Akira ransomware breaching MFA-protected SonicWall VPN accounts

Akira ransomware actors are actively exploiting previously stolen credentials and likely OTP seeds to bypass MFA on SonicWall SSL VPN devices (initially linked to CVE-2024-40766). After access, attackers perform rapid internal reconnaissance, harvest credentials (notably from Veeam Backup & Replication, MSSQL/PostgreSQL and DPAPI secrets), sideload vulnerable drivers via legitimate executables to disable endpoint protection, and deploy ransomware; administrators are urged to reset VPN credentials and install recommended SonicOS firmware.