Recommended Free Tools
iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
Akira ransomware operators have repeatedly entered organizations through VPN services without multifactor authentication (MFA), exposed Remote Desktop Protocol (RDP), stolen or sprayed credentials, and vulnerable internet-facing appliances. MFA would block or reduce many password-based intrusions, but it cannot patch an exploitable VPN, router, or backup server. The November 2025 update shows why organizations need identity controls, rapid patching, restricted remote access, monitoring, and tested recovery together.
How Akira gets in through VPN and RDP
The FBI and CISA’s April 18, 2024 advisory documented Akira access through VPN services that had no MFA configured. The same advisory described externally accessible RDP, spearphishing, and valid credentials as other entry or access methods. The updated advisory retains those observations and adds later cases involving compromised VPN credentials, brute force or password spraying, SSH access, and vulnerable backup infrastructure.
These are separate failure modes. A password stolen in a phishing attack or guessed during spraying is far less useful when a phishing-resistant second factor is required. A vulnerable appliance, however, may be compromised without the attacker authenticating as a normal user, so MFA does not substitute for firmware and software remediation.
Windows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallOutdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchVPN without MFA
A VPN concentrator is often the front door to internal systems. If it accepts only a username and password, an attacker with stolen credentials can authenticate remotely and appear to be a legitimate employee or contractor. Akira’s documented use of VPN services without MFA makes this configuration a high-priority exposure.
#1 Best Overall
- POWERFUL SECURITY KEY: The YubiKey 5C NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5C NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5C NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
Exposed RDP
RDP has two roles in Akira incidents. An internet-facing RDP listener can provide initial access when passwords are compromised or security controls are weak. After compromise, RDP can also support lateral movement between Windows systems. CISA’s ransomware guidance recommends closing unused RDP ports, restricting necessary access through controlled gateways, enforcing account lockouts, enabling MFA, and retaining RDP login logs.
Exploited edge and backup products
The November 13, 2025 update describes exploitation of SonicWall VPN access and unpatched Veeam backup servers, along with other Cisco, VPN, router, and network-infrastructure vulnerabilities. It specifically identifies CVE-2024-40766 among the vulnerabilities defenders should prioritize. An organization can therefore have MFA enabled for users and still be exposed if an internet-facing product is running vulnerable code.
Rank #2
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
What changed in the November 2025 Akira update
The update broadens the documented picture beyond a single VPN configuration error. Akira operators are reported to use the following techniques:
- Initial access: compromised VPN credentials, password spraying, vulnerable VPN or edge products, exposed RDP, SSH, and unpatched Veeam backup infrastructure.
- Lateral movement: RDP, SSH, and stolen Kerberos authentication tickets.
- Command and control or deployment: Ngrok, SystemBC, and STONETOP.
- Data theft: FTP, SFTP, and cloud services.
- Impact: the faster Akira_v2 encryptor, which also further inhibits recovery.
These techniques mean that blocking one path does not eliminate the campaign. Remote-access authentication, appliance security, internal movement, and recovery must be treated as connected controls.
Rank #3
- POWERFUL SECURITY KEY: The YubiKey 5 NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
Will MFA stop an Akira attack?
MFA is necessary for credential-based access, but it is not a complete Akira defense. It directly addresses stolen, reused, or password-sprayed credentials on VPN, email, administrative accounts, and other critical services. It does not repair a vulnerable VPN appliance, stop an already authorized administrator from abusing access, close an exposed RDP port, detect unusual data transfers, or restore encrypted systems.
| Control | Failure mode it addresses | What it does not cover |
|---|---|---|
| Phishing-resistant MFA | Stolen, replayed, or guessed passwords | Unpatched appliance exploits, exposed services, lateral movement, or recovery |
| Emergency patching | Known vulnerabilities in VPN, firewall, router, and backup products | Valid-account abuse and malicious activity by an authenticated user |
| RDP reduction and gateway control | Internet exposure and uncontrolled Windows remote access | Compromise through another service or stolen credentials elsewhere |
| Centralized logging and detection | Account creation, spraying, unusual VPN or SSH activity, and abnormal transfers | Preventing every intrusion |
| Protected, tested backups | Operational recovery after encryption or destructive actions | Initial access or data theft before recovery begins |
Defensive actions to take now
1. Enforce phishing-resistant MFA
Require MFA for VPN, email, privileged accounts, remote administration, and services that reach critical systems. Prefer passwordless methods using a device PIN, biometric, or cryptographic key. A FIDO2 security key is one physical implementation of the cryptographic-key approach described in CISA’s #StopRansomware Guide. It strengthens identity assurance, but it must be deployed alongside patching and network restrictions.
