Loading story…
Threat actors have launched a widespread campaign targeting SonicWall SSL VPN devices, resulting in the compromise of over 100 accounts across at least 16 customer environments. Security firm Huntress reported that attackers are rapidly authenticating into multiple accounts on compromised devices, indicating possession of valid credentials rather than relying on brute-force methods. The campaign began in earnest around October 4, 2025, with authentication attempts traced to a specific IP address, 202.155.8[.]73. In some cases, attackers disconnected after brief access, but in others, they conducted network scanning and attempted to access local Windows accounts, suggesting a range of post-compromise activities. The incident follows SonicWall’s disclosure of a security breach involving unauthorized exposure of firewall configuration backup files stored in MySonicWall accounts, which could provide attackers with sensitive information such as user and group settings, DNS configurations, and certificates. Although there is no direct evidence linking the configuration file breach to the VPN compromises, the risk of credential exposure remains high, prompting advisories for organizations to reset credentials on live firewall devices. Concurrently, security teams observed a surge in Akira ransomware incidents exploiting SonicWall SSL VPN devices, initially suspected to be due to a zero-day but later attributed to the known vulnerability CVE-2024-40766. This vulnerability, an improper access control flaw in SonicOS, affects multiple generations of SonicWall devices and was first disclosed and patched in August 2024. Despite the availability of a patch, unpatched devices remain vulnerable and have been actively targeted by Akira ransomware affiliates. In one documented case, Darktrace detected suspicious activity including network scanning, lateral movement, privilege escalation, and data exfiltration on a customer’s network, with approximately 2 GiB of data exfiltrated before the attack was contained. The attackers’ tactics included leveraging both the CVE-2024-40766 vulnerability and misconfigurations to gain access. The campaign underscores the importance of timely patching and credential hygiene, as attackers are exploiting both technical vulnerabilities and exposed credentials to infiltrate networks. Organizations using SonicWall’s cloud backup service are particularly at risk if they have not reset credentials following the configuration file exposure. Security advisories recommend immediate credential resets and patching of all affected SonicWall devices to mitigate ongoing threats. The incidents highlight the persistent threat posed by ransomware groups like Akira, who continue to exploit both new and previously disclosed vulnerabilities in widely deployed network infrastructure. The rapid detection and response by managed security services, such as those provided by Darktrace, have proven effective in limiting the impact of these attacks. However, the scale and speed of the current campaign demonstrate the attackers’ ability to coordinate and execute widespread compromises across multiple organizations. The situation remains dynamic, with ongoing investigations into the full extent of the compromise and the potential links between credential exposure and active exploitation. Organizations are urged to review their SonicWall device configurations, monitor for suspicious authentication activity, and ensure all security patches are applied without delay.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
13 events from the most recent confirmed update back to the earliest known activity.
In October 2025, Huntress reported widespread SSL VPN account authentications affecting more than 100 accounts, indicating broad compromise activity against SonicWall environments. The activity was linked in public reporting to ongoing post-exploitation and ransomware risk.
In September 2025, SonicWall disclosed unauthorized access to cloud-stored firewall configuration backups in MySonicWall. This increased concern that exposed configuration data could create follow-on risk for VPN and firewall customers.
Darktrace reported at least three other U.S. incidents showing similar 'vmwaretools' downloads and SSH exfiltration to the same ASN, indicating a broader campaign. The overlap suggested repeated Akira-linked tradecraft, potentially with variation across affiliates.
Darktrace's autonomous response and MDR teams blocked key endpoints and ports and quarantined suspected devices during the August 20 incident. The response reportedly limited observed exfiltration to about 2 GiB and prevented further escalation.
During the August 20 intrusion, the attackers abused Kerberos and AD CS in a manner consistent with the UnPAC the Hash technique to extract NTLM hashes via PKINIT and U2U. They also used WinRM and RDP for movement, downloaded a 'vmwaretools' payload from rare external IPs, and exfiltrated data over SSH to infrastructure associated in OSINT with Akira.
On August 20, 2025, Darktrace observed an intrusion at a U.S. customer in which a compromised SonicWall VPN server was the likely initial access point. The attackers conducted scanning, lateral movement, privilege escalation, and limited data exfiltration consistent with Akira tradecraft.
