Akira: threat actor profile

Akira is a ransomware variant and ransomware deployment entity active since at least March 2023. (MITRE ATT&CK, G1024)

Also known as: GOLD SAHARA, PUNK SPIDER, Howling Scorpius

Attacks we reported

1. Oct 29, 2026 Unit 42 Warns Retailers of Peak Season Cyber Threats

17 techniques MITRE has documented for this group

1. Initial Access Valid Accounts T1078 · External Remote Services T1133
2. Execution Command and Scripting Interpreter: PowerShell T1059.001
3. Persistence Valid Accounts T1078 · External Remote Services T1133
4. Privilege Escalation Valid Accounts T1078
5. Stealth Obfuscated Files or Information: Binary Padding T1027.001 · Masquerading: Match Legitimate Resource Name or Location T1036.005 · Valid Accounts T1078
6. Defense Impairment Disable or Modify Tools T1685
7. Credential Access Steal or Forge Kerberos Tickets T1558
8. Discovery Remote System Discovery T1018 · Domain Trust Discovery T1482
9. Lateral Movement Remote Services: Remote Desktop Protocol T1021.001
10. Collection Data from Information Repositories: Sharepoint T1213.002 · Archive Collected Data: Archive via Utility T1560.001
11. Command and Control Remote Access Tools T1219
12. Exfiltration Exfiltration Over Web Service: Exfiltration to Cloud Storage T1567.002
13. Impact Data Encrypted for Impact T1486 · Account Access Removal T1531 · Financial Theft T1657

All threat actors · ATT&CK heatmap

MITRE ATT&CK® data © The MITRE Corporation, reproduced and distributed with the permission of The MITRE Corporation (Enterprise ATT&CK v20.0).