Arctic Wolf Observes Akira Ransomware Campaign Targeting SonicWall SSLVPN Accounts

A remote code execution vulnerability (CVE-2024-40766) in SonicOS was disclosed and later advisory updates indicated potential active exploitation; Arctic Wolf observed Akira ransomware affiliates gaining initial access by compromising locally-managed SSLVPN accounts on vulnerable SonicWall devices (with MFA disabled). The report lists affected device families and fixed firmware versions and strongly recommends immediate SonicOS updates, resetting local SSLVPN passwords, enabling MFA, and restricting WAN/SSLVPN access as mitigations.