Akira Defeats MFA for SonicWall SSL VPNs

Attackers wielding Akira ransomware appear to be amassing victims by hacking into SonicWall SSL VPN servers, sidestepping multifactor authentication controls.

See Also: On Demand | Ransomware in 2025: Evolving Threats, Exploited Vulnerabilities, and a Unified Defense Strategy

Cybersecurity firm Arctic Wolf said it’s been tracking the “malicious SSL VPN logins” being used against organizations of varying size and across multiple sectors, “suggesting opportunistic, mass exploitation.”

The campaign began July 21 although “recently escalated, with new infrastructure linked to it observed as late as Sept. 20,” and has compromised at least NSA and TZ series devices running various versions of SonicOS 6 and 7, including the latest version 7.3.0 firmware.

The attacks often move quickly, progressing from unauthorized access, to data exfiltration, to ransomware being used to crypto-lock endpoints, in 60 minutes or less. “Malicious logins were followed within minutes by port scanning, Impacket SMB activity and rapid deployment of Akira ransomware,” Arctic Wolf said.

How attackers are able to bypass multifactor authentication on SonicWall SSL VPNs is unknown. SonicWall didn’t immediately respond to a request for comment. Evidence suggest hackers stole valid credentials, but “the exact method of authenticating against MFA-enabled accounts remains unclear,” Artic Wolf said.

Signs of an attack include unusual types of VPN logins, network scanning – often within five minutes of gaining access – as well as abusing server message block protocol and enumerating Active Directory objects.

Many attacks trace to VPN client logins originating from virtual private server hosting providers, researchers said. “While legitimate logins typically originate from broadband, SD-WAN or SASE service providers, logins from VPS infrastructure are far less likely to be benign,” they said. “In some intrusions, malicious access also originated from privacy VPNs, though this was less common.”

Attackers targeted firewall accounts as well as LDAP-synchronized accounts. “In several intrusions the dedicated account used for Active Directory synchronization was observed logging in via SSL VPN, despite not being intentionally configured for such access,” Arctic Wolf said. “In over half of the intrusions analyzed, we observed login attempts against accounts with the one time password feature enabled,” which gets implemented and configured using SonicOS.

For abusing the SMB protocol, researchers said attackers appear to favor Impacket SMB, an open-source, Python toolkit designed for network penetration that’s been long used by nation-state groups and cybercrime gangs to exploit a victim’s network. It enables attackers to move laterally inside a victim’s network and deploy malicious payloads.

The toolkit includes scripts such as SMBExec, which “creates a semi-interactive shell process that can start services on a remote device,” said ExtraHop Networks. Such attack activity can be very difficult to detect because resulting “commands are hidden in Windows service requests.”

Monitoring for SMB session setup requests consistent with Impacket “provides an early kill chain detection for discovery activity related to this campaign,” Arctic Wolf said. The firm also recommends blocking VPN connection requests that originate from VPS hosting providers or anonymization sources, and consider implementing geo-blocking to stop access attempts from any region where it doesn’t do business.

The firm said it saw no intrusions tied to accounts that use SSO/SAML for VPN authentication. “This suggests that separating identity management from firewall appliances can reduce risk and should be considered as a hardening strategy,” it said.

Multiple Security Alerts

Arctic Wolf’s alert follows a flurry of warnings about other campaigns targeting SonicWall SSL VPNs or firewalls.

In June, SonicWall and Microsoft Threat Intelligence warned that attackers created a network of fake websites designed to impersonate legitimate SonicWall sites for downloading an attacker-modified version of the NetExtender VPN installation package.

“The backdoored NetExtender client installer is digitally signed and actually works, but it sends the user’s credentials to a threat-actor-controlled server once a VPN connection is established to the enterprise network,” enabling them to gain surreptitious access to the victim’s network, said Charles Carmakal, CTO of Google Cloud’s Mandiant Consulting group.

SonicWall and Microsoft said they quickly took down the fake websites and revoked the digital certificate being used by the malicious installer.

In July, Google warned that a threat group it tracks as UNC6148 in October 2024 began deploying a previously unseen rootkit tracked as Overstep to provide backdoor access to fully patched but end-of-life SonicWall Secure Mobile Access 100 series appliances. Google said the attack group appeared to be tied to previous SonicWall targeting from late 2023 and early 2024, which in some cases led to the deployment of Abyss ransomware.

Google said the attackers exploited a vulnerability tracked as CVE-2024-38475 for patch traversal and session hacking, which SonicWall first patched in December 2024.

Attackers have targeted organizations that use SonicWall SSL VPN servers, using previously stolen credentials. In August, SonicWall warned all customers using Gen 7 firewalls to immediately update to version 7.3.0, and said if they carried over any local user accounts with SSL VPN access from previous versions of Gen 6 or Gen 7, they should immediately reset those passwords.

Cybersecurity firm Field Effect reported at the time that while attackers were largely targeting Gen 7 firewalls, “we have one confirmed case involving the Gen 8 SonicWall NSa 3800 running SonicOS 8.0.2.”

SonicWall said that rather than a zero-day, attackers appeared to be exploiting CVE-2024-40766, an improper access control vulnerability present in Gen 5, Gen 6 and earlier Gen 7 devices running SonicOS firmware, to harvest users’ passwords, for customers that didn’t follow all of its mitigation advice.

As a result of the campaign, “we are observing increased threat activity from actors attempting to brute-force user credentials,” SonicWall said at the time.

Attackers Mix Tactics

Earlier this month, cybersecurity firm Rapid7 warned that Akira-wielding attackers appeared to be using a combination of up to three tactics to gain unauthorized access to SonicWall SSL VPN servers, including targeting organizations that didn’t fully mitigate CVE-2024-40766.

The second tactic was targeting a vulnerability involving the SonicWall default users group. The risk traces to some default LDAP group configurations providing excess access rights to SonicWall’s SSL VPN services. “This can allow users who are not permitted to SSL VPN to successfully obtain access to the SSL VPN irrespective of Active Directory configurations,” Rapid7 said.

The third tactic involves targeting SonicWall appliances’ Virtual Office Portal, which can be used to configure time-based, one-time passwords for SSL VPN users. “The Virtual Office Portal in certain default configurations allows public access to the portal, which can allow threat actors to configure MFA/TOTP with valid accounts if there is a prior username and password credential exposure,” Rapid7 said.

Separately, SonicWall on Sept. 17 issued a security alert to all customers that enabled MySonicWall.com cloud backups, warning that attackers may have stolen their firewall preference files. “These files may supply threat actors with critical information, such as credentials or tokens, as well as all the services and configurations of the firewall,” said Rapid7.

SonicWall said about 5% of its customers enable MySonicWall.com cloud backups. Ryan Dewhurst, head of proactive threat intelligence at watchTowr, warned that the backups would be “a treasure trove for anyone with malicious intent: firewall rules, VPN configs, admin accounts and authentication secrets – basically perfect reconnaissance material.”

Arctic Wolf said the Akira-wielding attackers behind the ongoing campaign that uses malicious logins to SSL VPN servers might also be tapping, when available, some of the preceding vulnerabilities.