Vietnam Newsroom & Threat Intelligence
Clear sources · Careful assessments
Ransomware.VN
NOTEDo not attribute a ransomware family from a file extension or a single ransom note.Vietnam time · UTC+7
Home/Ransomware families/Akira
Technical profile

Akira

A ransomware family described by CISA and partners in AA24-109A.

Confirmed (Confirmed) · Reference profile status, not attribution for an individual case.

Name / status
Akira · Confirmed
Aliases
Aliases have not been standardized in this profile.
First seen
Since March 2023 according to AA24-109A.
Target platforms
Compare the variant and environment in the original source.
TTP
AA24-109A includes IOCs/TTPs; these have not been used to attribute a Vietnamese case.
Current Activity
No verified current activity dataset is available in this profile.
Target sectors
Sector categories have not been standardized in V1.
MITRE ATT&CK
Compare techniques against the reference sources; see the TTP Map.
IOC
Use only sourced, contextualized indicators; see IOC Watch.
Extension
Compare against the sample; do not infer from filenames alone.
Ransom note
See descriptions and reference images at the source.
Encryption behavior
Behavior varies by sample; Ransomware.VN has not published separate measurements.
Partial / Full / Chunked
No separate measurements on a representative sample.
Public decryptor status
Limited / Variant-specific
Recovery Intelligence
No validated recovery observations support generalization to all variants.
Leak site
Leak-site claims are not independent evidence. Direct links are not published.
Known incidents
No separately verified incident list has been added to this profile.
Detection notes
Compare multiple evidence sources; distinguish a single indicator from a conclusion about the entire incident.
Recovery notes
Assess samples and data structures. A family name alone does not establish recovery prospects.
Last updated
09/10/2026 (UTC+7)
CISA and partners — AA24-109A: Akira RansomwareInitially published 18/04/2024 · Reference documentation on Akira, IOCs and TTPs. See the update date at the source.

Each source's scope and date are recorded separately when available. A citation does not independently verify every assessment.

09/10/2026 · Added recovery scope, decryptor status and tool links; marked fields with insufficient data.

04/10/2026 · Created the reference profile and clearly marked missing data.