Incident response · Akira ransomware
Hit by Akira ransomware? More may be recoverable than the note claims.
Akira has been one of the most consistently active ransomware operations in Australia. It is also, by design, a fast and incomplete encryptor: on large files it scrambles only portions and leaves the rest intact. That design choice is often the opening a recovery works through, without paying.
Recognise it
How to confirm it is Akira.
Before anything else, keep the encrypted files and every ransom note exactly where they are. They identify the strain, and they are often the raw material a recovery works from.
- File extension
- .akira appended to encrypted files (some later variants use different extensions, including .powerranges)
- Ransom note
- akira_readme.txt, dropped in affected folders, pointing to a Tor negotiation site
- First seen
- March 2023; subject of the joint CISA #StopRansomware advisory AA24-109A
- Typical entry
- SonicWall and other VPN appliances without multi-factor authentication (Akira has worked the SonicWall SSL VPN weakness, CVE-2024-40766, since 2024), stolen credentials, and unpatched remote access systems
Behaviour
What Akira does to your systems.
Partial encryption by design
Akira encrypts small files fully but only encrypts portions of larger files, and affiliates can dial the encrypted percentage down for speed. The rest of the file is left untouched on disk.
Shadow copies deleted
Like most modern strains, it deletes Windows volume shadow copies so the easy restore path is gone.
Double extortion
Data is exfiltrated before encryption and the threat of publication is used as a second lever alongside the locked files.
Hybrid encryption
A combination of AES and RSA. Breaking the encryption itself is not a realistic recovery path; working with what was never encrypted is.
Windows, Linux and ESXi
Akira variants target VMware ESXi hosts and Linux systems as well as Windows, so virtualised environments are squarely in scope.
Active against Australia
Akira has ranked among the most active strains in Australian incidents across 2024 and 2025, across sectors and business sizes.
Akira and SonicWall
If you run a SonicWall, start at the firewall.
Akira's most-used route into Australian businesses since 2024 has been the SonicWall SSL VPN, and the first search many victims make is "akira sonicwall". This is what to check, in order, before anything is rebuilt.
Confirm the way in, and keep the evidence
Export the SonicWall logs before anyone touches the appliance. Look for SSL VPN logins from unfamiliar addresses, newly created local users, and firmware older than the CVE-2024-40766 fix. Those logs also answer the question your insurer and the OAIC will ask: did data leave?
Cut the route, keep the box
Disable SSL VPN, rotate every local and directory account that could authenticate to it, and enforce multi-factor authentication before it comes back. Do not factory reset the firewall. A wiped firewall is lost evidence.
Then the ESXi datastores
Akira's Linux build encrypts the VMDK files on the datastore, usually only in part. Leave the datastores and the SAN exactly as they are. Do not recreate VMs, restore over them or reformat storage. That is the data a recovery reads back.
Active Directory and Exchange
If the domain controllers and Exchange were among the encrypted VMs, assume the attacker held domain-level access. Credential resets, including the Kerberos service account, and a review of new accounts and scheduled tasks belong to containment rather than to the clean-up afterwards.
The honest answer
Can Akira-encrypted files be recovered?
Often, substantially, yes. Akira's speed comes from not encrypting everything: on files past a size threshold it encrypts a set of blocks rather than the whole file, and affiliates frequently configure even lighter touches. On large structured files (databases, virtual disks, archives) that leaves most of the underlying data physically intact on disk, recoverable by locating the untouched structures and rebuilding them without any key.
Two honest caveats. Small files are usually encrypted in full, because encrypting a small file costs the attacker nothing. And a free decryptor released in mid-2023 works only against early Akira builds; current variants patched the flaw it relied on, so do not plan around it (check nomoreransom.org, then move on).
Our assessment is quick: the strain build, a sample of encrypted files and their sizes tell us within hours what looks recoverable. Keep the encrypted files, and do not let anyone rebuild the affected machines before that assessment happens.
Free decryptors
Is there a free Akira decryptor?