In an August 19, 2025 update, SonicWall said earlier activity thought to reflect a zero-day was instead linked to password reuse and CVE-2024-40766 exploitation. This changed the public understanding of how attackers were obtaining access.
Defenders observed a surge of Akira ransomware incidents involving SonicWall SSL VPN devices across July and August 2025. The campaign affected multiple U.S. organizations and was initially thought to involve a new zero-day before later reassessment.
On August 4, 2025, SonicWall issued mitigation guidance in response to the ongoing SSL VPN compromise activity. Security vendors including Huntress, Arctic Wolf, GuidePoint Security, and FieldEffect also shared related observations and indicators.
By early August 2025, public reporting described active exploitation of SonicWall Gen 7 SSL VPN functionality to bypass MFA and gain unauthorized access, with Akira frequently following. At the time, the initial access method was described as a suspected zero-day with no confirmed CVE.
On 2024-09-06, SonicWall updated its advisory for CVE-2024-40766 to warn of possible active exploitation and expanded the affected exposure from management interfaces to include local SSLVPN user accounts. The same day, Arctic Wolf reported Akira intrusions using compromised local SSL VPN accounts on unpatched devices without MFA as an initial access vector.
SonicWall later said activity in 2024 that had initially been considered possible zero-day exploitation was actually associated with password reuse and exploitation of CVE-2024-40766 during some Gen 6 to Gen 7 migrations where passwords were not reset. This revised the attribution of the initial access vector for earlier incidents.
SonicWall had previously disclosed CVE-2024-40766, a vulnerability later linked to Akira-related SonicWall SSL VPN intrusions. Subsequent reporting said incidents first suspected as a zero-day were instead tied in part to this flaw.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 31 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
8 references tracked. Mallory keeps watching after this page renders.
csoonline.com
Open sourcesecurityonline.info
Open sourcecentripetal.ai
Open sourcethehackernews.com
Open sourcesecurityaffairs.com
Open sourcedarktrace.com
Open sourcekyberturvallisuuskeskus.fi
Open sourcekyberturvallisuuskeskus.fi
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Akira ransomware operators have been actively targeting organizations by exploiting SonicWall SSL VPN devices to gain unauthorized access to corporate networks. Security researchers observed that the attackers were able to authenticate to SonicWall VPN accounts even when one-time password (OTP) multi-factor authentication (MFA) was enabled, raising concerns about the effectiveness of MFA protections in these scenarios. The initial vector for these breaches was linked to an improper access control vulnerability in SonicWall devices, tracked as CVE-2024-40766, which was disclosed in September 2024 and patched in August 2024. Despite the patch, threat actors continued to leverage credentials that had been previously stolen from devices vulnerable to this flaw, allowing them to maintain access even after organizations applied the security update. Arctic Wolf researchers reported that attackers were able to solve multiple OTP challenges, suggesting that they may have compromised OTP seeds or found alternative methods to generate valid tokens, effectively bypassing MFA protections. The campaign has been described as lightning-fast, with Akira ransomware operators quickly exploiting exposed VPN accounts to move laterally within networks and deploy ransomware payloads. SonicWall responded by urging administrators to reset all SSL VPN credentials and ensure that the latest SonicOS firmware was installed on affected devices. The persistence of the attacks, even after patching, highlights the importance of credential hygiene and the need for organizations to rotate credentials following a security incident. The attackers’ ability to bypass MFA by potentially using previously stolen OTP seeds demonstrates a sophisticated understanding of authentication mechanisms and underscores the evolving tactics of ransomware groups. The Akira ransomware group has been known for its rapid intrusions and effective exploitation of remote access infrastructure, making it a significant threat to organizations relying on SonicWall VPN solutions. Security experts recommend that organizations monitor for unusual login activity, enforce strong password policies, and consider additional layers of authentication beyond OTP-based MFA. The incident serves as a reminder that patching vulnerabilities is only one aspect of a comprehensive security strategy, and that post-compromise credential management is critical to preventing ongoing unauthorized access. The Akira campaign against SonicWall VPNs is part of a broader trend of ransomware groups targeting remote access solutions to gain initial footholds in enterprise environments. Organizations are advised to review their VPN access logs, investigate any suspicious activity, and implement network segmentation to limit the impact of potential breaches. The continued exploitation of previously stolen credentials, even after security updates, demonstrates the long-term risks associated with credential theft and the need for proactive incident response measures. This series of attacks has prompted renewed calls for vendors and customers alike to improve the security of remote access infrastructure and to remain vigilant against evolving ransomware tactics.
