Akira_v2

Akira_v2 is a variant of the Akira malware, identified and confirmed by trusted third-party investigations. The Akira threat actors were initially observed deploying the Windows-specific "Megazord" ransomware, with further analysis revealing that a second payload, later identified as Akira_v2, was concurrently deployed in the attack. This novel variant of the Akira ESXi encryptor is part of a broader malicious software landscape designed to exploit and damage computer systems, often infiltrating through suspicious downloads, emails, or websites. The Akira threat actors have shown a persistent pattern of employing both Megazord and Akira, including the Akira_v2 variant, interchangeably. They have continued to use these two forms of malware, demonstrating a sophisticated understanding of multiple operating systems and their vulnerabilities. This dual deployment strategy allows them to maximize the potential damage and disruption caused by their attacks, making them a significant cybersecurity concern. In August 2023, the Akira threat actors evolved from primarily targeting Windows systems to focusing on Linux, specifically VMware ESXi virtual machines. They began deploying Megazord, a Rust-based code, alongside Akira, which is written in C++, including the Akira_v2 variant, also based on Rust. This shift signifies an expansion in their capabilities and target range, increasing the potential risk for a wider variety of systems and networks.