Rank #4
- POWERFUL SECURITY KEY: The Security Key NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key NFC via USB-A and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
2. Patch the remote-access perimeter
Inventory VPN gateways, firewalls, routers, network appliances, and backup servers exposed to untrusted networks. Apply vendor fixes on an emergency timetable, giving priority to known exploited vulnerabilities named in the Akira advisory, including CVE-2024-40766 and the listed Cisco, Veeam, and other CVEs. If a product cannot be patched promptly, remove it from exposure, restrict access, or replace it according to the vendor’s mitigation guidance.
The Tool Desk
Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →3. Remove unnecessary RDP exposure
- List every system listening for RDP, including cloud and branch-office hosts.
- Close unused listeners and block direct internet access to required ones.
- Place legitimate RDP use behind a controlled gateway or equivalent private-access path.
- Apply MFA, strong access policies, and account lockouts to the remaining users.
- Retain and review successful and failed RDP login telemetry.
4. Monitor for the 2025 behavior set
Alert on password-spraying patterns, unusual VPN or SSH sessions, unexpected domain-account creation, abnormal Kerberos-ticket activity, new tunneling tools such as Ngrok or SystemBC, and outbound transfers to unfamiliar FTP, SFTP, or cloud destinations. Correlating identity, endpoint, VPN, and firewall logs is more useful than examining any one source in isolation.
Best Value
- FIDO2 & Passkey Ready: Business-ready and FIDO2 L1 certified. This key is supported by major management suites and is ideal for both individual and enterprise deployment. Works seamlessly with Gmail, Facebook, GitHub, Dropbox, Coinbase, and more.
- Universal Connectivity (USB-A ): Features a built-in USB-A connector—simply unfold the key and plug it into your compatible PC or laptop for seamless authentication on the go.
- Dedicated Manager App: Use the Thetis Manager App for the initial hardware PIN setup. Setting the PIN on the device first ensures a smooth registration process. Once the PIN is configured, you can begin registering the key across your favorite FIDO2-compatible online services.
- Ultra-Durable & Portable: Featuring a rotating metal cover, this key is water, crush, and tamper-resistant. It fits easily on a keychain and requires no batteries or network connectivity.
- Check FIDO2 compatibility before purchase - Known limitations: ID Austria is not supported (requires FIDO2 Level 2). Windows Hello login only works with Windows Enterprise editions that support Entra ID, and NFC is NOT supported.
5. Protect recovery capability
Keep offline or otherwise isolated backups, restrict who can delete or alter them, and test restoration regularly. The advisories emphasize recovery and response controls but do not establish a universal restoration-time target. Define an organization-specific recovery sequence for identity services, virtualization, file servers, and critical applications before an incident occurs.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.A practical way to judge whether MFA is enough
Evaluate the environment on four axes:
- Phishing and credential replay resistance: hardware-backed, phishing-resistant MFA is stronger than a password alone.
- Coverage of identity and appliance attacks: confirm that controls address both user authentication and vulnerabilities in internet-facing products.
- Visibility: verify that VPN, RDP, SSH, identity, endpoint, and egress activity is logged and monitored.
- Recovery readiness: demonstrate that protected backups can be restored after encryption.
A security key can score highly on the first axis while doing nothing for patching, RDP exposure, monitoring, or backups. Conversely, excellent backups do not prevent data theft or initial compromise. The weakest uncovered path determines the practical risk.
What the official advisories do—and do not—establish
The FBI and CISA materials describe Akira activity affecting a broad range of businesses and critical-infrastructure sectors and provide tactics, indicators, and mitigations. They do not publish a single aggregate victim count, ransom total, or loss figure in the advisories summarized here. Those figures should not be inferred from the technical findings.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
