Loading story…
Akira ransomware activity continues to be linked to CVE-2024-40766, a critical improper access control vulnerability affecting SonicWall Gen5, Gen6, and Gen7 firewalls that was patched in August 2024. Rapid7 reported increasing exploitation, while ThreatDown’s MDR team associated recent incidents with the vulnerability without confirming exploitation in every case. Arctic Wolf previously reported increased Akira and Fog activity linked to SonicWall SSL VPN. Macnica’s historical research found that more than 100 of 218 organizations listed as Akira or Fog victims operated SonicWall devices—approximately 46%, compared with 5% or less among other ransomware groups’ victims—but characterized the exploitation evidence as circumstantial.
The continuing risk includes both unpatched devices and compromised credentials retained after patching. SonicWall investigations found attacks against patched appliances involving credentials carried over from older, vulnerable configurations without password resets. An August 2026 search identified 213,896 publicly reachable SonicWall VPN and management interfaces, but reachability alone does not establish vulnerability. Separately, Macnica estimated at least 48,933 exposed devices remained vulnerable in December 2024; that historical figure does not establish current exposure. Organizations should install the applicable SonicOS updates, reset local account passwords, remove inactive accounts, enforce SSL VPN multifactor authentication, limit privileges, and restrict and monitor management and Virtual Office Portal access. Patching alone may not address access enabled by previously compromised credentials.
See which actors are running it and whether you're in range.
12 events from the most recent confirmed update back to the earliest known activity.
A ThreatDown search identified 10,956 reachable SonicWall VPN portals and 202,940 management interfaces. Public reachability alone did not establish that any individual device was unpatched or exploitable.
An update to the joint Akira ransomware advisory stated that Akira threat actors had likely used CVE-2024-40766 for initial access.
A September 12 report described Rapid7's observation of increasing attacks exploiting CVE-2024-40766 following SonicWall's August warning. Rapid7 recommended software updates, local-account password rotation, removal of inactive accounts, SSLVPN multifactor authentication, and tighter portal access controls.
The Australian Cyber Security Centre warned that CVE-2024-40766 was being actively exploited.
SonicWall warned that Akira ransomware operators were exploiting CVE-2024-40766. The company urged users to install the available patch promptly.
SonicWall investigated attacks against patched appliances in 2025 and found that many involved credentials retained from older, vulnerable configurations without password resets.
Macnica estimated that at least 48,933 internet-exposed SonicWall devices remained unpatched against CVE-2024-40766 as of December 24. This represented approximately 13% of the assessed exposed population.
As of December 23, Macnica suspected that more than 100 organizations had been compromised by Akira and Fog through CVE-2024-40766. More than 100 of 218 examined victims operated SonicWall devices, but the research did not definitively establish exploitation.
CISA added the SonicWall vulnerability to its Known Exploited Vulnerabilities Catalog, identifying it as a vulnerability exploited in real-world attacks.
Macnica's research account states that the SonicWall NSA vulnerability CVE-2024-40766 was disclosed in September 2024.
SonicWall released a software fix for CVE-2024-40766, a critical improper access control vulnerability affecting SonicWall appliances. The vulnerability carries a CVSS score of 9.3 and is associated with VPN and management interfaces.
ThreatDown's MDR team handled multiple Akira ransomware cases in the weeks preceding its article, including incidents affecting two separate customers of one managed service provider. The team associated the overall pattern with CVE-2024-40766 but did not confirm exploitation in every individual case.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Correlate live exploitation activity against the software you actually run, and see where you're exposed.
4 references tracked. Mallory keeps watching after this page renders.
threatdown.com
Open sourcesecurity.nl
Open sourcesecurity.macnica.co.jp
Open sourcearcticwolf.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
The Akira ransomware group is actively exploiting the year-old SonicWall vulnerability CVE-2024-40766, along with SSLVPN misconfigurations and exposed Virtual Office Portals, to gain unauthorized access and deploy ransomware. Despite patches being available since August 2024, many organizations failed to reset local user passwords or address configuration weaknesses, leaving them vulnerable. Security advisories from SonicWall, Rapid7, and the Australian Cyber Security Centre urge immediate patching, password resets, MFA enforcement, and network access restrictions to mitigate ongoing attacks.
