Akira Recovery (Windows and ESXi)
Direct answer
Akira emerged in March 2023 and became one of the most active families of 2024-2026, focused on VMware ESXi and initial access via Cisco VPN without MFA (CVE-2023-20269). It appends .akira to files and drops akira_readme.txt. There is a partial Avast decryptor (June 2023) for an older variant. HD Doctor delivers technical response focused on ESXi, vCenter forensics and Veeam restore.
Akira historically attacked via Cisco VPN without MFA. If you have Cisco AnyConnect VPN exposed without MFA, assume compromise until proven otherwise and enable MFA immediately.
What is Akira
Akira is a ransomware family active since March 2023, possibly linked to former Conti members. Distinctive visual (1980s green CRT-style site) and double-extortion playbook (encryption + darknet leak). Has Windows (.akira) and Linux/ESXi (.powerranges) variants. In 2024 CISA issued advisory AA24-109A documenting massive use of Cisco VPN without MFA as a vector.
Symptoms of Akira infection
- Files with extension .akira or .powerranges (ESXi variant)
- Note 'akira_readme.txt' in affected folders
- Akira site (green CRT style) listing victim companies
- Cisco VPN successful login from foreign IP outside business hours
- ESXi VMs simultaneously powered off, then VMDK encrypted
- Cobalt Strike, AnyDesk, RClone logs (exfiltration)
Most common attack vectors
| Cause | % | Recoverable? |
|---|---|---|
| Cisco VPN without MFA (CVE-2023-20269) | 55% | MFA + patch + restore |
| Exposed RDP or leaked credential | 18% | Hardening + restore |
| SonicWall, Fortinet VPN (recent variants) | 12% | Patch + restore |
| Targeted phishing | 8% | Training + restore |
| Other / unidentified | 7% | Case-by-case analysis |
Distribution based on CISA AA24-109A and Sophos 2024 reports.
What NOT to do upon Akira identification
- 1.Do not re-enable VPN without MFA. Akira re-enters through the same vector if MFA is not enabled. MFA mandatory before any restore.
- 2.Do not ignore RClone exfiltration. Akira exfiltrates data before encrypting. Regulatory notification mandatory within 72h if personal data is involved.
- 3.Do not pay without testing Avast Decryptor. Older variant has free Avast decryptor. Attempt before any payment.
- 4.Do not restore VMDK without datastore snapshot. Keeping the original encrypted state allows future decryptor attempts if new keys are released.
- 5.Do not negotiate without proof of decryption. Operator must decrypt 1 test file before any payment.
HD Doctor process for Akira response
Response focused on Cisco VPN, vCenter and Veeam.
- 1
Triage and containment (0 to 6h)
Immediate Cisco VPN shutdown, full ESXi datastore snapshot, segment isolation, RAM capture, Cisco ASA/ISE log preservation.
- 2
Forensics (6 to 48h)
Cisco log analysis to identify compromised account, vCenter Tasks & Events, identify exact variant (classic Akira vs Megazord). Timeline.
- 3
Avast Decryptor attempt (24h)
For older Akira variants (June 2023), attempt with Avast decryptor in isolated environment. Recent variants have no public decryptor.
- 4
VMware restore (3 to 15 days)
Veeam restore prioritizing critical VMs, VMDK rebuild when header encrypted but data intact, SQL Server/Oracle granular recovery.
- 5
Hardening and report (5 to 25 days)
Mandatory Cisco VPN MFA, CVE-2023-20269 patches, Windows EDR, ESXi lockdown, forensic and judicial report.
Typical SLA for Akira response
| Scenario | Turnaround |
|---|---|
| Triage and containment | 0 to 6h |
| Cisco + ESXi forensics | 24 to 72h |
| Avast Decryptor (older variant) | 24h after match |
| Critical VM Veeam restore | 3 to 15 business days |
| Final technical report | 15 to 30 business days |
- MFA on Cisco VPN is a mandatory post-Akira control.
Affected systems
| Family | Support | Notes |
|---|---|---|
| VMware ESXi 6.0+ | ✅ Primary focus (.powerranges) | Datastore + VMs |
| Windows Server | ✅ Full response (.akira) | AD, file servers, SQL |
| Cisco AnyConnect / Secure Client VPN | ✅ Forensics + hardening | Most common origin |
| Hyper-V | ✅ Punctual cases | Encrypted VHDX |
| Veeam backup | ✅ Guided restore | Includes tampering detection |
Why HD Doctor for Akira response
- 🥷Real Akira production cases, with specific Cisco-VPN-compromised playbook.
- ⚡24×7 response within 6h, with Cisco CCNA and VMware VCP engineer.
- 🔓Updated base with Avast decryptor and eligible variants.
- 💾Veeam restore + SQL granular recovery.
- 📋Forensic report for regulator within 72h.
FAQ about Akira
Is there a free Akira decryptor?
Yes, partially. Avast published in June 2023 a decryptor for Akira variants prior to that date. Later variants (Akira v2, Megazord, .powerranges Linux) have no public decryptor. Avast-base matching is free.
What kind of companies does Akira target?
Small and mid-sized industrial, education and healthcare companies in the US, Europe and Latin America. Preference for organizations with Cisco VPN exposed without MFA. CISA AA24-109A documents the pattern.
How do I know if I was attacked via Cisco VPN?
Signs: (1) successful login from foreign IP outside business hours in Cisco ASA logs; (2) user account with VPN session without prior history; (3) lateral SMB traffic post-VPN-login; (4) Cobalt Strike Beacon execution from internal host. Our playbook includes full Cisco log analysis.
How long until full restore after Akira?
With Veeam immutable backup: 3 to 10 days for critical VMs, 15 to 30 days for full restore. Without clean backup: 30 to 90 days or partial rebuild depending on application.
Why is MFA so critical against Akira?
55% of Akira cases documented by CISA originated from Cisco VPN without MFA. Implementing MFA via Cisco Duo, Microsoft Authenticator or equivalent drastically reduces the most-used vector. It is the highest-defensive-ROI control against Akira in 2026.
Under Akira attack right now?
Cisco + VMware specialists. MFA within 24h after containment.