Threat Intelligence / Actor / Akira (ransomware-as-a-service operation)

Akira (ransomware-as-a-service operation)

1 tracked threat(s) · Categories: RANSOMWARE

Also known as: Akira, Storm-1567, GOLD SAHARA, Howling Scorpius, Punk Spider

Tracked threats

Akira Ransomware Kill Chain — SSLVPN Credential Stuffing → Kerberoasting → RDP Lateral → vssadmin Shadow Copy Deletion (SANS ISC Forensic Reconstruction, May 2026) — HIGH

Full actor intelligence — infrastructure, IOCs, detection coverage and operator fingerprints — is available via the Threadlinqs MCP server (Purple tier). View plans →

Threadlinqs Intelligence