Akira ransomware is encrypting victims again following pure extortion fling

Researchers at Cisco Talos report that the Akira ransomware operation has reverted to encrypting victims' files after periods of data-only extortion and has consolidated its encryptor toolset (C++ and Rust variants); the group leverages RaaS affiliates to exploit high-impact vulnerabilities (including CVE-2024-40766), compromised VPN credentials, and various social-engineering techniques to target Windows, Linux and ESXi environments, posing a significant operational risk to enterprises.