SonicWall urges customers to take VPN devices offline after ransomware campaign

### Executive summary Multiple incident response firms have observed a wave of intrusions targeting SonicWall Gen 7 SSL VPN appliances that appear to leverage a likely zero-day to gain access and deploy Akira ransomware; roughly 20–40 incidents were reported with evidence of MFA bypass, credential theft, lateral movement, and ransomware deployment, and SonicWall is investigating while advising customers to disable SSL VPN until mitigations or patches are available.