Jun 29, 2026
Akira ransomware operators are compromising SonicWall Gen 7 SSL VPN accounts protected by OTP-based MFA, using credentials—and potentially OTP seeds—harvested through the previously disclosed improper-access-control flaw `CVE-2024-40766`. SonicWall assessed the activity as exploitation of that known vulnerability rather than a new zero-day; some incidents were associated with legacy credentials retained during Gen 6-to-Gen 7 migrations. Intrusions have continued against patched appliances, including systems running SonicOS 7.3.0, because firmware updates do not invalidate previously stolen authentication material. After authenticating to VPN services, affiliates rapidly conduct network reconnaissance, escalate privileges, target backup infrastructure, deploy remote-management and tunneling tools, exfiltrate data, and encrypt systems—often within hours. Researchers observed security-control evasion, including bring-your-own-vulnerable-driver attacks to disable endpoint defenses, and attributed portions of the activity to the financially motivated cluster UNC6148. Organizations operating SonicWall SSL VPNs should update firmware, reset all SSL VPN and Active Directory credentials rather than relying on patching alone, remove legacy accounts and migration artifacts, and investigate anomalous VPN logins and rapid post-login reconnaissance.
Sep 26, 2026
Threat actors have launched a widespread campaign targeting SonicWall SSL VPN devices, resulting in the compromise of over 100 accounts across at least 16 customer environments. Security firm Huntress reported that attackers are rapidly authenticating into multiple accounts on compromised devices, indicating possession of valid credentials rather than relying on brute-force methods. The campaign began in earnest around October 4, 2025, with authentication attempts traced to a specific IP address, 202.155.8[.]73. In some cases, attackers disconnected after brief access, but in others, they conducted network scanning and attempted to access local Windows accounts, suggesting a range of post-compromise activities. The incident follows SonicWall’s disclosure of a security breach involving unauthorized exposure of firewall configuration backup files stored in MySonicWall accounts, which could provide attackers with sensitive information such as user and group settings, DNS configurations, and certificates. Although there is no direct evidence linking the configuration file breach to the VPN compromises, the risk of credential exposure remains high, prompting advisories for organizations to reset credentials on live firewall devices. Concurrently, security teams observed a surge in Akira ransomware incidents exploiting SonicWall SSL VPN devices, initially suspected to be due to a zero-day but later attributed to the known vulnerability CVE-2024-40766. This vulnerability, an improper access control flaw in SonicOS, affects multiple generations of SonicWall devices and was first disclosed and patched in August 2024. Despite the availability of a patch, unpatched devices remain vulnerable and have been actively targeted by Akira ransomware affiliates. In one documented case, Darktrace detected suspicious activity including network scanning, lateral movement, privilege escalation, and data exfiltration on a customer’s network, with approximately 2 GiB of data exfiltrated before the attack was contained. The attackers’ tactics included leveraging both the CVE-2024-40766 vulnerability and misconfigurations to gain access. The campaign underscores the importance of timely patching and credential hygiene, as attackers are exploiting both technical vulnerabilities and exposed credentials to infiltrate networks. Organizations using SonicWall’s cloud backup service are particularly at risk if they have not reset credentials following the configuration file exposure. Security advisories recommend immediate credential resets and patching of all affected SonicWall devices to mitigate ongoing threats. The incidents highlight the persistent threat posed by ransomware groups like Akira, who continue to exploit both new and previously disclosed vulnerabilities in widely deployed network infrastructure. The rapid detection and response by managed security services, such as those provided by Darktrace, have proven effective in limiting the impact of these attacks. However, the scale and speed of the current campaign demonstrate the attackers’ ability to coordinate and execute widespread compromises across multiple organizations. The situation remains dynamic, with ongoing investigations into the full extent of the compromise and the potential links between credential exposure and active exploitation. Organizations are urged to review their SonicWall device configurations, monitor for suspicious authentication activity, and ensure all security patches are applied without delay.
Jun 29, 2026