Note: Originally published April 18, 2024, this advisory was updated Nov. 13, 2025, with information on
new Akira ransomware activity that presents an imminent threat to critical infrastructure. Updated
information is labeled with “Update Nov. 13, 2025” at the beginning and “End Update” at the end of
sections that include substantive new information, such as new Akira threat actor activity, TTPs, and IOCs
