SonicWall SSL VPN Devices Targeted by Threat Actors to Distribute Akira Ransomware

SonicWall SSL VPN devices have been targeted by threat actors to distribute Akira ransomware, with researchers noting a significant uptick in attacks exploiting unpatched appliances between July and August 2025. According to Darktrace, on August 20, 2025, anomalous network scanning and reconnaissance activity was detected on a U.S. customer’s network, which SonicWall later attributed to exploits of CVE-2024-40766, an improper access control flaw disclosed on 23 August 2024.

The campaign involved attackers using previously stolen credentials and misconfigurations in the Virtual Office Portal to bypass multi-factor authentication and escalate privileges, enabling data exfiltration and lateral movement. Approximately 2 GiB of sensitive data was exfiltrated before containment actions halted further damage, with Akira’s Windows and ESXi variants then deployed to encrypt files and target cloud infrastructures.

The vulnerability, CVE-2024-40766, permits unauthorized access to administrative endpoints and remote control of SSL VPN configurations. Mitigations emphasise timely patching, credential hygiene, least-privilege access, and monitoring for anomalous Kerberos PKINIT requests and unusual administrative tool usage.