Akira exploitation of SonicWall SSL VPN flaw CVE-2024-40766

The **Akira ransomware group** is associated with a continuing **SonicWall SSL VPN** initial-access campaign that uses **CVE-2024-40766** and related credential abuse to breach victim networks. A newer victim-impact update shows **Marquis Software Solutions** was hit by a **ransomware attack on August 14, 2025** through a **SonicWall firewall**, exposing files with personal information for customers of **74 banks and credit unions** and affecting **over 400,000 customers**. Marquis says there is **no evidence** the data has been misused or published, while the breach details reinforce the campaign’s focus on **SonicWall VPN** access and post-compromise theft.

In late September, **Arctic Wolf** reported an ongoing **Akira** campaign against **SonicWall** firewalls and **SSL VPN** accounts that could log in even when **OTP MFA** was enabled, with activity tied to **CVE-2024-40766** and likely involving reused credentials or stolen OTP seeds. After access, the actors reportedly moved quickly into internal reconnaissance, including scans within **5 minutes**, use of **Impacket**, **RDP**, **dsquery**, **SharpShares**, and **BloodHound**, plus attempts to target **Veeam Backup & Replication** and disable defenses with a **BYOVD** chain. On **October 11, 2025**, **Huntress** said the same broad abuse pattern had affected **more than 100 accounts** across **16 customer environments**, with logins from **202.155.8[.]73** and signs of valid-credential use. Huntress also said SonicWall’s separate backup-file exposure in **MySonicWall** had no evidence linking it to the recent compromise spike.

An **Akira ransomware**-linked **exploitation wave** is driving a **widespread compromise** of **SonicWall SSL VPN devices** for initial access, with attacks using **CVE-2024-40766** and, in some cases, rapidly moving from login activity to **network scanning** and attempts to access **Windows accounts**. Huntress said the latest activity began on **October 4, 2025** and impacted **more than 100 accounts** across **16 customer environments**, with authentications in its cases originating from **202.155.8[.]73**. SonicWall also disclosed unauthorized exposure of **firewall configuration backup files** in **MySonicWall** accounts, but Huntress said there is **no evidence yet** linking that incident to the spike in compromises.

**CVE-2024-40766** is a **SonicWall SSL VPN** access control flaw that has been **actively exploited** to breach exposed devices, with **Akira ransomware** tied to the campaign. Recent reporting says attackers used **malicious SSL VPN logins** and, in some cases, were able to bypass or abuse **OTP MFA**, then move to **port scanning**, **Impacket SMB activity**, and rapid ransomware deployment. The campaign has been observed across multiple victims and has remained active since **mid-2024**, with new infrastructure and incidents continuing into **2025**.