Akira Ransomware Targets SonicWall Devices

A fresh storm of cyberattacks is brewing, targeting SonicWall SSL VPN devices, with the Akira ransomware operators pulling the strings. These orchestrated assaults exploit a vulnerability first identified in 2024, wreaking havoc across global industries since July 2025. The security loophole, cataloged as CVE-2024-40766, affects SonicWall SonicOS devices from Generation 5 to 7, specifically on firmware versions up to 7.0.1-5035.

Despite the vulnerability being publicly disclosed and fixed as of August 2024, Akira affiliates have leveraged it using the Ransomware-as-a-Service (RaaS) model. Notable for its ability to remain a step ahead, this method of attack is particularly concerning.

Inside the Attack

Cybersecurity firm Darktrace observed a complex attack sequence on August 20, 2025, when unusual activities aimed at a United States-based client’s network were detected. The attack began with network reconnaissance, deploying sophisticated scanning tools and DCE-RPC requests at the early hour of 05:10 UTC.

Hackers proceeded with lateral movement tactics through Windows Remote Management (WinRM) connections, identified via the “Ruby WinRM Client” user agent, gaining unauthorized access to domain controllers. These steps enabled a heist of credentials, extracting NTLM hashes via a technique known as “UnPAC the hash” — a crafty manipulation of Kerberos authentication procedures.

Post-breach activities saw the attackers establish command and control channels, with infected machines interacting with external IPs to download harmful files disguised as VMware tools using wget. By 07:00 UTC, they had begun the theft of approximately 2 GB of sensitive data, channeling it through SSH to servers under Akira’s command.

The Race to Defend

In a fortunate turn, Darktrace’s Autonomous Response mechanism aided in promptly severing malicious connections and overseeing critical communications across networks. This system effectively mitigated potential damage by curbing interactions over crucial ports such as Kerberos (88), RDP (3389), and DCE-RPC (49339).

In total, at least three additional attacks with similar methodologies have been identified, focusing on US organizations dependent on SonicWall VPN technology. The persistence in exploiting CVE-2024-40766 serves as a stark reminder for businesses about the importance of rigorous patch management, especially protecting internet-exposed devices critical for enterprise connectivity.

**Stay vigilant and enhance your cybersecurity posture today. [Contact Qsentinel for expert guidance and support in securing your network devices.]**

Ready to take data security seriously?

Discover how Qsentinel can protect your organization against ransomware, enforce true data sovereignty, and stay ahead of the quantum threat. Their purpose-built workspace is designed for exactly that.

👉 Check out Qsentinel now and secure your future.