Akira Ransomware’s Swift Intrusion

New insights from Arctic Wolf has brought the speedy spread of Akira ransomware into the spotlight. These malicious actors can infiltrate and unleash their ransomware within a mere four hours. How do they do it? By exploiting stolen SonicWall SSL VPN credentials from previous breaches, allowing them to dodge multi-factor authentication with ease.

Once inside, the hackers follow a strategic plan:

• They first scan networks for vulnerable services and accounts.
• Connections through SMB sessions are established using Impacket.
• RDP is utilized for moving laterally within the breached networks.
• They focus on Domain Controllers to access virtual machine data and storage resources.
• New domain-privileged accounts are created to ease remote monitoring and data extraction.
• A command and control system is set up for ongoing operations.
• Critical data is extracted while disabling detection tools to remain unnoticed.
• System Volume Shadow Service backups are erased, and event logs are wiped.
• Finally, they employ WinRAR to compress and rclone/FileZilla to transfer data before detonating the Akira ransomware.

Risks and Exploits: What Organizations Need to Know

Since July 2025, a resurgence in Akira ransomware attacks has been linked to a flaw—CVE-2024-40766—in SonicWall’s SonicOS. Despite an existing fix since August 2024, some organizations haven’t reset their account passwords after firewall updates, leaving them vulnerable to attackers already holding these credentials.

Additional vulnerabilities include misconfigured SSL VPN user groups and a compromise-friendly Virtual Office Portal in SonicOS. Attacks have leveraged these weaknesses for unauthorized access, highlighted by repeated SSL VPN logins, indicating credential rather than direct code exploitation.

Though unconnected to past SonicWall cloud backup service breaches, these attack patterns showcase the importance of robust and updated security measures.

Proactive Steps:

• Monitor for logins from atypical sources like VPS hosts.
• Detect suspicious SMB activity, potential signs of Impacket and LDAP discovery misuse.
• Control application permissions tightly to avoid rogue tool execution.

Organizations, especially those leveraging SonicWall solutions, are urged to reset all associated credentials. This includes not just SSL VPN passwords but MFA and Active Directory-linked details. With fully patched devices still vulnerable through weak accounts, vigilance remains crucial.

Stay Updated

Stay informed on the latest cybersecurity threats by subscribing to our updates. It’s crucial to stay ahead of vulnerabilities to protect your digital infrastructure.

Qsentinel Security Alerts: For ongoing updates on cybersecurity, subscribe to Qsentinel’s alerts to safeguard your organization.

Ready to take data security seriously?

Discover how Qsentinel can protect your organization against ransomware, enforce true data sovereignty, and stay ahead of the quantum threat. Their purpose-built workspace is designed for exactly that.

👉 Check out Qsentinel now and secure your future.