Megazord

Megazord is a new variant of the Akira ransomware, first observed in deployment by Akira threat actors around August 2023. Initially focusing on Windows systems, the malware evolved to target Linux VMware ESXi virtual machines. Early versions of Akira were written in C++, encrypting files with an .akira extension. However, from August 2023, some attacks began deploying Megazord, which employs Rust-based code and encrypts files with a .powerranges extension. The Akira threat actors have continued to use both Megazord and Akira, including another variant, Akira_v2, interchangeably. In-depth analysis of the Megazord ransomware revealed that it was concurrently deployed with a second payload in certain attacks. This secondary payload was later identified as a novel variant of the Akira ESXi encryptor, "Akira_v2", which is also written in Rust. Several static and code similarities between Megazord and Akira suggest that Megazord could be an attempt to give Akira a new look or to evade detection by security software. The emergence of Megazord underscores the persistent and evolving threat posed by ransomware. With its ability to change file names by appending a .powerrangers extension, Megazord can cause significant disruption and potential data loss. To combat this threat, organizations are advised to maintain robust cybersecurity measures, including regular system updates, backups, and employee education about the risks of suspicious downloads, emails, and websites.