Sonic Wall SSL VPN Flaw and Misconfigurations Actively Exploited by Akira Ransomware Hackers
Summary: Rapid7 observed a spike in SonicWall appliance intrusions over the past month tied to Akira ransomware activity since late July 2025, involving a year-old SSL VPN flaw (CVE-2024-40766, CVSS 9.3) in which local user passwords were carried over during migration and not reset. Rapid7 said it has responded to a growing number of customer incidents from one or more of three risks - the flaw, LDAP SSL VPN Default User Group misconfigurations, and Virtual Office Portal exposure - now well into the double digits.
Key Takeaway: Akira has claimed 967 victims since March 2023, and Rapid7 describes a standard flow that starts with SSL VPN initial access and ends with ransomware encryption at the hypervisor level - after backups are deleted or stopped.
Read the original at The Hacker News ↗
- Topics
- Identity & Access Management
- Mentions
- CVE-2024-40766
- Related
- CVE-2024-40766: Sonic Wall SonicOS Improper Access Control Vulnerability Known Exploited Vulnerabilities · Sep 09, 2024