Akira ransomware group can achieve initial access to data encryption in less than an hour

Akira is a prolific ransomware group active since 2023 that has compromised hundreds of victims and extorted roughly $245M; security firm Halcyon reports the group uses zero-day exploits, buys access from brokers, targets Veeam/Cisco/SonicWall products and unprotected VPNs, employs intermittent encryption and double-extortion, and can progress from initial access to full encryption in as little as one hour, severely reducing incident response time and increasing likelihood of ransom payment.