Akira Ransomware’s SonicWall Campaign Creates Enterprise M&A Risk

ReliaQuest analyzed Akira ransomware campaigns (June–October 2025) that leveraged unpatched or misconfigured SonicWall SSL VPNs inherited during M&A to gain footholds in acquiring organizations; attackers exploited stale admin credentials, predictable hostnames, and inconsistent EDR to escalate to domain controllers in as little as five hours and deploy ransomware rapidly, with over 70 victims observed in October 2025.