Akira Ransomware Targets the LATAM Airline Industry

### Executive Summary This report details a two-day Akira ransomware (Storm-1567) intrusion against a Latin American airline where attackers likely exploited a Veeam Backup vulnerability for SSH access, created a privileged 'backup' account, exfiltrated critical backup and user data via WinSCP to an actor-controlled SFTP server, and then deployed Akira to encrypt systems while disabling defenses and deleting shadow copies; the document includes technical analysis, IoCs, MITRE ATT&CK mapping, and mitigation guidance.