware group and how to defend against them.
Table of Contents
What Does the CISA Guidance Against Akira Ransomware Include?
The joint advisory provides indicators of compromise and common tactics, techniques and procedures, allowing IT teams to identify Akira ransomware activity and protect their networks, CISA said Thursday. The update is part of CISA and the FBI’s ongoing efforts to combat ransomware.
CISA and the FBI are urging organizations to act quickly by backing up critical data regularly, adopting multifactor authentication and addressing known exploited vulnerabilities.
Learn how cyber experts from the government and industry deal with similar threats by attending the Potomac Officers Club’s 2026 Cyber Summit on May 21. Register here.
Nick Andersen, executive assistant director for the cybersecurity division at CISA, said, “The threat of ransomware from groups like Akira is real and organizations need to take it seriously, with swift implementation of mitigation measures.”
“We urge every organization, large or small, to follow the guidance released today and take steps now to protect their organizations against ransomware threats,” Andersen added.
What Is the Akira Ransomware Group?
The ransomware group mainly attacks small and medium-sized businesses but has also targeted larger organizations across multiple industries, including manufacturing, education, financial services and healthcare. Akira threat actors initially focused on Windows systems, but in an April 2024 advisory, CISA said the group had deployed a Linux variant targeting VMware ESXi virtual machines.
Since January 2024, Akira has impacted more than 250 organizations globally and collected around $42 million in ransom payments.
