Akira Ransomware Gang Extorts $42 Million; Now Targets Linux Servers

**Executive summary:** The report details the Akira ransomware group's global operations—extorting approximately $42 million from over 250 victims as of January 1, 2024—highlighting its shift from a C++ Windows locker to Rust-based variants that also target VMware ESXi, exploitation of known Cisco vulnerabilities, use of RDP/VPN/spear-phishing/valid credentials for initial access, credential dumping (Mimikatz, LaZagne), BYOVD techniques, data exfiltration tools, and hybrid ChaCha20+RSA encryption; it situates Akira within the broader ransomware ecosystem alongside LockBit and Agenda and notes the proliferation of low-cost ransomware.