Akira Ransomware’s Exploitation of SonicWall Vulnerability Continues

Akira ransomware: From SonicWall VPN login to encryption in under four hours Four hours or less: that’s how long it takes for Akira affiliates to break into organizations and deploy the ransomware on their systems, Arctic Wolf researchers have warned. Armed with SonicWall SSL VPN credentials stolen in earlier intrusions and apparently able to bypass multi-factor authentication (MFA), the attackers: Start to scan the network to discover network services and unsecured accounts Use Impacket to set up and interact with SMB sessions Use RDP for lateral movement through compromised environments Find their way to a Domain Controller and gain access to virtual machine storage and backups Create additional accounts (including domain accounts) to install RMM tools and for data exfiltration Establish a C2 method Collect and exfiltrate data Disable legitimate RMM tools and EDR tools, delete System Volume Shadow Service copies, clear event logs Install WinRAR to archive data that will be exfiltrated via rclone or FileZilla to a virtual private server (VPS) they control Deploy the Akira ransomware. Initial access Arctic Wolf has been warning about the increase of Akira ransomware attacks since July 2025. At first, it appeared the attackers might be exploiting a zero-day in SonicWall VPN devices, but it was later confirmed they were abusing CVE-2024-40766, an improper access control flaw in SonicWall SonicOS management access and SSL VPN. A fix for CVE-2024-40766 was released by SonicWall in August 2024 but, according to the company, some customers have upgraded from Gen 6 to Gen 7 firewalls without resetting passwords for local user accounts with SSL VPN access. The prevailing theory is that these actors harvested SSL VPN and privileged service account credentials months earlier during quieter intrusions. They are now reusing those credentials to breach organizations that may have patched or upgraded, but never rotated local user passwords. Rapid7 researchers have also suggested that attackers are exploiting additional weaknesses, including: A misconfiguration in SonicWall devices’ SSLVPN Default Users Group setting, which automatically adds every successfully authenticated LDAP user to a predefined local group that may have access to sensitive services Externally accessible Virtual Office Portal inside the SonicOS management interface, which allows them to configure one-time password (OTP) multi-factor authentication on compromised accounts. “In our investigation, we observed repeated malicious SSL VPN logins on accounts with OTP MFA enabled, ruling out scratch code usage in those cases. We also found no signs of malicious use of the compromised accounts prior to SSL VPN login (event ID 1080), nor did we observe unauthorized OTP unbinding events or other malicious configuration changes (event ID 1382) in the five days leading up to the intrusions,” Arctic Wolf researchers noted. “Taken together, the evidence points to the use of valid credentials rather than modification of OTP configuration, though the exact method of authenticating against MFA-enabled accounts remains unclear.” So far, there’s no indication that these intrusions and the attack against SonicWall’s cloud backup service for firewalls are related. Advice for organizations Victim organizations span multiple industries and vary in size, which points to the attacks being opportunistic rather than targeted. The extraordinarily short time between initial access and ransomware deployment means that early detection and response are crucial. The researchers advise organizations to: Monitor for or, if possible, block logins from VPS hosting providers Monitor for anomalous SMB activity that points to Impacket use and for LDAP discovery activity Monitor for execution of network scanning tools and archival tools from unusual locations on servers Use App Control for Business to block unauthorized remote tools, deny execution from untrusted paths, etc. “If your SonicWall devices have previously run firmware versions vulnerable to CVE-2024-40766, we strongly recommend resetting all credentials stored on the firewall, including SSL VPN passwords and OTP MFA secrets,” Arctic Wolf researchers added. “This includes both local firewall accounts and LDAP-synchronised Active Directory accounts, especially where accounts have access to SSL VPN. Threat actors are abusing these credentials even when devices are fully patched, suggesting that credential theft may have occurred earlier in the lifecycle. Resetting LDAP synchronisation accounts is especially critical, as we have observed logins against these accounts despite them not being intended for VPN access.” Subscribe to our breaking news e-mail alert to never miss out on the latest breaches, vulnerabilities and cybersecurity threats. Subscribe here!

The Akira ransomware group continues to exploit a year-old SonicWall vulnerability for initial access and relies on pre-installed and legitimate tools to evade detection, security researchers warn. Over the past three months, Akira ransomware attacks have led to a surge in the exploitation of CVE-2024-40766 (CVSS score of 9.3), an improper access control issue in SonicWall firewalls that was patched in August 2024. Akira’s campaign, Arctic Wolf warns in a fresh report, remains active, as the ransomware operators are successfully targeting SSL VPN accounts that use a one-time password (OTP) as the multi-factor authentication (MFA) option. Arctic Wolf says it observed dozens of incidents that can be tied together by VPN client logins originating from VPS hosting providers, network scanning, Impacket SMB activity for endpoint discovery, and Active Directory discovery. Artifacts collected from these intrusions suggest that multiple threat actors or affiliates might have been involved, that automation was used for authentication, and that readily available tools were used for discovery and lateral movement. The cybersecurity firm also points out that, while it is unclear how the attackers were able to circumvent MFA, SonicWall confirmed in August that devices running SonicOS versions prior to 7.3 “may have been susceptible to brute force attacks affecting MFA credentials”. “With dwell times measured in hours rather than days—among the shortest we’ve recorded for ransomware—the window for effective response against this threat is exceptionally narrow. By detecting unexpected logins from a handful of hosting-related ASNs and identifying Impacket SMB activity over the network, intrusions can be disrupted at an early stage,” Arctic Wolf notes. In one attack analyzed by Barracuda, the Akira affiliates were seen leveraging various pre-installed and legitimate utilities, which allowed them to stay under the radar. They also used the Datto remote monitoring and management (RMM) tool, installed on a domain controller. “They homed in on the RMM tool’s management console and used it, together with several previously installed backup agents, to implement the attack without triggering a security alert for a new software install or suspicious activity,” Barracuda explains. The hackers used Datto to execute a PowerShell script to gain full control over the server, then ran additional tools, modified registries to evade detection and turn off security features, and dropped various files, including scripts that modified firewall rules. “The attackers didn’t deploy sophisticated new malware or tools that would immediately raise red flags. Instead, they used what was already there — the Datto RMM and the backup agents. […] The attacker’s activity closely mirrored what a backup agent might legitimately do during scheduled jobs. This made everything look like regular IT activity,” Barracuda notes. Related: Volvo Group Employee Data Stolen in Ransomware Attack Related: Fintech Firm Wealthsimple Says Supply Chain Attack Resulted in Data Breach Related: Recent SAP S/4HANA Vulnerability Exploited in Attacks