Two have existed, and neither covers a current build. Avast published a free Windows decryptor in July 2023 that relied on a flaw in early Akira; the operators patched it within weeks. In March 2025 a security researcher published a method that brute-forces keys for the Linux and ESXi build that circulated from late 2023 into 2024. That build seeded its keys from timestamps taken during encryption, so with the original file timestamps, files nobody has touched since, and a lot of GPU time, the key space is small enough to search. It takes hours per file on a rack of GPUs, and it does nothing against builds released after the operators changed the seeding.
So the honest position for a 2026 incident: check nomoreransom.org first, because that is where any genuine tool ends up, then stop looking. Search results for "Akira recovery download" and "Akira recovery code" are full of tools that are either malware or a front for a service that quietly pays the ransom and bills you for it. Nothing you can download will decrypt a current .akira file. Running unknown tools against the originals can destroy the partially intact data a real recovery depends on. Work on copies.
- Avast decryptor, July 2023
- Windows builds from before the fix. Free on nomoreransom.org. Try it on a copy and expect it to fail on anything encrypted after mid-2023.
- GPU brute force, March 2025
- The Linux and ESXi build from late 2023 into 2024 only. Needs untouched files, their timestamps and serious GPU time. A research result, not a product.
- Anything else
- No public decryptor exists for current Akira builds. A download that promises one is malware or a scam.
Virtual disks
Recovering VMDKs after Akira hits ESXi.
Akira's Linux build was written for VMware ESXi. It runs on the hypervisor itself and encrypts each virtual disk on the datastore as one large file. That matters for recovery, because a VMDK is a single file to Akira, not the thousands of files inside it. The small-file problem disappears: a 2 KB document inside a 500 GB disk is only encrypted if its blocks happen to sit in an encrypted range. On a disk where Akira touched a few per cent of the blocks, most guest files come through untouched.
Each encrypted file carries a footer Akira writes at the end, recording the encrypted key and the settings the affiliate ran with. That footer tells us the block pattern, so we know which ranges of the disk are gone before we look inside. From there the work is filesystem repair, which is what ScanCrypt is built for: find the NTFS or ext4 structures that survived, map the intact extents, and rebuild a disk the hypervisor will mount. Databases and mail stores inside the guest need their own pass, because one encrypted block through a table or a mailbox store takes more than a copy to fix.
Two things make it harder. Snapshot chains (the -000001.vmdk delta files) spread the live disk across several files, each encrypted on its own. And a recovery that reads hundreds of terabytes off a SAN is bound by storage throughput before anything clever, so target storage with real capacity matters as much as the method.
- Do not
- Reboot the hosts, delete or recreate datastores, consolidate snapshots, or restore over the encrypted disks. Every one of those overwrites data that was intact.
- Do
- Leave the encrypted VMDKs where they are, take a datastore listing with file sizes, and copy the ransom note and one or two small encrypted files so we can identify the build.
- Send us
- The descriptor (the small text .vmdk), the flat or sparse extent, and the note. Large disks come in through our secure upload portal or on a drive; nothing has to pass through a web form.
Recovered, 2026
Twenty VMs on ESXi, back without paying.
An Australian business rang us after Akira had encrypted the virtual machines on its two ESXi hosts and SAN, Active Directory and Exchange among them. The SonicWall was the way in. We contained it, kept the hosts and the firewall logs intact, and read the encrypted VMDKs back with ScanCrypt. Everything came back, and nobody paid a ransom. Every incident is different, though. How much comes back depends on the build, on how much of each file was encrypted and on what survived, and we can usually say what looks recoverable within hours, well before anyone has to think about paying.
Call 1300 004 766, answered 24/7- Strain
- Akira, Linux and ESXi build
- Environment
- Two ESXi hosts, a SAN, about 20 VMs including on-premises AD and Exchange
- Way in
- SonicWall SSL VPN
- Outcome
- Everything recovered with ScanCrypt. No ransom paid.
