Akira Ransomware’s Exploitation of SonicWall Vulnerability Continues

The Akira ransomware group continues to exploit a year-old SonicWall vulnerability for initial access and relies on pre-installed and legitimate tools to evade detection, security researchers warn, with a surge in activity around CVE-2024-40766 (CVSS 9.3) over the past three months.

According to Arctic Wolf, the campaign remains active and targets SSL VPN accounts that use a one-time password as the MFA option, while VPN client logins from VPS hosting providers and Impacket SMB activity are among the indicators observed. Artifacts from intrusions suggest multiple threat actors or affiliates might be involved, and automation was used for authentication alongside readily available discovery and lateral-movement tools.

SonicWall noted in August that devices running SonicOS pre-7.3 may have been susceptible to brute-force attacks affecting MFA credentials, contributing to the rapid dwell times described as hours rather than days. In one analysed attack, the attackers leveraged the Datto remote monitoring and management tool installed on a domain controller, using its management console and other backup agents to avoid triggering alerts.

Barracuda explains the operation as mirroring legitimate backup activity, with PowerShell scripts executed via Datto to gain control, followed by registry modifications and firewall rule changes to progress the intrusion.