Ransomware Threats Target SonicWall Devices

On September 18, 2025, Rapid7, a leading cybersecurity firm, issued a warning about a serious vulnerability in SonicWall devices. The Akira ransomware group is actively taking advantage of this, leaving organizations at risk. This flaw, related to SonicWall’s Gen5, Gen6, and Gen7 firewall appliances, was first discovered in August 2024. Despite being known for over a year, many organizations haven’t tackled the issue, creating an open door for cyberattacks.

Despite SonicWall’s efforts to alert its customers through a security advisory, there remains a gap. Rapid7’s analysis has shown that Akira’s tactics make use of unsecured default settings in the Virtual Office Portal. If attackers get hold of usernames and passwords, they might even enable multi-factor authentication (MFA) themselves—posing a significant security risk.

Securing SonicWall Devices: Essential Steps

There’s a pressing need for organizations using SonicWall devices to enhance their security measures. Rapid7 offers several straightforward yet crucial steps:

• Change all local passwords: Update passwords on all SonicWall systems and prune inactive accounts.
• Enforce multi-factor authentication: Integrate MFA for SSLVPN services following SonicWall’s protocols for improved security.
• Tighten SSLVPN default settings: Address risks associated with default groups by adhering to SonicWall’s guidelines.
• Restrict Virtual Office access: Limit portal access to internal networks, cutting down on unauthorized intrusions.
• Monitor suspicious activities: Keep a keen eye on access attempts, especially on port 4433, to spot any unusual patterns.

Keeping devices updated with the latest firmware and being proactive in security practices are key strategies in defending against threats such as Akira’s ransomware attacks.

Stay vigilant against vulnerabilities in your systems. With Qsentinel, we help businesses secure their networks and protect data from cyber threats. Learn more about our comprehensive security solutions today.

Ready to take data security seriously?

Discover how Qsentinel can protect your organization against ransomware, enforce true data sovereignty, and stay ahead of the quantum threat. Their purpose-built workspace is designed for exactly that.

👉 Check out Qsentinel now and secure your future.