Akira-Style Ransomware Campaign Hits Windows Users Across South America

A Babuk-derived ransomware campaign impersonating the Akira group is actively targeting Windows users and organizations across South America by mimicking Akira branding (including .akira file extensions and Tor-based ransom contacts); technical analysis shows the encryptor is modified from leaked Babuk code rather than Akira’s original codebase, and defenders are advised to patch systems, use strong endpoint protection, maintain offline backups, and monitor for suspicious encryption activity.