Akira exploitation of SonicWall SSL VPN flaw CVE-2024-40766

The **Akira ransomware group** is associated with a continuing **SonicWall SSL VPN** initial-access campaign that uses **CVE-2024-40766** and related credential abuse to breach victim networks. A newer victim-impact update shows **Marquis Software Solutions** was hit by a **ransomware attack on August 14, 2025** through a **SonicWall firewall**, exposing files with personal information for customers of **74 banks and credit unions** and affecting **over 400,000 customers**. Marquis says there is **no evidence** the data has been misused or published, while the breach details reinforce the campaign’s focus on **SonicWall VPN** access and post-compromise theft.

**Akira-affiliated** actors are causing **widespread compromise** of **SonicWall SSL VPN devices**, with Huntress reporting activity that began on **October 4, 2025** and impacted **more than 100 accounts** across **16 customer environments**. The observed logins appear to use **valid credentials** rather than brute force, and some intrusions included **network scanning** and attempts to access **local Windows accounts**. Huntress said authentications on the compromised devices came from **202.155.8[.]73**. The disclosure follows SonicWall's report of unauthorized exposure of **firewall configuration backup files** in **MySonicWall** accounts, but Huntress said there is **no evidence** linking that exposure to the recent spike in compromises.

An **Akira ransomware**-linked **exploitation wave** is driving a **widespread compromise** of **SonicWall SSL VPN devices** for initial access, with attacks using **CVE-2024-40766** and, in some cases, rapidly moving from login activity to **network scanning** and attempts to access **Windows accounts**. Huntress said the latest activity began on **October 4, 2025** and impacted **more than 100 accounts** across **16 customer environments**, with authentications in its cases originating from **202.155.8[.]73**. SonicWall also disclosed unauthorized exposure of **firewall configuration backup files** in **MySonicWall** accounts, but Huntress said there is **no evidence yet** linking that incident to the spike in compromises.

**CVE-2024-40766** is a **SonicWall SSL VPN** access control flaw that has been **actively exploited** to breach exposed devices, with **Akira ransomware** tied to the campaign. Recent reporting says attackers used **malicious SSL VPN logins** and, in some cases, were able to bypass or abuse **OTP MFA**, then move to **port scanning**, **Impacket SMB activity**, and rapid ransomware deployment. The campaign has been observed across multiple victims and has remained active since **mid-2024**, with new infrastructure and incidents continuing into **2025**.