AKIRA is back but this time it breaks through firewalls

AKIRA is an international cyber gang which, in 2025, is hitting Italian small and medium-sized enterprises hard, particularly in the Northeast. Its attacks are rapid, structured and devastating. Understanding the phenomenon is the first step in protecting yourself. Taking timely action is critical.

Who is AKIRA: the hacker group threatening Italian companies
Active since 2023, AKIRA is a cybercriminal organization structured as a corporate . The group uses percentage-paid affiliates, industrialized attack tools, and even customer service to negotiate ransoms with victims.

What’s happening: escalation of attacks in Italy
In recent months, Eurosystem has received numerous reports from companies that have been compromised or on alert . RHC Dark Lab reports confirm a systematic growth of attacks. In less than 24 hours, AKIRA manages to:

• Compromising IT infrastructure,

• Subtracting and encrypting data,

• delete backups,

• Completely halt business operations.

Main vulnerabilities exploited

• VPN exposed without multi-factor authentication (MFA);

• Public and unprotected RDP accesses;

• Outdated firewalls;

• Vulnerable edge or SSL devices;

• Legacy systems still active on the network;

• Accessible or unsegmented backups.

Techniques and tools used by AKIRA
The group uses a combination of advanced tools to circumvent defenses:

• BRUTED For brute force attacks;

• SharpHound for Active Directory mappings;

• RClone for data exfiltration;

• WinRAR for rapid compression and handling;

• Dump LSASS/NTDS and BYOVD techniques to circumvent antivirus and EDR;

• ChaCha20 + RSA-4096 algorithms for encryption;

• Malware variants written in Rust to avoid detection;

• Attacks extended to systems Windows, Linux and VMware ESXi .

The numbers of the threat

• Over 250 companies affected globally ;

• More than 42 million dollars extorted ;

• Fast, silent and destructive attacks;

• Double extortion. : first data theft, then encryption, then the threat of publication.

No one is safe: AKIRA strikes based on exposure
The group does not select victims based on turnover, but based on the vulnerabilities exposed . A simple VPN without MFA may be enough to become a target. All businesses are potentially at risk.

Why you need an experienced cybersecurity partner
AKIRA is not a single hacker, but a complex and well-structured organization. Defending itself requires Experience, advanced tools, and speed of action. Attempting to counter such a threat without support is extremely risky.

What we can do right away to protect your business
Eurosystem offers an immediate intervention plan designed for SMEs that includes:

• Analysis of vulnerabilities and exposure points;

• Securing VPN, RDP, and backup;

• Network segmentation and monitoring with Sysmon;

• Implementation of MFA, AppLocker, WDAC;

• Simulations of attack and preparation for response;

• Tiered administration and privilege management with Just-In-Time (JIT) access.

Eurosystem stands by Italian enterprises
We collaborate with leading European cybersecurity and threat intelligence centers , reacting in real time and anticipating the moves of cyber criminals. We are already active on several fronts in the Northeast. Response time can mean the difference between business continuity and business paralysis.

Contact us today for a confidential Cybersecurity assessment.
AKIRA is no longer just a movie name. It is a real threat.

Eurosystem S.p.A. – Cybersecurity. Prevention. Response.