September 2025 Update on Aggressive Ongoing Akira Ransomware Campaign

Since late July 2025, Arctic Wolf has tracked an increase in Akira ransomware activity targeting SonicWall SSL VPN accounts. This campaign remains active and continues to evolve, with new infrastructure tied to it observed as recently as September 20, 2025. 

Threat actors affiliated with Akira ransomware have been known to target VPN infrastructure as an initial access vector in previous campaigns against other firewall devices, and has exploited vulnerabilities such as CVE-2023-20269 in Cisco ASA and CVE-2020-3259 in Cisco AnyConnect. 

These are the key elements of the latest Akira ransomware campaign targeting SonicWall devices: 

• Credential Use: Threat actors are accessing SSL VPN accounts through credentials likely to have been previously exfiltrated with CVE-2024-40766, including accounts with OTP MFA enabled. 

• Extraordinarily short dwell time: In dozens of recent intrusions, attackers moved from credential access to lateral movement, exfiltration, and encryption in under four hours—with some as fast as 55 minutes. 

• Infrastructure changes: Threat actors are rotating VPS-based client infrastructure, attempting to evade detection. 

• Widespread impact: Victims span multiple industries and organization sizes, indicating opportunistic mass exploitation rather than targeted intrusions. 

SonicWall has indicated that this campaign is likely related to past exploitation of CVE-2024-40766. From this perspective, devices that would have previously run firmware versions vulnerable to the vulnerability may have been silently exploited, with follow-on credential use taking place at a later time. Arctic Wolf has detection coverage through our Managed Detection and Response Platform for key aspects of this campaign, including tracking of hosting-related VPN logins and Impacket SMB activity. 

Additionally, SonicWall recently disclosed an incident involving the MySonicWall cloud backup service. While SonicWall has stated the incident was not a ransomware event, the full extent of this breach may not yet be fully known. At this time, there is no evidence linking the MySonicWall cloud backup file incident to the Akira ransomware campaign described here. 

Arctic Wolf will continue to publish updates as this campaign evolves. A full threat research blog with additional technical details will be published today, and will be available from the following page: https://arcticwolf.com/resources/tag/threat-research/ 

Recommendations

Reset SSL VPN and Active Directory Credentials

If your SonicWall devices have previously run firmware versions vulnerable to CVE-2024-40766, we strongly recommend resetting all credentials stored on the firewall, including SSL VPN passwords and OTP MFA secrets. This includes both local firewall accounts and LDAP-synchronized Active Directory accounts, especially where accounts have access to SSL VPN. Threat actors are abusing these credentials even when devices are fully patched, suggesting that credential theft may have occurred earlier in the lifecycle. 

Resetting LDAP synchronization accounts is especially critical, as we have observed logins against these accounts despite them not being intended for VPN access. 

Review and Implement SonicWall’s Recommendations

In addition to resetting credentials, SonicWall has provided specific recommendations to customers who have imported configurations from Gen 6 to newer firewalls: 

• Update to the latest firmware version 7.3.0 by following the firmware update guide. 

• Enable Security Services: Ensure services such as Botnet Protection are active. These services help detect threat actors known to target SSLVPN endpoints. 

• Enforce Multi-Factor Authentication (MFA): MFA should be enabled for all remote access to reduce the risk of credential abuse. 

• Remove Unused Accounts: Delete any inactive or unused local firewall user accounts, particularly those with SSLVPN access. 

• Practice Good Password Hygiene: Encourage periodic password updates across all user accounts. 

SonicWall will continue to update their product notice page with further developments in this campaign. 

Block VPN Access to Malicious IPs and Hosting-Related ASNs

Initial access in this campaign is predominately tied to logins from VPS hosting providers. Legitimate business VPN logins typically originate from broadband or SD-WAN providers, not VPS hosting infrastructure. Arctic Wolf is monitoring for new logins from a selection of network providers associated with this campaign. 

Where possible, these IP addresses and ASNs can be blocked outright at the firewall level for SSL VPN logins on SonicWall or other firewall devices. 

Below is an updated table of infrastructure associated with this campaign. Blocking VPN logins from these client IP addresses and ASNs reduces exposure to opportunistic exploitation, regardless of the firewall model being targeted. 

Update to SonicOS 7.3.0 and Follow SonicWall Guidance

While intrusions have been observed against even the latest firmware, SonicWall has introduced brute-force and MFA hardening in SonicOS 7.3.0. Updating remains a best practice and aligns with SonicWall’s most recent guidance. 

Where possible, enforce MFA for all remote access, remove unused accounts, and ensure that security services like Botnet Protection are active. 

Deploy Arctic Wolf Agent & Sysmon

The Arctic Wolf Agent with Sysmon provides the endpoint and network visibility required to detect lateral movement, credential access, and ransomware staging activities. If not already deployed, we strongly recommend doing so across all domain controllers, file servers, and internet-facing systems. 

• For instructions on how to install Arctic Wolf Agent, see the below install guides: 

• Agent Installation on Windows 

• Agent Installation on Linux 

• Sysmon Installation on Windows 

• If you have a supported EDR solution deployed in your environment, please configure it for monitoring with Arctic Wolf. 

• Endpoint Detection and Response Integrations 

Note: Arctic Wolf recommends following change management best practices for deploying Agent and Sysmon, including testing changes in a testing environment before deploying to production. 

Configure SonicWall Integration with Arctic Wolf MDR

To provide early visibility and alerting for the threats described in this bulletin, Arctic Wolf customers can enable SonicWall log monitoring through the Managed Detection and Response service. To configure this integration, see the following documentation page: https://docs.arcticwolf.com/bundle/m_syslog/page/configure_sonicwall_to_send_logs_to_arctic_wolf.html 

References 

• SonicWall August 2025 product notice on CVE-2024-40766

• SonicWall CVE-2024-40766 advisory

• SonicWall MySonicWall Cloud Backup File incident

• SonicWall credential reset knowledge base article

• SonicWall SonicOS 7.3 and 8.0.3 security updates