Loading story…
The Akira ransomware group is actively exploiting the year-old SonicWall vulnerability CVE-2024-40766, along with SSLVPN misconfigurations and exposed Virtual Office Portals, to gain unauthorized access and deploy ransomware. Despite patches being available since August 2024, many organizations failed to reset local user passwords or address configuration weaknesses, leaving them vulnerable. Security advisories from SonicWall, Rapid7, and the Australian Cyber Security Centre urge immediate patching, password resets, MFA enforcement, and network access restrictions to mitigate ongoing attacks.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
1 event from the most recent confirmed update back to the earliest known activity.
Initial story creation
11 references tracked. Mallory keeps watching after this page renders.
thecyberthrone.in
Open sourcecyberscoop.com
Open sourcesecurityonline.info
Open sourcethecyberexpress.com
Open sourcescworld.com
Open sourcehelpnetsecurity.com
Open sourcego.theregister.com
Open sourcerapid7.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Akira ransomware operators have been actively targeting organizations by exploiting SonicWall SSL VPN devices to gain unauthorized access to corporate networks. Security researchers observed that the attackers were able to authenticate to SonicWall VPN accounts even when one-time password (OTP) multi-factor authentication (MFA) was enabled, raising concerns about the effectiveness of MFA protections in these scenarios. The initial vector for these breaches was linked to an improper access control vulnerability in SonicWall devices, tracked as CVE-2024-40766, which was disclosed in September 2024 and patched in August 2024. Despite the patch, threat actors continued to leverage credentials that had been previously stolen from devices vulnerable to this flaw, allowing them to maintain access even after organizations applied the security update. Arctic Wolf researchers reported that attackers were able to solve multiple OTP challenges, suggesting that they may have compromised OTP seeds or found alternative methods to generate valid tokens, effectively bypassing MFA protections. The campaign has been described as lightning-fast, with Akira ransomware operators quickly exploiting exposed VPN accounts to move laterally within networks and deploy ransomware payloads. SonicWall responded by urging administrators to reset all SSL VPN credentials and ensure that the latest SonicOS firmware was installed on affected devices. The persistence of the attacks, even after patching, highlights the importance of credential hygiene and the need for organizations to rotate credentials following a security incident. The attackers’ ability to bypass MFA by potentially using previously stolen OTP seeds demonstrates a sophisticated understanding of authentication mechanisms and underscores the evolving tactics of ransomware groups. The Akira ransomware group has been known for its rapid intrusions and effective exploitation of remote access infrastructure, making it a significant threat to organizations relying on SonicWall VPN solutions. Security experts recommend that organizations monitor for unusual login activity, enforce strong password policies, and consider additional layers of authentication beyond OTP-based MFA. The incident serves as a reminder that patching vulnerabilities is only one aspect of a comprehensive security strategy, and that post-compromise credential management is critical to preventing ongoing unauthorized access. The Akira campaign against SonicWall VPNs is part of a broader trend of ransomware groups targeting remote access solutions to gain initial footholds in enterprise environments. Organizations are advised to review their VPN access logs, investigate any suspicious activity, and implement network segmentation to limit the impact of potential breaches. The continued exploitation of previously stolen credentials, even after security updates, demonstrates the long-term risks associated with credential theft and the need for proactive incident response measures. This series of attacks has prompted renewed calls for vendors and customers alike to improve the security of remote access infrastructure and to remain vigilant against evolving ransomware tactics.
Jun 29, 2026
The Akira ransomware group has been exploiting vulnerabilities in SonicWall SSL VPN appliances, particularly those inherited by large enterprises through mergers and acquisitions (M&A) of small- and medium-sized businesses. Attackers have leveraged legacy admin credentials, weak hostnames, and inadequate endpoint defenses to gain rapid access to sensitive systems, with lateral movement to domain controllers occurring in under 10 hours on average. Security researchers note that these attacks are not necessarily targeting M&A activity directly, but the inherited, often misconfigured SonicWall devices present a lucrative entry point for ransomware operations. Experts warn that the integration of overlooked or poorly secured network devices during M&A processes significantly increases the risk of compromise for acquiring organizations. The Akira campaign highlights the broader challenge of managing legacy security appliances, as attackers continue to exploit such devices for initial access and rapid ransomware deployment. Organizations are urged to conduct thorough asset inventories and strengthen security controls around inherited IT infrastructure, especially network edge devices like SSL VPNs.
Jun 29, 2026
Australia’s ASD’s ACSC warned that attackers are actively exploiting the critical SonicWall SSL VPN vulnerability **`CVE-2024-40766`** against exposed devices in Australia, with **Akira ransomware** specifically cited as targeting vulnerable organizations. The flaw can enable unauthorized access and, in some conditions, cause the firewall to crash, increasing the risk of both intrusion and service disruption on internet-facing perimeter systems. Affected systems include **SonicWall Gen 5, Gen 6, and Gen 7** firewalls running **SonicOS `7.0.1-5035` and earlier**, while SonicWall has separately issued security and threat-activity advisories for SSL VPN deployments. Defenders were urged to review SonicWall exposure, apply vendor remediation and firmware updates, and **reset passwords after patching**, as compromised credentials may allow continued access even after the software flaw is fixed.
Aug 15, 2026