Active Exploitation of SonicWall VPNs

**TL;DR:** Huntress observed a cluster of active attacks against SonicWall 7th‑generation SSL VPN appliances (suspected CVE-2024-40766 correlation) where attackers gained access, moved quickly to harvest credentials and domain data, disabled defenses and event logs, and deployed Akira ransomware; the report includes detailed TTPs, IoCs (IPs, file paths, hashes, drivers, accounts/passwords), and urgent mitigations (disable/lock down VPN, rotate service account credentials, hunt for indicators).