extortion.wiki THE RANSOMWARE DOCUMENTARY ARCHIVE
Menu

242 negotiations · 332 notes · 276 seizure banners · snapshots Jul 06, 2026 / Jun 26, 2026 / Jul 23, 2026

Akira

From extortion.wiki, the ransomware negotiation research archive

Negotiation records classified under Akira in the current Ransomchats snapshot. This page indexes the source label; it does not independently verify attribution.

Classification follows the source dataset. Metadata is useful. It is not testimony.

Actor lineage

Global lineage directory

Overview

Joint government reporting documents Akira ransomware activity from March 2023. This record does not assert a predecessor, successor, or operator overlap because the curated sources do not establish one.

Source name
Akira
Canonical lineage name
Akira
Entity model
operation
First observed
March 2023
Last observed
Date not established
Current status
Not established

Documentary media

First page of the official StopRansomware Akira ransomware advisory
Joint Akira ransomware advisoryFirst-page preview of the FBI, CISA, Europol EC3, and NCSC-NL joint advisory documenting Akira activity observed since March 2023.FBI, CISA, Europol EC3, and NCSC-NL · published 2024-04-18 · Contextual materialEvidence status:officially confirmed · Rights/review:documentary excerpt reviewedA low-resolution first-page excerpt is used to identify and discuss the underlying official advisory. Agency marks remain only within the unaltered document preview; no general reuse license is claimed.Source: FBI, CISA, Europol EC3, and NCSC-NL joint advisory AA24-109A.

Known aliases

No source-supported alias is currently recorded. Malware names and actor-group names are not assumed to be equivalent.

Historical timeline

Lineage and relationships

No evidence-backed relationship is currently recorded. Similar code, language, infrastructure style, or negotiation behavior is not enough on its own.

Predecessors

None established.

Successors

None established.

Splits and mergers

None established.

Suspected affiliate relationships

None established.

MITRE ATT&CK integration

No explicit MITRE ATT&CK group mapping is published for this source label. Software entries and fuzzy name matches are not promoted to group mappings.

External intelligence references

  1. #StopRansomware: Akira RansomwareFBI, CISA, Europol EC3, and NCSC-NL · government advisory · primary authoritative

Confidence and evidence notes

Confidence applies to each individual alias, event, or relationship—not to the actor page as a whole. “Confirmed” requires explicit authoritative attribution or multiple strong independent sources. Moderate, low, disputed, and unknown entries retain the source's uncertainty. A malware-family name is not automatically an actor identity, and shared code or affiliates do not prove shared leadership.

Ransomware notes

Browse Akira notes

The explicit archive alias mapping connects this Ransomchats actor label to the ThreatLabz family Akira. Its 3 archived notes are counted and searched separately from the negotiation records below.

Search within this collection

Negotiation records

Filter Akira records

Collection: 60 records · 2,408 messages

Akira negotiation record collection
Participants Source Archive status
20250423 6 Akira, Victim JSON Indexed
20250425b 15 Akira, Victim JSON Indexed
20250424 12 Akira, Victim JSON Indexed
20250423 65 Akira, Victim JSON Indexed
20250417 59 Akira, Victim JSON Indexed
20250408 12 Akira, Victim JSON Indexed
20250331 6 Akira, Victim JSON Indexed
20250330 15 Akira, Victim JSON Indexed
20250328 39 Akira, Victim JSON Indexed
20250321 25 Akira, Victim JSON Indexed
20250313 43 Akira, Victim JSON Indexed
20250312 20 Akira, Victim JSON Indexed
20250310 24 Akira, Victim JSON Indexed
20250306 9 Akira, Victim JSON Indexed
20250227 56 Akira, Victim JSON Indexed
20250222 72 Akira, Victim JSON Indexed
2025027 13 Akira, Victim JSON Indexed
20250216 14 Akira, Victim JSON Indexed
20250125 9 Akira, Victim JSON Indexed
20250121 26 Akira, Victim JSON Indexed
20250120 7 Akira, Victim JSON Indexed
20250117 70 Akira, Victim JSON Indexed
20250112 44 Akira, Victim JSON Indexed
20250110 7 Akira, Victim JSON Indexed
20250108 10 Akira, Victim JSON Indexed
20250104 13 Akira, Victim JSON Indexed
20240803 34 Akira, Victim JSON Indexed
20240723 43 Akira, Victim JSON Indexed
20240719 6 Akira, Victim JSON Indexed
20240718 105 Akira, Victim JSON Indexed
20240620 7 Akira, Victim JSON Indexed
20240618 53 Akira, Victim JSON Indexed
20240611 50 Akira, Victim JSON Indexed
20240531 55 Akira, Victim JSON Indexed
20240509 170 Akira, Victim JSON Indexed
20240424 70 Akira, Victim JSON Indexed
20240410 16 Akira, Victim JSON Indexed
20240329 65 Akira, Victim JSON Indexed
20240317 8 Akira, Victim JSON Indexed
20240301 43 Akira, Victim JSON Indexed
20240201 40 Akira, Victim JSON Indexed
20240131 75 Akira, Victim JSON Indexed
20240129 70 Akira, Victim JSON Indexed
20240127 41 Akira, Victim JSON Indexed
20231227 74 Akira, Victim JSON Indexed
20231217 67 Akira, Victim JSON Indexed
20231209 112 Akira, Victim JSON Indexed
20231115 81 Akira, Victim JSON Indexed
20231112 58 Akira, Victim JSON Indexed
20230929 58 Akira, Victim JSON Indexed
20230815 84 Akira, Victim JSON Indexed
20230728 5 Akira JSON Indexed
20230727 72 Akira, Victim JSON Indexed
20230722 9 Akira JSON Indexed
20230719 4 Akira JSON Indexed
20230707 37 Akira, Victim JSON Indexed
20230628 5 Akira JSON Indexed
20230616 80 Akira, Victim JSON Indexed
20230606 13 Akira, Victim JSON Indexed
20230529 7 Akira, Victim JSON Indexed