Security experts have warned of a surge in malicious activity from Akira ransomware actors targeted at victims running SonicWall SSL VPN appliances. The campaign appears to have begun back in late July, with initial reports suggesting a zero-day vulnerability may have been to blame. These were later dismissed, with legacy bug CVE-2024-40766 blamed for initial access. A new report published on Friday by Arctic Wolf claimed that exploitation of this improper access control vulnerability supported credential harvesting. This subsequently enabled those devices to be targeted, even if they had been patched, it said. “With dwell times measured in hours rather than days – among the shortest we’ve recorded for ransomware – the window for effective response against this threat is exceptionally…