Akira Ransomware Now Uses APT-Style Tactics to Breach Corporate Networks

S-RM’s analysis details a sophisticated Akira ransomware intrusion against a multinational agriculture company: attackers gained access via an unpatched single-factor VPN and exploited VMware vCenter RCE (CVE-2021-21972) to implant a reverse shell, spun up a near-undetectable VM, extracted NTDS.dit and the SYSTEM hive to obtain credentials, moved laterally, exfiltrated data, and deployed ransomware (including via abuse of Veritas Backup Exec) — all within roughly six hours, with operations impacting small and medium-sized organizations across North America, Europe, and Australia.