https://www.tomshardware.com/tech-industry/cyber-security/akira-ransomware-cracked-with-rtx-4090-new-exploit-to-brute-force-encryption-attack [] Skip to main content (*) ( ) Open menu Close menu Tom's Hardware [ ] Search Search Tom's Hardware [ ] RSS US Edition flag of US flag of UK UK flag of US US flag of Australia Australia flag of Canada Canada * * Best Picks * Raspberry Pi * CPUs * GPUs * 3D Printers * News * Coupons * More + Newsletter + Reviews + PC Components + Motherboards + SSDs + PC Building + Monitors + Laptops + Gaming + Cooling + RAM + Power Supplies + Cases + 3D Printers + Desktops + Overclocking + Peripherals + About Us Forums Trending * Where to Buy Ryzen 9 9950X3D * RDNA 4 * Where to Buy RX 9070 * AMD Ryzen 9 9950X3D Review 1. Tech Industry 2. Cyber Security Akira ransomware can be cracked with sixteen RTX 4090 GPUs in around ten hours -- new counterattack breaks encryption News By Dallin Grimm published 16 March 2025 The freshest Akira variant uses old-timey encryption method vulnerable to brute-force methods * * * * * * * Comments (13) When you purchase through links on our site, we may earn an affiliate commission. Here's how it works. GeForce RTX 3090 (Image credit: Shutterstock) The dreaded Akira ransomware attack has had another hole blown through its hull. Blogger Tinyhack has discovered a new exploit to brute-force the virus's encryption and has reportedly already used it to restore the data of an attacked company. Akira, a well-known ransomware cyberattack, may now be escapable by affected companies thanks to a GPU-based brute-force counterattack. With an RTX 4090, the Tinyhack found they could crack the encrypted ransomware'd files in seven days, and with 16 GPUs, the process would take just over ten hours. Akira is a ransomware attack aimed at high-profile targets, first discovered in 2023 and known for ludicrously high ransom requests (sometimes reaching tens of millions of dollars). In 2023, Avast's Threat Research Team found the method Akira used to encrypt victim files, and published a free encryption breaker tool to free computers from the dreaded attack. Akira then patched this high-profile crack, adding some bespoke details to its originally publicly-available encryption methods. At least one Akira variant uses an encryption method that can be decrypted via the new GPU-based brute-force method over a period of days or weeks. The Akira attack uses the chacha8 and Kcipher2 encryption methods to generate per-file encryption keys, using four distinct timestamps, in nanoseconds, as seeds. These timestamps can be deduced to a tight range of on average 5 million nanoseconds (0.005 seconds), and then precisely found with brute-force, a process which requires the use of top-end GPUs such as Nvidia's RTX 3090 or 4090. Several things must go right for those hoping to execute the decryption method. Encrypted files must be untouched following the encryption so the timestamp that the file was last accessed can be found and used for the brute-force. Using a NFS (as opposed to files just living on the network's local disks) can also complicate decryption, as server lag will make it more difficult to determine the true timestamps used by the encryption. Using an RTX 4090, decrypting a single file by running through every possible nanosecond in the average range of 4.5 million nanoseconds, finding the correct four timestamps, and generating the appropriate decryption keys takes around 7 days. Affected organizations are recommended to rent servers through services like runpod or vast.ai, using multiple GPU servers to bring the time down. Tinyhack's client took around 3 weeks to successfully decrypt a full set of VM files. Ransomware attacks are most often impossible to decrypt without paying ransom, so finding a method to circumvent the attack is a big win for cybersecurity research. While those behind Akira will likely quickly patch this method for future attacks as they did after the Avast decryption release, those already hit by Akira may be able to free infected systems with this method. Tinyhack's blog post runs through the entire process of discovering the vulnerability and full instructions to decrypt with it, so please head there to get an exhaustive look at brute-forcing a way into Akira. Ransomware has come a long way since its beginnings on a floppy disk sent by mail, and today marks another victory against it. Stay On the Cutting Edge: Get the Tom's Hardware Newsletter Get Tom's Hardware's best news and in-depth reviews, straight to your inbox. [ ][ ]Contact me with news and offers from other Future brands[ ]Receive email from us on behalf of our trusted partners or sponsors[Sign me up] By submitting your information you agree to the Terms & Conditions and Privacy Policy and are aged 16 or over. TOPICS GeForce RTX 3090 See all comments (13) Dallin Grimm Dallin Grimm Social Links Navigation Contributing Writer Dallin Grimm is a contributing writer for Tom's Hardware. He has been building and breaking computers since 2017, serving as the resident youngster at Tom's. From APUs to RGB, Dallin has a handle on all the latest tech