Akira Affiliate Crashes Ransomware After Attempting EDR Evasion

FBI: Akira gang has received nearly $250 million in ransoms Government agencies in the U.S. and Europe shared new information on Thursday to help organizations defend themselves against the Akira ransomware gang, which has attacked small- and medium-sized businesses since 2023. The updates to an April 2024 advisory about the group’s operations include a new list of tactics and vulnerabilities being exploited in attacks. As of late September, Akira is believed to have claimed more than $244 million in ransomware proceeds, according to the advisory. “Akira ransomware doesn’t just steal money – it disrupts the systems that power our hospitals, schools, and businesses,” said FBI Cyber Division Assistant Director Brett Leatherman. “Behind every compromised network, you’ll find real people and communities harmed by callous cyber criminals.” In addition to the FBI, the Defense Department and the Health and Human Services Department contributed to the advisory. Europol and law enforcement agencies in France, Germany and the Netherlands were also involved in the updated advisory. The group has allegedly targeted the manufacturing, education, IT and healthcare sectors. “Akira threat actors gain access to VPN products, such as SonicWall, by stealing login credentials or exploiting vulnerabilities like CVE-2024-40766,” the agencies said. “In some instances, they gain initial access through compromised VPN credentials, potentially by using initial access brokers or brute-forcing VPN endpoints. Additionally, Akira threat actors deploy password spraying techniques, using tools such as SharpDomainSpray to gain access to account credentials.” The group has also abused remote access tools like AnyDesk and LogMeIn to maintain their access to victim networks and blend in with administrator activity. In some cases, incident responders saw Akira uninstall endpoint detection and response (EDR) systems. The FBI warned that in some incidents Akira threat actors were able to steal data just two hours after initial access. The advisory links to specific advice for k-12 schools impacted by the ransomware gang. “The threat of ransomware from groups like Akira is real and organizations need to take it seriously, with swift implementation of mitigation measures,” said Nick Andersen, Executive assistant director for the cybersecurity division at the Cybersecurity and Infrastructure Security Agency. The advisory notes that Akira has ties to the now-defunct Conti ransomware gang, which launched several high-profile attacks before disbanding at the onset of Russia’s invasion of Ukraine. On a call with reporters, Andersen confirmed that Akira “may have some connections to the now defunct Conti ransomware group” but declined to say if Akira had ties to the government of Russia. The FBI’s Leatherman added that while there are no direct ties between Akira and the Russian state, they do know that the “Conti ransomware group at one point did operate within Russia and some actors may be associated with that group.” “But like with any ransomware group or variant that operates as an affiliate based program, you can have actors located anywhere across the globe. So we do believe that we likely have actors who are in a variety of different countries,” Leatherman told Recorded Future News. Researchers previously said there are deep similarities between the Akira and Conti ransomware strains. Blockchain analysis showed multiple Akira ransomware transactions to wallets associated with Conti's leadership team. Akira most recently took credit for a cyberattack on BK Technologies, a Florida-based company that makes radios for U.S. defense companies, as well as dozens of police and fire departments across the country. BK Technologies warned investors last month that it suffered a security incident in September where hackers stole non-public information and data on current and former employees. Akira has taken credit for dozens of high-profile attacks on entities like Stanford University, the Toronto Zoo, a state-owned bank in South Africa, major foreign exchange broker London Capital Group and other organizations. Jonathan Greig is a Breaking News Reporter at Recorded Future News. Jonathan has worked across the globe as a journalist since 2014. Before moving back to New York City, he worked for news outlets in South Africa, Jordan and Cambodia. He previously covered cybersecurity at ZDNet and TechRepublic.

Update August 05, 03:12 EDT: Cybersecurity company Huntress confirmed Arctic Wolf's findings on Monday and published a report providing indicators of compromise (IOCs) collected while investigating this campaign. Further details are available in this Reddit thread. SonicWall firewall devices have been increasingly targeted since late July in a surge of Akira ransomware attacks, potentially exploiting a previously unknown security vulnerability, according to cybersecurity company Arctic Wolf. Akira emerged in March 2023 and quickly claimed many victims worldwide across various industries. Over the last two years, Akira has added over 300 organizations to its dark web leak portal and claimed responsibility for multiple high-profile victims, including Nissan (Oceania and Australia), Hitachi, and Stanford University. The FBI says the Akira ransomware gang has collected over $42 million in ransom payments as of April 2024 from more than 250 victims. As Arctic Wolf Labs observed, multiple ransomware intrusions involved unauthorized access through SonicWall SSL VPN connections, starting on July 15. However, while a zero-day vulnerability being exploited in these attacks is very likely, Arctic Wolf has not ruled out credential-based attacks. "The initial access methods have not yet been confirmed in this campaign," the Arctic Wolf Labs researchers cautioned. "While the existence of a zero-day vulnerability is highly plausible, credential access through brute force, dictionary attacks, and credential stuffing have not yet been definitively ruled out in all cases." Throughout this surge in ransomware activity, attackers quickly transitioned from initial network access via SSL VPN accounts to data encryption, a pattern consistent with similar attacks detected since at least October 2024, indicating a sustained campaign targeting SonicWall devices. Additionally, Arctic Wolf noted the ransomware operators were observed using virtual private server hosting for VPN authentication, while legitimate VPN connections typically originate from broadband internet service providers. The security researchers are still investigating the attack methods used in this campaign and will provide additional information to defenders as soon as it becomes available. Due to the strong possibility of a SonicWall zero-day vulnerability being exploited in the wild, Arctic Wolf advised administrators to temporarily disable SonicWall SSL VPN services. Additionally, they should implement further security measures, such as enhanced logging, endpoint monitoring, and blocking VPN authentication from hosting-related network providers, until patches become available. Admins advised to secure SMA 100 appliances Arctic Wolf's report comes one week after SonicWall warned customers to patch their SMA 100 appliances against a critical security vulnerability (CVE-2025-40599) that may be exploited to gain remote code execution on unpatched devices. As the company explained, while attackers would need admin privileges for CVE-2025-40599 exploitation, and there is no evidence that this vulnerability is being actively exploited, it still urged administrators to secure their SMA 100 appliances, as they're already being targeted in attacks using compromised credentials to deploy new OVERSTEP rootkit malware according to Google Threat Intelligence Group (GTIG) researchers. SonicWall also 'strongly' advised customers with SMA 100 virtual or physical appliances to check for indicators of compromise (IoCs) from GTIG's report, suggesting that admins should review logs for unauthorized access and any suspicious activity and contact SonicWall Support immediately if they find any evidence of compromise. A SonicWall spokesperson was not immediately available for comment when contacted by BleepingComputer earlier today. Overall prevention scores can hide what happens after initial access. Once attackers are using valid credentials, prevention drops sharply. The Blue Report 2026 measures defenses technique by technique across 338 million simulations run in customer production environments. Get the report

