Akira Ransomware Attacks Fuel Uptick in Exploitation of SonicWall Flaw

The Akira ransomware group is exploiting a year-old SonicWall flaw, CVE-2024-40766, in a fresh round of attacks that Rapid7 warns may combine three attack vectors for initial access. The vulnerability, rated CVSS 9.3, is described as an improper access control issue that could let attackers access restricted resources and crash the firewall in certain conditions. Exploitation was observed after SonicWall published its advisory in August 2024, with the company updating guidance to include additional mitigations.

According to SonicWall, administrators should update passwords on Gen5 and Gen6 firewalls with locally managed SSLVPN accounts and enable the “User must change password” option for each local account. Rapid7 notes that the Akira group may be using a combination of three security risks—including the SSLVPN Default Users Group security risk and potential access to the Virtual Office Portal—to gain unauthorized access and conduct ransomware operations.

Active since at least 2023, Akira targets edge devices for initial access, escalates privileges, exfiltrates data, erases backups and deploys file-encrypting ransomware at the hypervisor level.