Fog ransomware targets SonicWall VPNs to breach corporate networks

Arctic Wolf and other researchers observed at least ~30 intrusions where Akira and Fog ransomware actors exploited SonicWall SSL VPN accounts—likely via CVE-2024-40766—gaining access to unpatched endpoints (often without MFA and on default port 4433) and performing rapid VM/backup encryption and data theft; researchers also report shared infrastructure between groups and a large number of internet-exposed vulnerable SonicWall endpoints.