September 2025 Update on Aggressive Ongoing Akira Ransomware Campaign

Arctic Wolf warns of an active Akira ransomware campaign targeting SonicWall SSL VPN accounts, leveraging previously exfiltrated credentials (linked to CVE-2024-40766) to gain access and rapidly move to lateral movement, exfiltration, and encryption—sometimes within an hour. The advisory includes numerous VPN client IP and ASN indicators, notes infrastructure rotation by the actors, and provides mitigation guidance such as resetting VPN and AD credentials, enforcing MFA, updating SonicOS, blocking hosting-related IPs/ASNs, and deploying endpoint telemetry (Arctic Wolf Agent and Sysmon).