Akira Hits SonicWall VPNs in Broad Ransomware Campaign

Akira ransomware actors are targeting SonicWall firewall customers vulnerable to a flaw discovered last year, specifically CVE-2024-40766, which enabled malicious logins and firewall crashes. While initial thoughts pointed to a zero-day, researchers note that an older critical vulnerability was involved, with activity beginning in mid-July and similar malicious VPN logins traced back to last October.

According to Arctic Wolf Labs, threat actors gained initial access through malicious SSL VPN logins with successful OTP MFA challenges and deployed Akira ransomware, with victims spanning multiple sectors and organisation sizes, suggesting opportunistic mass exploitation. The campaign has escalated in recent months, with new infrastructure observed as late as 20 September 2025, and Arctic Wolf Labs reported short dwell times and ongoing questions about bypassing MFA.

Mitigation guidance includes updating SonicWall firmware to version 7.3.0, resetting local accounts, and monitoring for VPN logins from untrusted hosting infrastructure, while researchers noted intrusions affecting devices even on newer SonicOS versions such as 8.0.2. SonicWall has not responded to Dark Reading’s request for comment, and Field Effect has indicated that firewalls running even newer versions could have been impacted. 29 September 2025.