Security experts have warned of a surge in malicious activity from Akira ransomware actors targeted at victims running SonicWall SSL VPN appliances. The campaign appears to have begun back in late July, with initial reports suggesting a zero-day vulnerability may have been to blame. These were later dismissed, with legacy bug CVE-2024-40766 blamed for initial access. A new report published on Friday by Arctic Wolf claimed that exploitation of this improper access control vulnerability supported credential harvesting. This subsequently enabled those devices to be targeted, even if they had been patched, it said. “With dwell times measured in hours rather than days – among the shortest we’ve recorded for ransomware – the window for effective response against this threat is exceptionally narrow,” Arctic Wolf warned. The report claimed that most attacks observed in this campaign contain similar elements: VPN client logins originating from hosting providers Internal network scanning Impacket SMB activity tied to discovery Active Directory discovery OTP Bypass Interestingly, the threat actors have also been able to compromise devices running one-time password (OTP) multi-factor authentication (MFA). “In our investigation, we observed repeated malicious SSL VPN logins on accounts with OTP MFA enabled, ruling out scratch code usage in those cases. We also found no signs of malicious use of the compromised accounts prior to SSL VPN login, nor did we observe unauthorized OTP unbinding events or other malicious configuration changes in the five days leading up to the intrusions,” the report continued. “Taken together, the evidence points to the use of valid credentials rather than modification of OTP configuration, though the exact method of authenticating against MFA-enabled accounts remains unclear.” One possible explanation is that threat actors managed to obtain OTP seeds. “Google Threat Intelligence Group recently uncovered a campaign affecting SonicWall SMA demonstrating that if OTP seeds are obtained by threat actors, they can be used to generate valid OTP tokens,” Arctic Wolf said. There are also hints that adversaries used automated tooling to achieve initial access and lateral movement. Arctic Wolf said it recorded multiple login events in quick succession across a number of accounts, from the same VPN client IP address. “Upon gaining SSL VPN access, threat actors wasted no time in attempting lateral movement through compromised environments, typically initiating internal scanning within five minutes of logging in,” it added. Bring-Your-Own-Vulnerable-Driver (BYOVD) techniques were also used to evade detection by security tools. “Early detection is critical in this campaign, and to that end we recommend monitoring for hosting-related ASNs in SonicWall SSL VPN logins,” Arctic Wolf concluded. “Additionally, monitoring for SMB session setup requests consistent with Impacket provides an early kill chain detection for discovery activity related to this campaign.” The security vendor also advised blocking logins from infrastructure linked to virtual private server (VPS) hosting providers and anonymization services, as well as restricting VPN logins from countries where the organization does not do business. Image credit: Michael Vi / Shutterstock.com

Betti RHC, la prima graphic novel al mondo dedicata alla cybersecurity awareness, ha finalmente il suo sito ufficiale. Uno spazio tutto suo dove scoprire il progetto, sfogliare le copertine degli episodi e immergersi nel mondo di Betti: la giovane laureanda in informatica che, dopo la morte misteriosa del padre, si trasforma nell'hacker più potente del mondo. Una storia avvincente che, episodio dopo episodio, affronta una minaccia digitale diversa — dal phishing al ransomware, fino al cyberbullismo — e insegna a riconoscerla e a difendersi, senza che sembri mai una lezione. Sul sito trovate tutto ciò che rende Betti un progetto diverso dal solito: la sua filosofia, le anteprime delle tavole e il racconto di come nasce ogni volume. Perché dietro Betti RHC c'è solo lavoro umano: ogni tavola è disegnata interamente a mano dagli artisti del Gruppo Arte di Red Hot Cyber, senza alcun uso di intelligenza artificiale. E a garantire che ogni storia sia realistica e tecnicamente corretta c'è la supervisione degli hacker etici del gruppo HackerHood, che mantengono il racconto fedele al mondo reale della sicurezza informatica. C'è spazio anche per le aziende, che possono usare Betti come strumento di awareness diverso dai soliti corsi: acquistare i volumi, personalizzarli con il proprio brand o sponsorizzare nuovi episodi. E come primo regalo, l'episodio "Byte the Silence", dedicato al cyberbullismo, è scaricabile gratuitamente per uso personale. Perché la miglior difesa, in fondo, è una bella storia. 👉 Scopri tutto su https://betti.redhotcyber.com/