Redazione RHC : 28 September 2025 15:03
Since late July 2025, a new wave of cyber attacks has been recorded targeting organizations equipped with SonicWall firewalls, with the active spread of the Akira ransomware.
According to researchers at Arctic Wolf Labs , malicious activity has significantly increased and continues to persist. Attackers gain initial access through compromised SSL VPN connections , successfully bypassing multi-factor authentication (MFA) . Once inside the network, they quickly move on to the encryption phase—in some cases, the dwell time before the ransomware was released was as short as 55 minutes .
The hacks have been linked to CVE-2024-40766 , an access control vulnerability disclosed in 2024. The leading hypothesis is that criminals previously harvested credentials from exposed and vulnerable devices, which they now exploited against already patched devices. This explains why fully patched systems were compromised, a circumstance that initially fueled the hypothesis of a new zero-day exploit.
Another critical element concerns SonicWall’s OTP MFA : attackers were able to authenticate even with accounts protected by this feature, increasing the severity of the campaign.
Once they gain access via SSL VPN, the attackers:
To reduce the chance of detection, threat actors attempt to disable endpoint security solutions, such as Windows Defender and EDR.
In some cases, they use the BYOVD (bring your own vulnerable driver) technique to compromise systems at the kernel level and delete shadow volume copies to prevent any restores.
Before starting the encryption, the attackers exfiltrate sensitive information: the files are compressed with WinRAR and extracted using tools like rclone and FileZilla . They then distribute the Akira ransomware, via executable files named akira.exe or locker.exe , encrypting network drives and launching the ransom note.
Arctic Wolf experts urge all organizations using SonicWall appliances to take immediate action.
In particular, it is recommended to reset SSL VPN credentials , including Active Directory-linked accounts, especially if systems have previously run firmware vulnerable to CVE-2024-40766. Simply applying patches is not considered sufficient if credentials have already been compromised.
Redazione