New Akira Lookalike Ransomware Campaign Targeting Windows Users in South America

A Babuk-based ransomware campaign targeting Windows systems in South America is impersonating the Akira family by appending a .akira extension and deploying ransom notes with Akira-like Tor URLs and messaging; this deception aims to mislead victims and investigators. ESET researchers identified the Babuk-derived encryptor behind the campaign and recommend patching, network segmentation, offline backups, and monitoring for the .akira extension as mitigations.