Escalation of Akira Ransomware Targeting SonicWall Flaw

In a troubling development for cybersecurity experts, the Akira ransomware has been gaining traction since July, with its sights set on SonicWall SSL VPN devices. Findings by Darktrace show that this surge has unmasked alarming network anomalies within a U.S. company. These revelations, including suspicious scanning and data theft, were ultimately traced back to a compromised SonicWall server. This points to Akira’s strategic targeting of existing vulnerabilities, particularly affecting sectors like manufacturing, education, and healthcare across North America, Latin America, Europe, and Asia-Pacific.

Initially believed to stem from an unknown zero-day flaw, SonicWall later assured that the breach was linked to the already known CVE-2024-40766 vulnerability. Detected in August, these suspicious activities included network scanning and movements, leading to the SonicWall VPN breach. Darktrace’s Managed Detection and Response (MDR) service played a crucial role in managing alerts promptly, limiting the damage to a 2 GB data exfiltration.

Evolving Tactics and Ongoing Concerns

Since its debut in March 2023, Akira ransomware has evolved to employ a Ransomware-as-a-Service (RaaS) model, encouraging double extortion to force payment for both data decryption and privacy. The threat landscape expanded as Akira began affecting Linux and VMware ESXi systems, the latter proving particularly troubling due to its prominent role in cloud infrastructures.

The ransomware proliferates by exploiting remote services and known vulnerabilities, supported by reconnaissance, network movements, and administrative tools. Despite the countermeasures, Akira’s group ensures sustained access using advanced tactics like Kerberoasting and credential theft. On August 20, unusual DCE-RPC requests signaled an issue, prompting Darktrace to dissolve the risk using mitigation strategies.

Keeping systems patched to prevent threats from known vulnerabilities is crucial. Despite robust measures, uncovered weaknesses offer ransomware groups opportunities, a notion backed by GuidePoint Research indicating a 57% rise in ransomware factions, even as victim statistics stay flat. Meta data reveals a 56% victim share in the U.S., with industries including manufacturing facing a 26% rise in attacks, stressing an ongoing defense requirement.

Nick Hyatt from GuidePoint Security articulates, “The evolving landscape requires sustained scrutiny,” urging vigilance as actors perpetually adapt to exploit network vulnerabilities.

Staying secure requires vigilance and continuous adaptation. Find out how Qsentinel can help protect your organization from ransomware attacks.

Ready to take data security seriously?

Discover how Qsentinel can protect your organization against ransomware, enforce true data sovereignty, and stay ahead of the quantum threat. Their purpose-built workspace is designed for exactly that.

👉 Check out Qsentinel now and secure your future.