Loading story…
Threat actors exploited a SonicWall VPN vulnerability to gain initial access to an organization, then leveraged plaintext Huntress recovery codes found on a desktop to bypass MFA and compromise the Huntress portal. The attackers used this access to close incident reports, de-isolate hosts, and uninstall endpoint security agents, attempting to blind the organization’s defenses. This incident highlights the critical risk of storing recovery codes and credentials in plaintext and the need for robust credential management practices.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
1 event from the most recent confirmed update back to the earliest known activity.
Initial story creation
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Akira ransomware operators are compromising SonicWall Gen 7 SSL VPN accounts protected by OTP-based MFA, using credentials—and potentially OTP seeds—harvested through the previously disclosed improper-access-control flaw `CVE-2024-40766`. SonicWall assessed the activity as exploitation of that known vulnerability rather than a new zero-day; some incidents were associated with legacy credentials retained during Gen 6-to-Gen 7 migrations. Intrusions have continued against patched appliances, including systems running SonicOS 7.3.0, because firmware updates do not invalidate previously stolen authentication material. After authenticating to VPN services, affiliates rapidly conduct network reconnaissance, escalate privileges, target backup infrastructure, deploy remote-management and tunneling tools, exfiltrate data, and encrypt systems—often within hours. Researchers observed security-control evasion, including bring-your-own-vulnerable-driver attacks to disable endpoint defenses, and attributed portions of the activity to the financially motivated cluster UNC6148. Organizations operating SonicWall SSL VPNs should update firmware, reset all SSL VPN and Active Directory credentials rather than relying on patching alone, remove legacy accounts and migration artifacts, and investigate anomalous VPN logins and rapid post-login reconnaissance.
Sep 26, 2026The Akira ransomware group is actively exploiting the year-old SonicWall vulnerability CVE-2024-40766, along with SSLVPN misconfigurations and exposed Virtual Office Portals, to gain unauthorized access and deploy ransomware. Despite patches being available since August 2024, many organizations failed to reset local user passwords or address configuration weaknesses, leaving them vulnerable. Security advisories from SonicWall, Rapid7, and the Australian Cyber Security Centre urge immediate patching, password resets, MFA enforcement, and network access restrictions to mitigate ongoing attacks.
Jun 29, 2026
The Akira ransomware group has been exploiting vulnerabilities in SonicWall SSL VPN appliances, particularly those inherited by large enterprises through mergers and acquisitions (M&A) of small- and medium-sized businesses. Attackers have leveraged legacy admin credentials, weak hostnames, and inadequate endpoint defenses to gain rapid access to sensitive systems, with lateral movement to domain controllers occurring in under 10 hours on average. Security researchers note that these attacks are not necessarily targeting M&A activity directly, but the inherited, often misconfigured SonicWall devices present a lucrative entry point for ransomware operations. Experts warn that the integration of overlooked or poorly secured network devices during M&A processes significantly increases the risk of compromise for acquiring organizations. The Akira campaign highlights the broader challenge of managing legacy security appliances, as attackers continue to exploit such devices for initial access and rapid ransomware deployment. Organizations are urged to conduct thorough asset inventories and strengthen security controls around inherited IT infrastructure, especially network edge devices like SSL VPNs.
Jun 29, 2026