Akira SonicWall SSL VPN Attacks

Starting in late July 2025, attackers broke into SonicWall Gen 7 firewalls through their SSL VPNs, in some cases getting past multifactor authentication, and some deployed Akira ransomware soon after. Researchers first suspected a zero day. By late September, Arctic Wolf said the attackers were most likely using credentials stolen earlier through CVE-2024-40766, an access-control bug in SonicOS, and that the Akira campaign was still growing.