Akira Ransomware bypasses MFA on SonicWall VPNs

Akira ransomware has been targeting SonicWall SSL VPNs since July 2025, exploiting credentials likely obtained from the exploitation of CVE-2024-40766 to bypass OTP MFA. The campaign, active since 21 July 2025, is affecting SonicWall NSA and TZ series devices running SonicOS 6–8, including recent 7.3.0 builds, with attackers able to authenticate despite MFA protections.

According to Arctic Wolf, the threat actors’ post-login activity is rapid and followed by swift internal scanning and lateral movement, using tools such as Impacket and RDP. The report notes that in over half of intrusions, OTP MFA accounts were involved, with attackers potentially leveraging stolen credentials or OTP seeds, though the exact bypass method remains unclear.

The most crucial mitigation, according to the report, is to reset all SSL VPN credentials on SonicWall devices ever exposed to CVE-2024-40766, as well as Active Directory credentials on accounts used for SSL VPN access and LDAP synchronization.