Arctic Wolf Observes Akira Ransomware Campaign Targeting SonicWall SSLVPN Accounts

Arctic Wolf reports CVE-2024-40766, an RCE in SonicOS affecting multiple SonicWall firewall generations; the advisory was later updated indicating potential active exploitation. Arctic Wolf observed Akira ransomware affiliates gaining initial access by compromising locally-managed SSLVPN accounts (with MFA disabled) on vulnerable devices and strongly recommends updating SonicOS to fixed versions, resetting local SSLVPN passwords, enabling MFA, and restricting WAN/SSLVPN management.