Jun 29, 2026
SonicWall experienced a significant security incident in early October 2025, resulting in the unauthorized access of firewall configuration backup files for all customers utilizing the MySonicWall cloud backup service. The breach exposed sensitive configuration data, including device settings, encrypted credentials, VPN configurations, private keys, and administrator information. Although the credentials and secrets were protected with AES-256 encryption, the exposure of this data raised substantial concerns about the potential for further exploitation, especially in cases where weak or reused passwords were present. Forensic analysis conducted by SonicWall in collaboration with Mandiant confirmed that 100% of cloud backup customers were affected, making this a global event with far-reaching implications for network security. Following the breach, security researchers, including those at Huntress, observed a marked increase in SonicWall SSLVPN account compromises starting on October 4, 2025. Over 100 accounts across 16 customer environments were breached, with attackers using valid credentials rather than brute-force methods. The malicious activity was traced to a single IP address (202.155.8[.]73), and attackers were seen rapidly authenticating, conducting network scans, and attempting lateral movement within affected environments. In some cases, attackers disconnected quickly, but in others, they pursued deeper access by targeting local Windows accounts. Evidence suggests that the Akira ransomware group may be leveraging both the stolen credentials and known SSLVPN vulnerabilities to facilitate these intrusions. While Huntress did not find direct evidence linking the observed SSLVPN compromises to the configuration file breach, the timing and nature of the attacks have raised concerns about a possible connection. The exposed configuration files, even though encrypted, could potentially be decoded by determined attackers, revealing authentication passwords and keys in their encrypted form. This scenario underscores the risk posed by the breach, particularly if attackers are able to crack or otherwise obtain the necessary decryption keys. SonicWall and security vendors have issued urgent guidance to affected customers, recommending immediate review of the MySonicWall portal for impact assessment and the implementation of enhanced security measures. System administrators are advised to follow SonicWall’s security checklist, which includes steps such as resetting credentials, reviewing access logs, and applying any available patches or mitigations. The incident has prompted widespread concern within the security community due to the scale of the exposure and the potential for further exploitation. The breach highlights the critical importance of strong encryption, robust credential management, and rapid incident response in cloud-based security services. It also demonstrates the potential for configuration data leaks to serve as a springboard for targeted attacks, including ransomware campaigns. Organizations using SonicWall products are urged to remain vigilant, monitor for signs of compromise, and coordinate closely with SonicWall and their security partners to mitigate ongoing risks. The incident serves as a stark reminder of the evolving threat landscape facing managed security service providers and their customers.
Jun 29, 2026
Huntress reported an active credential-stuffing and brute-force campaign targeting **SonicWall** VPN and firewall login portals, compromising 30 organizations and 92 user accounts in roughly 41 hours. The activity began on July 25 and used authorized logins against remote access interfaces rather than exploiting a software vulnerability, with attacks described as broad and opportunistic instead of focused on a particular sector. Huntress said the observed victims were all its customers using SonicWall devices, indicating the total number of affected organizations could be higher. Investigators traced the automated credential-validation activity to a small set of malicious IP addresses registered to **DigitalOcean** and said the pattern aligns with recurring SonicWall SSLVPN targeting seen in 2025 and 2026, including abuse of reused compromised credentials. Huntress said it had not yet observed post-compromise hands-on-keyboard activity, raising concern that the intrusions may be intended to pre-position access for later operations. At the time of reporting, SonicWall said it was investigating and had not issued a security advisory, while Huntress urged defenders to restrict remote management, reset credentials and secrets, review authentication logs, and enforce **MFA**.
Aug 2, 2026