Akira SonicWall Campaign Uncovered

Starting in July 2025, Akira ransomware activity targeting SonicWall SSL VPN devices surged globally, with SonicWall CVE-2024-40766 linked to the campaign after an initial belief in a zero‑day vulnerability. On 20 August 2025, Darktrace observed unusual activity on a US customer network, including scanning, lateral movement and data exfiltration, with a compromised SonicWall VPN server identified as part of the broader campaign.

The enterprise faced data exfiltration of approximately 2 GiB, and analyses show the attackers used techniques such as Kerberoasting and UnPAC the hash to escalate privileges and move laterally, while C2 activity involved tools like AnyDesk, RustDesk, Ngrok and Cloudflare Tunnel.

Darktrace’s Cyber AI Analyst tracked multi‑stage activity—from reconnaissance using network scanning and Advanced IP Scanner to credential access and exfiltration via SSH to an Akira‑associated endpoint—leading to rapid containment by the Autonomous Response and MDR team, which quarantined affected devices and blocked connections to malicious endpoints and sensitive ports.

The analysis also notes other incidents in the US tied to the same campaign, with similar patterns such as the download of a vmwaretools executable and SSH exfiltration to shared AS endpoints. According to the report, the campaign underscores the ongoing risk of misconfigurations and the exploitation of previously disclosed vulnerabilities alongside the abuse of legitimate admin tools to blend in with normal activity.