US government agencies warn that the Akira ransomware operation has expanded its encryption capabilities to Nutanix AHV virtual machines, targeting their disk files. Recent investigations reveal that Akira now directly encrypts Nutanix VM disk files with minimal platform interaction, indicating evolving tactics. #AkiraRansomware #NutanixAHV
Keypoints
- Akira ransomware has started encrypting Nutanix AHV VM disk files since June 2025.
- The attack exploits the CVE-2024-40766 vulnerability on SonicWall firewalls.
- Akira’s Linux encryptor directly targets .qcow2 files without shutting down VMs using platform commands.
- Intrusion methods include using stolen credentials, exploiting vulnerabilities, and lateral movement tools.
- Organizations are advised to update mitigation strategies, including regular backups and patching known vulnerabilities.