Arctic Wolf Observes July 2025 Uptick in Akira Ransomware Activity Targeting SonicWall SSL VPN – Copy

Arctic Wolf reports an active campaign involving Akira ransomware that has increased targeting of SonicWall SSLVPNs (observed since July 2025 and instances back to October 2024), possibly tied to exploitation of CVE-2024-40766; the bulletin includes numerous IoCs (IP addresses and ASNs), recommends disabling SSLVPN where possible, rotating credentials, applying SonicOS updates (7.3.0), enabling MFA and security services, and deploying log/agent monitoring to detect and mitigate intrusions.