Over a year after SonicWall patched CVE-2024-40766, a critical flaw in its next-gen firewalls, ransomware attackers are still gaining a foothold in organizations by exploiting it. Like last September and earlier this year, the attackers are affiliates of the Akira ransomware-as-a-service outfit. The July 2025 surge in attacks was, according to SonicWall, facilitated by the fact that organizations has migrated from Gen 6 to Gen 7 firewalls but did not reset local user passwords (as … More → The post Akira ransomware affiliates continue breaching organizations via SonicWall firewalls appeared first on Help Net Security .

Akira ransomware: From SonicWall VPN login to encryption in under four hours Four hours or less: that’s how long it takes for Akira affiliates to break into organizations and deploy the ransomware on their systems, Arctic Wolf researchers have warned. Armed with SonicWall SSL VPN credentials stolen in earlier intrusions and apparently able to bypass multi-factor authentication (MFA), the attackers: Start to scan the network to discover network services and unsecured accounts Use Impacket to set up and interact with SMB sessions Use RDP for lateral movement through compromised environments Find their way to a Domain Controller and gain access to virtual machine storage and backups Create additional accounts (including domain accounts) to install RMM tools and for data exfiltration Establish a C2 method Collect and exfiltrate data Disable legitimate RMM tools and EDR tools, delete System Volume Shadow Service copies, clear event logs Install WinRAR to archive data that will be exfiltrated via rclone or FileZilla to a virtual private server (VPS) they control Deploy the Akira ransomware. Initial access Arctic Wolf has been warning about the increase of Akira ransomware attacks since July 2025. At first, it appeared the attackers might be exploiting a zero-day in SonicWall VPN devices, but it was later confirmed they were abusing CVE-2024-40766, an improper access control flaw in SonicWall SonicOS management access and SSL VPN. A fix for CVE-2024-40766 was released by SonicWall in August 2024 but, according to the company, some customers have upgraded from Gen 6 to Gen 7 firewalls without resetting passwords for local user accounts with SSL VPN access. The prevailing theory is that these actors harvested SSL VPN and privileged service account credentials months earlier during quieter intrusions. They are now reusing those credentials to breach organizations that may have patched or upgraded, but never rotated local user passwords. Rapid7 researchers have also suggested that attackers are exploiting additional weaknesses, including: A misconfiguration in SonicWall devices’ SSLVPN Default Users Group setting, which automatically adds every successfully authenticated LDAP user to a predefined local group that may have access to sensitive services Externally accessible Virtual Office Portal inside the SonicOS management interface, which allows them to configure one-time password (OTP) multi-factor authentication on compromised accounts. “In our investigation, we observed repeated malicious SSL VPN logins on accounts with OTP MFA enabled, ruling out scratch code usage in those cases. We also found no signs of malicious use of the compromised accounts prior to SSL VPN login (event ID 1080), nor did we observe unauthorized OTP unbinding events or other malicious configuration changes (event ID 1382) in the five days leading up to the intrusions,” Arctic Wolf researchers noted. “Taken together, the evidence points to the use of valid credentials rather than modification of OTP configuration, though the exact method of authenticating against MFA-enabled accounts remains unclear.” So far, there’s no indication that these intrusions and the attack against SonicWall’s cloud backup service for firewalls are related. Advice for organizations Victim organizations span multiple industries and vary in size, which points to the attacks being opportunistic rather than targeted. The extraordinarily short time between initial access and ransomware deployment means that early detection and response are crucial. The researchers advise organizations to: Monitor for or, if possible, block logins from VPS hosting providers Monitor for anomalous SMB activity that points to Impacket use and for LDAP discovery activity Monitor for execution of network scanning tools and archival tools from unusual locations on servers Use App Control for Business to block unauthorized remote tools, deny execution from untrusted paths, etc. “If your SonicWall devices have previously run firmware versions vulnerable to CVE-2024-40766, we strongly recommend resetting all credentials stored on the firewall, including SSL VPN passwords and OTP MFA secrets,” Arctic Wolf researchers added. “This includes both local firewall accounts and LDAP-synchronised Active Directory accounts, especially where accounts have access to SSL VPN. Threat actors are abusing these credentials even when devices are fully patched, suggesting that credential theft may have occurred earlier in the lifecycle. Resetting LDAP synchronisation accounts is especially critical, as we have observed logins against these accounts despite them not being intended for VPN access.” Subscribe to our breaking news e-mail alert to never miss out on the latest breaches, vulnerabilities and cybersecurity threats. Subscribe here!