Ransomware has a new target. Is your backup ready?
ALPHV, BlackMatter, and Gunra have wiped backups before encryption to raise ransom pressure.
46
- Mentions · 7d0
- Mentions · 30d3
- All mentions5
- First seenAug 17, 2026
- Last mentioned23d ago
Timeline
5 articles · newest firstUp a Creek Without a Command Line: Mapping an Akira Ransomware Attack
Huntress mapped an Akira ransomware intrusion that used RDP, LSASS dumping, GOST tunneling, and RClone.
55
The First 24 Hours: What Happens When Ransomware Lands
Huntress describes the first day after ransomware is discovered, citing a 14-day median dwell time and rapid Akira theft.
51
Employee benefits platform Paylogix says hackers stole financial and health
Akira ransomware gang stole financial, health, and passport data on tens of thousands of people from benefits administrator Paylogix in November.
65
Akira Ransomware Uses Safe Mode to Bypass EDR
An Akira affiliate rebooted a compromised host into Safe Mode to bypass EDR, but constrained memory crashed the encryptor before encryption completed.
74
Appears with
- Akirathreat actor · 5
- CISAorganization · 3
- FBIorganization · 3
- Huntressorganization · 3
- Mandiantorganization · 2
- Akiraorganization · 2
- Gunrathreat actor · 1
- SonicWallvendor · 1
- GOSTproduct · 1
- ALPHVthreat actor · 1
- IBMorganization · 1
- Paylogixvendor · 1
- Huntressvendor · 1
- BlackMattermalware · 1
- UnderDefenseorganization · 1
- NSAorganization · 1
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.