news. More about cyber security A broken lock on a PCB. Apartment buildings broken into with phone in minutes -- IoT-connected intercoms using default creds vulnerable to anyone with Google Crypto Hacker FBI identifies North Korea as source of $1.5 billion ByBit hack Latest AMD Ryzen 7 9800X3D Processor Box Retail Finally, AMD's Ryzen 7 9800X3D is readily available again, and at MSRP See more latest [ ] 13 Comments Comment from the forums * Heat_Fan89 Welcome to the Digital World from hell. Can't wait for all the shenanigans when Banks make the switch to digital currencies. That ought to be fun. Reply * FunSurfer So now ransomware attackers can make more money by running a renting service of servers for ransomware decryption... Why can't the OS detect the chacha8 and Kcipher2 encryption methods running at real time? It's about time to put the AI Copilot for a good use... Reply * A Stoner I have a question about cracking encryption... If you already know what is inside the file, shouldn't that make it much easier to crack encryption? Say you know that there is an exact file this large that looks exactly like this, should that not inform the encryption cracking? Reply * DingusDog A Stoner said: I have a question about cracking encryption... If you already know what is inside the file, shouldn't that make it much easier to crack encryption? Say you know that there is an exact file this large that looks exactly like this, should that not inform the encryption cracking? That's not how it works, that's not how any of this works. But at least username checks out. Reply * NightKnight1337 A Stoner said: I have a question about cracking encryption... If you already know what is inside the file, shouldn't that make it much easier to crack encryption? Say you know that there is an exact file this large that looks exactly like this, should that not inform the encryption cracking? Does knowing what's inside a house make it easier for you to go through the door? It's all about the lock Reply * USAFRet If you're at the point of having to use a 4090 to (attempt to) decrypt your data, you've already lost the battle. Reply * edzieba Heat_Fan89 said: Can't wait for all the shenanigans when Banks make the switch to digital currencies. That ought to be fun. Currencies have been digital for over half a century when SWIFT replaced TELEXed transfer orders. Did you think COBOL was just invented for fun? Currencies have been digital for a long, long time, and they were ephemeral long before even that (when currencies ceased to be asset-backed and transitioned to economy-backed AKA 'fiat'), and large fund transfers (e.g. wire transfers) were so even before that. Use of a distributed ledger rather than a centralised ledger isn't even a major distinction, as there are plenty of distributed ledger systems already in active use for inter-bank payments (e.g. Spunta Banka DLT). Reply * A Stoner DingusDog said: That's not how it works, that's not how any of this works. But at least username checks out. It was how people were able to hack into encrypted PDFs in the past as I recall. If they could provide accurate information to the cracker as to what was inside, "exact quotes" from it, it gave them the ability to crack it faster, since they had something to compare the data to to validate keys. Reply * stronk2211 Author is missing 6 zeros from his nanoseconds. A nanosecond is 0.000000001 seconds. Reply * Silicon Mage If you store your data in the Cloud using something like Dropbox it maintains a Version history and you can get your stuff back without any problems at all. So if you get ransomwared all you have to do is reinstall your OS. Reply * View All 13 Comments Show more comments Most Popular GoatWithAGun's motherboard Motherboard dies after marathon 100-hour BIOS update process, vigil attended by thousands online AMD Strix Halo Ryzen AI Max AMD boasts its Ryzen AI Max+ 395 is up to 12.2x faster than Lunar Lake in AI workloads GIMP 3.0 Freeware image editor GIMP 3.0 arrives after seven years of incubation Google Gemini Advanced Google's Gemini 2.0 Flash is reportedly capable of removing watermarks -- Also found to generate AI celebrity photos Raspberry Pi Raspberry Pi and ChatGPT bring AI conversations to your retro rotary phone RTX 3050 MSI Afterburner update enables RTX 50 series owners to push their GDDR7 VRAM up to 36 GT/s Asus AMD manager reports 45% GPU retail market share in Japan -- Eyes 70% as the next target Baidu's ERNIE Bot running on a smartphone ERNIE 4.5 AI model by Baidu claims to match DeepSeek R1 at half the cost Raspberry Pi Pico 2 RP2350 Raspberry Pi Pico 2's RP2350 SoC goes on general sale Beyond CUDA Speakers Keller and Koduri headline the Beyond CUDA Summit today -- AI leaders rally to challenge Nvidia's dominance Tom's Hardware is part of Future US Inc, an international media group and leading digital publisher. Visit our corporate site. * Terms and conditions * Contact Future's experts * Privacy policy * Cookies policy * Accessibility Statement * Advertise with us * About us * Coupons * Careers (c) Future US, Inc. Full 7th Floor, 130 West 42nd Street, New York, NY 10036.