Seven Australian Victims in a Year: Inside the Akira Ransomware Group

Prepared by: Richard Grainger, Global Head of Digital Forensics

Threat actor profile: Akira 

Threat actor status: ACTIVE 

Akira is a financially motivated ransomware group that has been actively targeting Australian organisations. In the 2024–25 financial year, Akira named seven Australian victims on its dark web leak site — placing it alongside Sarcoma and Qilin as one of the most active ransomware groups operating in this region. Triskele Labs has directly responded to nine Akira-related incidents, making it one of only ten groups for which Triskele Labs handled more than one engagement in FY25. 

That firsthand experience paints a consistent picture: Akira affiliates are methodical, patient, and deliberate. They don't just encrypt and run. They steal data first, destroy backups, and then apply sustained psychological pressure to force payment — through ransom notes, emails to staff, and in some cases direct phone calls to victims. 

This article breaks down how Akira operates, what Triskele Labs has observed across those nine incidents, and what organisations can do to reduce their exposure. 

How Akira gets in 

Akira operates under a ransomware-as-a-service (RaaS) model, meaning the core group provides tooling and infrastructure to a network of affiliates who carry out the actual attacks in exchange for a share of ransom payments. This structure means tactics can vary slightly between affiliates, but a consistent pattern has emerged across the incidents Triskele Labs has responded to. 

The two most common entry points are SSL VPN portals and Remote Desktop Protocol (RDP) services. 

SSL VPN portals are web-based gateways that allow employees to connect to a company's internal network remotely — the same type of system many organisations relied on heavily during the shift to hybrid work. RDP (Remote Desktop Protocol) is a Microsoft technology that allows someone to remotely control a computer over a network, commonly used by IT staff and service providers to manage systems without being physically present. 

When these services are exposed to the internet without multi-factor authentication (MFA), they become targets. Akira affiliates conduct password spraying — a technique where attackers try a small number of commonly used passwords across a large number of accounts, avoiding lockouts while systematically working through potential credentials. Once a valid set of credentials is found, they're in. 

This isn't a novel technique, but it continues to succeed at scale. Across all ransomware incidents Triskele Labs responded to in FY25, VPN and RDP without MFA accounted for 60% of initial access vectors. Akira's targeting of these pathways is consistent with that broader trend.  

What happens once they're inside 

Across the nine incidents Triskele Labs has responded to, Akira affiliates followed a recognisable pattern of deliberate, staged compromise. 

Reconnaissance and credential harvesting

Once inside the network, affiliates conduct discovery activity to understand the environment — mapping systems, identifying domain accounts, locating backup infrastructure, and finding where sensitive data is stored. Credential theft is a priority: Akira affiliates are observed accessing LSASS memory (a Windows process that stores authentication credentials in memory), the Active Directory database (NTDS), and using a technique called DCSync which mimics a domain controller to pull down password hashes from across the network. They also harvest credentials stored in web browsers and Windows Credential Manager. 

Lateral movement

With credentials in hand, affiliates move laterally through the environment using legitimate remote access tools — RDP, SMB admin shares (Windows file and printer sharing), SSH, and WinRM (Windows Remote Management). Pass the Hash is also observed, a technique where stolen password hashes are used directly to authenticate without needing to crack the underlying password. 

Persistence

To maintain access if initial entry points are discovered and closed, affiliates create local accounts, register scheduled tasks, and modify Windows services — all techniques that allow them to re-enter the environment or continue executing code even after partial remediation. 

Data staging and exfiltration

Before encryption, affiliates identify, collect, and archive sensitive data from local systems and network shares. Rclone — a command-line tool designed for syncing files between local systems and cloud storage services like Google Drive, Dropbox, or Amazon S3 — is commonly used to transfer this data out of the environment. While Rclone is a legitimate tool used by IT teams for backup and migration tasks, it is regularly repurposed by threat actors for large-scale data theft because it blends in with normal cloud traffic. WinSCP, a graphical file transfer client, and other tools supporting web protocols and alternative channels are also used. 

Backup destruction

Concurrently, affiliates identify and remove or corrupt backup files — specifically to prevent the organisation from recovering without paying. 

Encryption and extortion

With data exfiltrated and backups gone, affiliates deploy ransomware across Windows, Linux, and ESXi (VMware's bare-metal virtualisation platform used to run virtual machines) environments. Victims are then contacted with demands: pay for a decryption tool, and pay to prevent the stolen data from being published on Akira's dark web leak site. 

In some cases, this escalates further. Triskele Labs has observed affiliates sending persistent emails to staff and making direct phone calls to victim organisations — including to reception lines and leadership — to increase pressure. This triple-extortion approach is a deliberate tactic, not an afterthought. 

Defence in depth: what to prioritise 

The consistent entry points and techniques Akira affiliates use mean there are clear, actionable controls that reduce risk materially. 

1. Enforce MFA on all external-facing remote access
   VPN portals and RDP services without MFA remain the front door Akira walks through. MFA alone doesn't eliminate risk, but it significantly raises the cost of a successful password spraying attack. 
2. Monitor for authentication anomalies
   Password spraying produces distinctive patterns — multiple failed login attempts across different accounts in a short window. Detection logic tuned to these patterns, and rapid containment when they're identified, can stop an intrusion before it progresses. 
3. Protect and isolate backups  
   Akira affiliates specifically target backup infrastructure to eliminate recovery options. Backup data should be stored in immutable, isolated environments — logically or physically separated from production systems — and tested regularly to confirm restorability. 
4. Deploy detection coverage for persistence and lateral movement techniques
   Scheduled task creation, new local account creation, Windows service modifications, LSASS memory access, and Pass the Hash activity are all observable. Detection coverage for these behaviours provides early warning well before encryption occurs. 
5. Monitor data staging and unusual outbound transfers.
   Large volumes of data being compressed, archived, and moved to cloud storage destinations — particularly via tools like Rclone — are detectable. Baselining normal outbound transfer behaviour and alerting on anomalies is a meaningful signal.
6. Patch internet-facing systems promptly.
   Where Akira affiliates can't get in through credentials, they look for known vulnerabilities. Keeping VPN appliances, RDP gateways, and virtualisation platforms up to date removes a secondary entry point. 

Summary 

Akira is an active ransomware threat to Australian organisations. It was among the most prolific groups targeting Australian businesses in FY25, with seven domestic victims named publicly and nine incidents responded to directly by Triskele Labs. The group's affiliates are consistent in their approach: enter through unprotected VPN or RDP, harvest credentials, move laterally, steal data, destroy backups, encrypt, and then apply sustained pressure to force payment. 

The controls that matter most are also consistent: MFA on all remote access, detection coverage for credential theft and lateral movement, isolated and tested backups, and monitoring for unusual data staging and outbound transfer activity. 

More reading

• Qilin
  https://www.triskelelabs.com/blog/qilin-on-the-rise-what-australian-organisations-need-to-know

• State of Cyber: TA
  https://www.stateofcyber.com.au/report/dfir#threat-actors-are-getting-smarter.

• Reinfection/persistence
  https://www.triskelelabs.com/blog/how-threat-actors-regain-access-after-ransomware-attack

• Kairos
  https://www.triskelelabs.com/blog/kairos-changing-the-ransomware-playbook

• Qilin on the Rise: What Australian Organisations Need to Know — sister article in the same threat actor series
• State of Cyber DFIR Report FY25 — contextualises Akira within the broader Australian ransomware landscape
• How Not to Get Hacked — practical controls resource for readers seeking next steps
• RansomHub - Threat Actor Group 
•