Unit 42 warns retailers of ransomware, extortion and DDoS
As of September 30, 2026, operators had claimed 565 retail victims, with median revenue about $22 million.
Stories per day · 30 days
2 RSS
10 stories, newest first · one card per story
Stories tagged #akira
Australia’s ASD issued more than 4,400 cyber warnings in a year
Victim reports helped disrupt an August 2025 Akira campaign linked to a known SonicWall flaw.
1
Up a Creek Without a Command Line: Mapping an Akira Ransomware Attack
Huntress mapped an Akira ransomware intrusion that used RDP, LSASS dumping, GOST tunneling, and RClone.
3
The First 24 Hours: What Happens When Ransomware Lands
Huntress describes the first day after ransomware is discovered, citing a 14-day median dwell time and rapid Akira theft.
6
Network Segmentation Failures Are Expanding the Corporate Attack Surface
Forescout finds nearly half of OT and medical segments also hold IT or IoT, widening lateral movement.
1
Ransomware Attacks on Manufacturers Surge as Supply Chain Risk Grows
Black Kite reports manufacturing ransomware incidents up 40% in 2026, with new gang The Gentlemen responsible for 12% of attacks.
15
Employee benefits platform Paylogix says hackers stole financial and health
Akira ransomware gang stole financial, health, and passport data on tens of thousands of people from benefits administrator Paylogix in November.
2
Akira Ransomware Uses Safe Mode to Bypass EDR
An Akira affiliate rebooted a compromised host into Safe Mode to bypass EDR, but constrained memory crashed the encryptor before encryption completed.
Akira Affiliate Crashes Ransomware After Attempting EDR Evasion
Huntress documented an Akira ransomware affiliate attack that failed after its anti-EDR tool crashed legitimate software and stopped encryption before completion.
Akira Hits Safe Mode: Ransomware Rebooting Around EDR
Huntress documents an Akira ransomware affiliate rebooting endpoints into Windows Safe Mode to evade EDR and Defender, though Safe Mode broke the ransomware.
1