Akira Ransomware Revives SonicWall Flaw CVE-2024-40766, Uses ‘UnPAC the Hash’ to Breach Networks

Between July and August 2025, Akira ransomware incidents resurfaced, targeting organisations via SonicWall SSL VPN appliances and reviving interest in CVE-2024-40766. According to Darktrace’s Threat Research Team, the campaigns exploit unpatched or misconfigured SonicWall devices to gain initial access, followed by lateral movement, credential harvesting, and data exfiltration.

The vulnerability affects SonicOS versions 7.0.1-5035 and earlier across Gen 5, Gen 6 and Gen 7 devices, though patches were released in August 2024. The attacks use a Kerberos abuse technique known as “UnPAC the Hash” to steal credentials, with Darktrace noting 15 distinct administrative credentials accessed during intrusions.

On 20 August 2025, Darktrace’s MDR team detected a SonicWall VPN server compromise in a United States customer’s network, and observed data exfiltration to SSH endpoints and later to a known Akira IoC, including approximately 2 GB of data via SSH. The campaign’s broader impact has seen multiple incidents across the US, Europe and the Asia‑Pacific region, tied by shared TTPs and SSH data exfiltration to a common network infrastructure.