Akira, the Ransomware-as-a-Service operation that ranks as the second most active ransomware crew on the planet by publicly disclosed victim count, has claimed an attack this week on Réseau Radiologique Romand, a Swiss radiology network, alleging the theft of roughly 48GB of data. The claim, posted to Akira's leak site, fits a pattern the group has run thousands of times: get in through the SSL VPN at the edge of the network, move fast, and exfiltrate before anyone notices the front door was open. Akira has collected north of $244 million in ransoms by late 2025, and a regional medical imaging provider is exactly the kind of target its playbook is built to convert.
What Happened
Akira added Réseau Radiologique Romand to its public victim list this week, claiming approximately 48 gigabytes of stolen data. The group operates as a RaaS syndicate active since March 2023, with lineage tracked back toward the defunct Conti operation and tracked by vendors under labels including Storm-1567 and Howling Scorpius. While the specific intrusion details for this victim have not been independently confirmed, the attack matches Akira's well-documented operating model: the SSL VPN appliance at the network edge is treated as the primary entry point, and the rest of the intrusion follows a tightly compressed timeline. In dozens of documented cases, Akira has gone from initial credential access to lateral movement to exfiltration to encryption in under four hours, a tempo that defeats most incident response programs before they can engage.
What Was Taken
Akira claims approximately 48GB of data exfiltrated from the radiology network. For a medical imaging provider, the sensitivity of that volume is severe. Radiology networks hold protected health information, diagnostic imaging, patient identifiers, referral and billing records, and the administrative data that ties them together. Under Akira's double-extortion model, exfiltration precedes encryption specifically so the group retains leverage even if the victim restores from backups: pay, or the data is published on the leak site. The presence of the victim on that leak site at all indicates a ransom demand is in play and that negotiations have either stalled or not satisfied the group. The exact contents of the 48GB have not been verified, but the data classes typical of a radiology practice make it high-impact regardless of the precise file breakdown.
Why It Matters
This incident is not interesting because it is novel. It is interesting because it is routine. Akira is the proof of concept that the edge appliance is the initial-access surface of the era. The group does not need the newest CVE or an exotic exploit chain to land a victim of this profile. It relies on a small, durable set of SSL VPN weaknesses and on stolen credentials, and it converts them at industrial scale. For healthcare defenders, the lesson is that being a mid-sized regional provider offers no obscurity. Akira's encryptors cover Windows, Linux, VMware ESXi, and as of mid-2025 Nutanix AHV, which means a single VPN compromise can cascade into an entire virtualized hospital environment encrypted at once. The hypervisor support is the multiplier that turns one unlocked door into a fully dark facility.
The Attack Technique
Akira's initial access is monomaniacally focused on the SSL VPN. The group has repeatedly exploited Cisco ASA and Firepower Threat Defense via flaws such as CVE-2020-3259 and CVE-2023-20263, SonicWall via CVE-2024-40766, and WatchGuard appliances. Where multi-factor authentication is simply absent, Akira walks in. Where MFA is present, the group has still been observed bypassing one-time-password protection using stolen or broker-purchased valid credentials paired with a pushed or intercepted code. That detail is the one defenders keep getting wrong: OTP-based MFA is not a guarantee when the attacker already holds a working credential. Once inside, Akira uses Ngrok tunneling for command-and-control and tools like SharpDomainSpray for password spraying, moving laterally and exfiltrating in hours. The group rotates between the original C++ Akira encryptor and the Rust-based Megazord and Akira_v2 payloads.
What Organizations Should Do
- Patch and inventory every edge appliance now. Prioritize Cisco ASA/FTD, SonicWall, and WatchGuard against the known Akira CVEs (CVE-2020-3259, CVE-2023-20263, CVE-2024-40766), and confirm no internet-facing VPN is running unsupported firmware.
- Move off OTP-only MFA for VPN access. Deploy phishing-resistant, hardware-backed authentication such as FIDO2/WebAuthn, since stolen credentials plus an intercepted code defeat one-time-password factors.
- Hunt for the toolset. Alert on Ngrok tunneling, SharpDomainSpray password-spray patterns, and anomalous authentication from VPN accounts, especially logins from unusual geographies or impossible-travel sequences.
- Harden the virtualization layer. Isolate ESXi and Nutanix AHV management interfaces, enforce separate credentials, and ensure hypervisor hosts are not reachable from general user network segments.
- Maintain offline, tested backups. Keep immutable or air-gapped copies and rehearse restoration, because double extortion means recovery alone does not remove the data-leak threat.
- Shrink the response window. Akira can finish in under four hours, so tune detection and containment for VPN-origin intrusions to trigger automatically rather than relying on manual triage.