US government agencies are warning that the Akira ransomware operation has been spotted encrypting Nutanix AHV virtual machines in attacks. An updated joint advisory from CISA, the FBI, the Department of Defense Cyber Crime Center (DC3), the Department of Health and Human Services (HHS), and several international partners alerts that Akira ransomware has expanded its encryption capabilities Nutanix AHV VM disk files. The advisory includes new indicators of compromise and tactics observed through FBI investigations and third-party reporting as recent as November 2025. Encrypting Nutanix VMs in attacks The advisory warns that in June 2025 Akira actors started to encrypt disk files for Nutanix AHV virtual machines. "In a June 2025 incident, Akira threat actors encrypted Nutanix AHV VM disk…