- When
- 2026
Outcomes described are specific engagements. No recovery is guaranteed.
Common questions
Akira, in plain terms.
Mid-incident and need a straight answer? Call 1300 004 766. A person answers, 24 hours a day.
What is the .akira file extension?
Files renamed with a .akira extension have been encrypted by the Akira ransomware operation, active since March 2023 and consistently among the most active strains hitting Australian organisations. The ransom note is usually named akira_readme.txt. Keep the encrypted files and notes; they identify the exact build and are often the raw material a recovery works from.
Can .akira files be decrypted for free?
Usually not any more. A free decryptor released in 2023 exploited a flaw in early Akira builds, and the operators patched it. Current variants have no public decryptor. Check nomoreransom.org in case your incident involves an old build, but the realistic recovery paths are backups, snapshots, and partial-encryption recovery of the data Akira never touched.
Can Akira-encrypted files be recovered without paying?
Often, partially, and sometimes substantially. Akira encrypts only portions of large files for speed, so databases, virtual disks and archives frequently retain most of their data intact. That intact data can be located, carved and rebuilt without the attacker's key. It is a recovery effort with honest limits, not a guarantee, and small fully-encrypted files are usually a loss without backups.
Akira hit our ESXi hosts. Does that change anything?
It changes the mechanics, not the principle. Akira's Linux variant encrypts virtual machine disk files on ESXi datastores, and VMDKs are exactly the kind of large structured file where partial encryption leaves a great deal intact. Do not delete or recreate the datastores; leave everything in place and get an assessment first.
What should we do in the first hour?
Isolate the affected machines but leave them powered on, keep every encrypted file and ransom note, take surviving backups offline, and start a simple timeline of what happened when. Do not rebuild, do not run cleanup tools, and do not pay in a panic. Our First-Response Guide covers this on one printable page, and 1300 004 766 is answered around the clock.
Not Akira?
The extension on your files names the strain.
If the note or extension does not match what is on this page, one of these may fit. If none of them do, call anyway: the strain shapes the recovery, but identifying it is our job, not yours.
random extension
Qilin →
The most active operation of 2026. Every victim gets a unique file extension.
.inc
INC Ransom →
Subject of a 2026 ACSC joint advisory. Heavy targeting of Australian healthcare.
.LYNX
Lynx →
Built on the INC Ransom code. Encrypts 5, 15 or 25 percent of each file, so most of a large file survives.
.fog / .flocked
Fog →
Education-focused, enters via VPN credentials, attacks backups first.
.safepay
SafePay →
Encryption depth is a setting, and operators pick shallow. Enters on valid VPN and RDP credentials.
.dragonforce_encrypted
DragonForce →
Full, partial or header-only per file. Dedicated ESXi builds hit whole virtual estates.
README-GENTLEMEN.txt
The Gentlemen →
Busy in Australia through 2026. Comes in through FortiGate, kills endpoint security, then encrypts as little as 1 to 9 percent of each file.
no extension (via your IT provider)
Storm →
New in August 2026. Reaches Australian businesses through a compromised IT provider and lists them with long countdowns.
no extension (theft only)
Kairos →
Never encrypts. Steals data and runs a seven-day clock. Nine Australian victims since 2024.
WHAT_HAPPENED.readme.txt
Lamashtu →
Appeared April 2026 and resumed listing in September. Gives three days to make contact and ten before it publishes.
Or start from ransomware recovery, which covers the method whatever the strain turns out to be.
After the incident
The same responders, before the next one.
Most Akira recoveries end with the same short list: the remote access that had no MFA and the backup the attacker could reach. Fortify is our managed security plan, built from that list. Fortify clients get this incident response team as part of the plan, with no hourly cap on in-scope incidents.
Right now
The first hours decide what can be saved.
Isolate the machines, keep the encrypted files, take backups offline, and call before anything gets rebuilt. Australian incident response, answered by a real person.
Outcomes described are specific engagements. No recovery is guaranteed.