TF-1844765 high

Description

Indicator that identifies a malware sample (payload). IOC type: MD5 hash of a malware sample (payload). Attributed malware: Akira (aliases: REDBIKE). Confidence: 75. First seen: 2026-07-04 16:17:48 UTC. Reporter: TheRavenFile. Tags: akira, Ransomware.

Indicators of Compromise (1)

Each indicator is enriched from the IOC database, threat-intel feed corroboration (Threat Hunt) and VirusTotal. Click one to expand.

References (3)

• External reference ThreatFox IOCs
• Malpedia profile ThreatFox IOCs
• ThreatFox IOC page ThreatFox IOCs

  Indicator that identifies a malware sample (payload). IOC type: MD5 hash of a malware sample (payload). Attributed malware: Akira (aliases: REDBIKE). Confidence: 75. First seen: 2026-07-04 16:17:48 UTC. Reporter: TheRavenFile. Tags: akira, Ransomware.

• Akira, Software S1129 | MITRE ATT&CK®
  web:attack.mitre.org

  Akira ransomware employs hybrid encryption and threading to increase the speed and efficiency of encryption and runtime arguments for tailored attacks. Notable variants include Rust-based Megazord for targeting Windows and Akira _v2 for targeting VMware ESXi servers.

  2026-07-28 05:29 UTC
• MalwareBazaar | Browse malware samples - abuse.ch
  web:bazaar.abuse.ch

  Using the form below, you can search for malware samples by a hash ( MD5 , SHA256, SHA1), imphash, tlsh hash , ClamAV signature, tag or malware family. Browse Database

  2026-07-28 05:29 UTC
• MalwareBazaar | akira - abuse.ch
  web:bazaar.abuse.ch

  Malware samples associated with tag akira MalwareBazaar Database Samples on MalwareBazaar are usually associated with certain tags. Every sample can associated with one or more tags. Using tags, it is easy to navigate through the huge amount of malware samples in the MalwareBazaar corpus. The page below gives you an overview on malware samples that are tagged with akira . Database Entry

  2026-07-28 05:29 UTC
• Akira (Malware Family) - Fraunhofer
  web:malpedia.caad.fkie.fraunhofer.de

  Details for the Akira malware family including references, samples and yara signatures.

  2026-07-28 05:29 UTC
• CISA and Partners Release Advisory Update on Akira Ransomware
  web:www.cisa.gov

  This updated joint advisory provides network defenders with the latest indicators of compromise, tactics, techniques, and procedures, and detection methods associated with Akira ransomware activity.

  2026-07-28 05:29 UTC
• #StopRansomware: Akira Ransomware - CISA
  web:www.cisa.gov

  Akira ransomware threat actors are associated with other groups known as Storm-1567, Howling Scorpius, Punk Spider, and Gold Sahara, and may have connections to the defunct Conti ransomware group. Akira threat actors primarily target small- and medium-sized businesses, but have also impacted larger organizations across various sectors.

  2026-07-28 05:29 UTC
• A spotlight on Akira ransomware from X-Force incident response ... - IBM
  web:www.ibm.com

  Figure 2: Akira ransomware .onion dark web negotiations portal (Source: X-Force dark web research) After gaining access, the negotiation portal displays a message telling the victim that the Akira group is preparing a sample of stolen data from the victim organization. This process may be manual for the threat actor, based on the amount of time it appears to take. Once ready, the threat group ...

  2026-07-28 05:29 UTC
• Akira Ransomware 2025: Updated CISA Advisory, TTPs, and Defense Strategies
  web:www.picussecurity.com

  Learn how Akira ransomware operates in 2025 with updated CISA findings. Explore its latest TTPs, initial access methods, and actionable defense strategies.

  2026-07-28 05:29 UTC
• Akira Ransomware: In-Depth Analysis, Detection, and Mitigation
  web:www.sentinelone.com

  Akira Ransomware uses multi-extortion tactics and a retro-styled leak site. Learn about its negotiation processes and how to mitigate it.

  2026-07-28 05:29 UTC
• Akira Ransomware - Trellix
  web:www.trellix.com

  The compilation date of the analyzed sample is the 29th of July 2023, and it is a console application. Arguments to such an application are usually shared via the command-line and do not require a graphical interface of sorts. Akira supports a number of arguments, which instruct the malware to execute certain functions. Below, the options are ...

  2026-07-28 05:29 UTC

Only Available for Registered Users. Sign in to view.