Akira Ransomware exploits year
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2024-40766 | Improper Access Control in SonicWall SonicOS Management (Gen 5/6/7 Firewalls) CVE-2024-40766 is an improper access control flaw (CWE-284) in SonicWall SonicOS management access that can allow unauthorized access to protected resources and, under specific conditions, crash the affected firewall. It is network-exploitable without privileges or user interaction per its CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) and affects Gen 5 and Gen 6 appliances as well as Gen 7 devices running SonicOS 7.0.1-5035 or older. A successful attacker gains unauthorized access to resources behind or on the appliance and can potentially take the firewall offline, creating opportunities for follow-on attacks such as VPN account compromise and ransomware deployment. The flaw was added to CISA's Known Exploited Vulnerabilities catalog on 2024-09-09 with known ransomware use, and recent reporting ties Akira ransomware activity — including MFA bypass on SonicWall VPNs affecting over 100 accounts — to this legacy bug combined with password reuse. No public PoC is known, but EPSS assigns an ~18.2% probability of exploitation within 30 days (97th percentile). Do: Upgrade Gen 7 appliances to SonicOS 7.0.1-5037 or later (the fixed release beyond the affected 7.0.1-5035) and move Gen 5/6 devices to the latest SonicOS release SonicWall supports for those generations; per CISA KEV guidance, apply vendor mitigations or discontinue use if patching is not possible. Restrict WAN-side management and SSLVPN access to trusted sources, audit VPN accounts for password reuse, rotate credentials and any locally stored recovery codes, and review logs for signs of Akira-related compromise such as MFA bypass or disabled EDR agents. | 9.8 | 18% | KEV ransomware |
| mass≈100,000–500,000 internet-exposed SonicWall firewalls/SSLVPN endpoints (installed base of 1M+ appliances) |
Full article535 words · extracted from securityaffairs.com · click to collapse
Pierluigi Paganini
September 11, 2025
Researchers warn that Akira ransomware group is exploiting a year-old SonicWall firewall flaw, likely using three attack vectors for initial access.
The Akira ransomware group is exploiting a year-old SonicWall firewall vulnerability, tracked as CVE-2024-40766 (CVSS score of 9.3), likely using three attack vectors for initial access, according to Rapid7.
“Evidence collected during Rapid7’s investigations suggests that the Akira group is potentially utilizing a combination of all three of these security risks to gain unauthorized access and conduct ransomware operations.” reads the report published by Rapid7.
The vulnerability is an improper access control issue that resides in the SonicWall SonicOS management access. An attacker can exploit the issue to achieve unauthorized access to the devices.
SonicWall addressed the critical flaw in its firewalls in August 2024, and the US CISA added it to its Known Exploited Vulnerabilities (KEV) catalog in September 2024.
In August 2025, SonicWall investigated claims of a zero-day being used in ransomware attacks but found no evidence of any new vulnerability in its products.
SonicWall launched the investigation after a surge in Akira ransomware attacks targeting Gen 7 firewalls with SSLVPN enabled. The company worked to determine if the incidents stem from an existing flaw or a newly discovered vulnerability.
SonicWall later confirmed that there’s no zero-day involved in recent ransomware attacks, but rather the exploitation of a known flaw, CVE-2024-40766. While many systems have since been patched, attackers can still access them if credentials weren’t changed. Fewer than 40 related incidents are under investigation by SonicWall, mostly tied to firewall migrations.
“We now have high confidence that the recent SSLVPN activity is not connected to a zero-day vulnerability. Instead, there is a significant correlation with threat activity related to CVE-2024-40766, which was previously disclosed and documented in our public advisory SNWLID-2024-0015.” reads the advisory published by the security vendor.
“We are currently investigating less than 40 incidents related to this cyber activity. Many of the incidents relate to migrations from Gen 6 to Gen 7 firewalls, where local user passwords were carried over during the migration and not reset. Resetting passwords was a critical step outlined in the original advisory. “
SonicWall issued new guidance on the SSLVPN Default Users Group risk, which may grant unauthorized access in certain LDAP setups. Rapid7 also found threat actors abusing the Virtual Office Portal to configure MFA/TOTP with exposed credentials. Evidence suggests Akira ransomware is exploiting a mix of these flaws for attacks.
“Evidence collected during Rapid7’s investigations suggests that the Akira group is potentially utilizing a combination of all three of these security risks to gain unauthorized access and conduct ransomware operations.” continues the report.
Rapid7 urges SonicWall users to secure accounts, enable MFA, fix SSLVPN Default Groups risk, restrict and monitor the Virtual Office Portal, and apply security patches.
The Akira ransomware has been active since March 2023, the threat actors behind the malware claim to have already hacked multiple organizations in multiple industries, including education, finance, and real estate. Like other ransomware gangs, the group has developed a Linux encryptor to target VMware ESXi servers.
Follow me on Twitter: @securityaffairs and Facebook and Mastodon
(SecurityAffairs – hacking, Akira ransomware)
Text extracted automatically; images, tables and formatting may be missing. Original: https://securityaffairs.com/182112/cyber-crime/akira-ransomware-exploits-year-old-sonicwall-flaw-with-multiple-vectors.html