Security Resilience

Threat actor · all actors

AkiraG1024 criminal

aka Akira, GOLD SAHARA, PUNK SPIDER, Howling Scorpius, Storm-1567, Megazord

Last updated: 2026-10-16

9attributed CVEs
24ATT&CK techniques
27.0IDF score (tooling uniqueness)
1exclusive CVEs
2020–2024years active

About this actor

[Akira](https://attack.mitre.org/groups/G1024) is a ransomware variant and ransomware deployment entity active since at least March 2023.(Citation: Arctic Wolf Akira 2023) [Akira](https://attack.mitre.org/groups/G1024) uses compromised credentials to access single-factor external access mechanisms such as VPNs for initial access, then various publicly-available tools and techniques for lateral movement.(Citation: Arctic Wolf Akira 2023)(Citation: Secureworks GOLD SAHARA) [Akira](https://attack.mitre.org/groups/G1024) operations are associated with "double extortion" ransomware activity, where data is exfiltrated from victim environments prior to encryption, with threats to publish files if a ransom is not paid. Technical analysis of [Akira](https://attack.mitre.org/software/S1129) ransomware indicates variants capable of targeting Windows or VMWare ESXi hypervisors and multiple overlaps with [Conti](https://attack.mitre.org/software/S0575) ransomware.(Citation: BushidoToken Akira 2023)(Citation: CISA Akira Ransomware APR 2024)(Citation: Cisco Akira Ransomware OCT 2024)

Source: MITRE ATT&CK

Names & naming systems

Each vendor coins its own name for the same actor. Where a name follows a known scheme we attribute it; the rest are listed honestly as unclassified.

MITRE ATT&CKG-number catalogue id

G1024

Microsoftweather-system names

Storm-1567

CrowdStrikenation-animal names

PUNK SPIDER

Secureworkscolour-metal names

GOLD SAHARA

Palo Alto Unit 42constellation names

Howling Scorpius

Unclassifiedno scheme matched

AkiraMegazord

How we know this

Data origin
MITRE ATT&CK Imported from the MITRE ATT&CK STIX bundle as an intrusion-set object.
Techniques
MITRE ATT&CK STIX mappings — 24 ATT&CK techniques on file.
Named victims
None on file.

See how actor data is built for the full pipeline.

Activity timeline

2020: 2 CVE published220202021: 1 KEV added120212023: 4 CVE published2023: 3 KEV added720232024: 3 CVE published2024: 4 KEV added72024
CVE publishedKEV added

Profile

CVERiskCVSSEPSSPublishedProducts
CVE-2024-40711 KEV9.99.80.96802024-09-07see CVE
CVE-2024-40766 KEV9.99.80.18382024-08-23see CVE
CVE-2020-3259 KEV8.57.50.71792020-05-06see CVE
CVE-2023-27532 KEV8.57.50.84862023-03-10see CVE
CVE-2023-28252 KEV8.57.80.70182023-04-11see CVE
CVE-2024-37085 KEV7.86.80.80272024-06-25see CVE
CVE-2020-3580 KEV7.56.10.97352020-10-21see CVE
CVE-2023-20269 KEV7.55.00.25562023-09-06see CVE
CVE-2023-20263 3.94.70.00582023-09-06see CVE

Mitigating controls (NIST 800-53)

ControlTechniques coveredCoverage
SI-418 / 2475%
CM-217 / 2471%
AC-316 / 2467%
AC-615 / 2462%
CM-615 / 2462%
CM-713 / 2454%
AC-212 / 2450%
SI-312 / 2450%
SI-712 / 2450%
RA-511 / 2446%
AC-510 / 2442%
CA-710 / 2442%
IA-210 / 2442%
AC-179 / 2438%
CM-59 / 2438%

Co-occurring actors

Similar actors

Similar TTPs

Overlapping CVEs

Active in same years

Same category