Cybercriminals Target SonicWall Firewalls to Deploy Akira Ransomware via Malicious Login Attempts

Security teams face a rapidly evolving campaign that abuses compromised SonicWall SSL VPN credentials to deliver Akira ransomware, with activity observed in under four hours from initial access. According to SonicWall, new malicious infrastructure tied to the campaign was seen as recently as 20 September 2025, and initial access often came from SSL VPN client logins originating from hosting-related ASNs.

The attackers are said to have exploited CVE-2024-40766, an improper access control flaw disclosed in September 2024, to enable unauthorized logins that bypass MFA by using stolen credentials. Targets range from small enterprises to large organisations across multiple sectors, with credential harvesting and subsequent internal reconnaissance followed by the deployment of the ransomware across diverse environments.

Arctic Wolf Labs detected a surge of suspicious login attempts against SonicWall SSL VPN services in late July 2025, and, in many incidents, LDAP-synchronising accounts not intended for remote VPN access authenticated successfully. The campaign leverages tools such as Impacket SMB, conducts network exploration, and culminates in encryption of drives and network shares, sometimes within 55 minutes of initial access.

Arctic Wolf Labs continues to monitor the threat in collaboration with SonicWall and the security community to refine detections and protect against further exploitation.