Akira Ransomware Exploits SonicWall VPN Accounts With Lightning-Fast Intrusions

Arctic Wolf has observed a major uptick in Akira ransomware activity since late July 2025, with attackers aggressively targeting SonicWall SSL VPN accounts and fresh infrastructure observed as recently as 20 September 2025. Affiliates are exploiting stolen credentials, even in environments where multi-factor authentication is enabled, with threat actors accessing SSL VPN accounts through credentials likely exfiltrated with CVE-2024-40766.

The campaign continues to focus on VPNs, with previous operations abusing flaws such as CVE-2023-20269 in Cisco ASA and CVE-2020-3259 in Cisco AnyConnect. In dozens of recent intrusions, attackers moved from credential access to lateral movement, exfiltration and encryption in under four hours, with some attacks completed in 55 minutes, leaving defenders little time to respond.

SonicWall confirmed links to CVE-2024-40766 exploitation and urged credential resets, updating to SonicOS 7.3.0, removing unused accounts and enforcing MFA across remote access. Victims span multiple industries and organisation sizes, indicating opportunistic mass exploitation rather than targeted intrusions, according to the report.