Cybercriminals Target SonicWall Firewalls to Deploy Akira Ransomware via Malicious Login Attempts

Security teams are addressing a rapidly evolving threat that exploits compromised SonicWall SSL VPN credentials to deploy Akira ransomware within four hours. This represents one of the shortest dwell times recorded for such threats.

Immediately after successful authentication, typically from hosting-related Autonomous System Numbers (ASNs), attackers conduct port scans, use Impacket SMB tools for reconnaissance, and deploy Akira ransomware across diverse environments.

Targets include small to large organizations across various sectors, suggesting a broad-spectrum exploitation approach. New malicious infrastructure associated with this campaign was observed as recently as September 20, 2025.

SonicWall attributes the unauthorized logins to the exploitation of CVE-2024-40766, an improper access control flaw disclosed in September 2024.

In late July 2025, Arctic Wolf Labs identified an increase in suspicious login attempts against SonicWall SSL VPN services.

Compromised credentials from vulnerable devices appear to remain effective even on patched firewalls, allowing attackers to bypass one-time-password (OTP) multi-factor authentication and access MFA-protected accounts.

SonicWall confirmed in August 2025 that MFA seeds could be brute-forced or obtained offline, facilitating legitimate-seeming logins without indicating MFA unbinding or configuration tampering.

Initial access is often gained through SSL VPN client logins from virtual private server infrastructure, rather than expected broadband or SD-WAN origins.

Malicious SSL VPN login activity spaced out over consistent intervals.

Some incidents involved LDAP synchronizing accounts, not intended for remote VPN access, successfully authenticating and quickly progressing to internal network reconnaissance.

Tools like Advanced IP Scanner and SoftPerfect Network Scanner, executed from temporary directories, were followed by Impacket-style SMBv2 session setup requests targeting RPC, NetBIOS, SMB, and SQL ports.

Active Directory enumeration exploited built-in utilities (nltest, dsquery) and PowerShell cmdlets (Get-ADUser, Get-ADComputer) to gather user, computer, and share information.

In several cases, attackers used SQLCMD and custom PowerShell scripts to extract backup credentials from Veeam Backup & Replication databases, targeting both MSSQL and PostgreSQL instances.

The Get-EncryptionSalt PowerShell function retrieves the encryption salt from the file system.

Extracted credentials facilitated the creation of local and domain accounts, installation of remote-access tools (AnyDesk, TeamViewer, RustDesk), and the establishment of SSH reverse tunnels or Cloudflare Tunnel services for persistent access.

To avoid detection, attackers disabled legitimate RMM software, deleted Volume Shadow Copy snapshots, and used registry modifications to disable User Account Control.

Techniques involving vulnerable drivers repackaged Microsoft’s consent.exe to load malicious DLLs that manipulated kernel ACLs, disabling security processes like MsMpEng.exe without generating alerts. Geofencing logic within the malicious DLLs excluded Eastern European locales, suggesting targeted intent.

Data staging involved using WinRAR to package recent files into 3 GB chunks, followed by exfiltration via rclone or FileZilla SFTP to attacker-controlled VPS servers.

The Akira encryptor binaries, named akira.exe, locker.exe, or w.exe, were then executed, encrypting drives and network shares within hours. In some cases, encryption began as quickly as 55 minutes after initial access.

Reset all SSL VPN and LDAP-synchronized credentials on devices that have run firmware vulnerable to CVE-2024-40766, including OTP seeds. Block or monitor VPN logins from hosting ASNs and anonymization services. Implement network-based detection for Impacket-style SMBv2 session setups. Enforce application control to prevent execution from temporary and user-writable directories. Restrict VPN authentication to centralized identity providers via SSO/SAML, isolating credential management from firewall appliances. Review MySonicWall cloud backup incident remediation to determine if credential resets are warranted.

Early detection is essential: anomalous VPN login patterns, hosting ASN origins, and unexpected SMB discovery activity offer the best chances to interrupt this campaign before encryption occurs.

Using IRP packets, the malware targets specific security processes (e.g., MsMpEng.exe and SecurityHealthService.exe) and weaponizes Windows Access Control Lists (ACLs) at the kernel level to disable them.

SysInternals DebugView output showing a malicious driver being loaded and ACL tampering to disable security processes.

Organizations should consider credential security for edge devices as critical and recognize that patching alone is insufficient without credential resets and robust monitoring.

Arctic Wolf Labs continues to monitor this threat, collaborating with SonicWall and the security community to enhance detections and prevent further exploitation.

Based on reporting by GBHackers.