Akira ransomware breaching MFA-protected SonicWall VPN accounts

Ongoing Akira ransomware attacks targeting SonicWall SSL VPN devices continue to evolve, with threat actors successfully authenticating to MFA-protected accounts, according to Arctic Wolf. Researchers note that multiple OTP challenges were issued for login attempts, followed by successful logins, suggesting that OTP seeds may have been compromised or an alternative method used to generate valid tokens.

The campaign is linked to CVE-2024-40766, an improper access control flaw previously disclosed in September 2024, which SonicWall had patched in August 2024; however, attackers have continued to use credentials stolen from exploited devices even after updates. SonicWall has urged administrators to reset all SSL VPN credentials and ensure the latest SonicOS firmware is installed, since threat actors can still gain initial access using stolen accounts even on patched systems.

The report also describes BYOVD attacks and the use of legitimate Windows components to sideload malicious drivers, enabling the ransomware to run without being blocked.