Akira Ransomware Exploits SonicWall Vulnerabilities in Ongoing Campaign

The Akira ransomware group has intensified its exploitation of vulnerabilities in SonicWall's Secure Mobile Access (SMA) 100 series and SSL VPN products, leveraging these flaws to breach networks and deploy ransomware. This campaign has been ongoing since at least mid-2025, with a notable increase in activity observed in recent months. The attackers are exploiting a combination of known vulnerabilities and potential zero-day flaws in SonicWall devices. These vulnerabilities allow the attackers to bypass multi-factor authentication (MFA) protections, gain unauthorized access, and subsequently deploy ransomware within hours of initial access. The exploitation often involves misconfigurations in SSL VPN setups, which the attackers leverage to gain a foothold in targeted networks. The Akira group has been particularly aggressive in targeting organizations across various sectors, including critical infrastructure. They have been observed using stolen credentials and exploiting these vulnerabilities to exfiltrate sensitive data before encrypting systems. This dual approach not only disrupts operations but also increases pressure on victims to pay ransoms to prevent data leaks. Security researchers have noted that the Akira ransomware can move swiftly from initial access to full encryption, sometimes within an hour. This rapid deployment underscores the importance of timely patching and robust network configurations to mitigate such threats. SonicWall has been investigating these incidents and working on patches to address the vulnerabilities. However, the persistence of these attacks highlights the challenges in securing legacy systems and the need for continuous monitoring and updating of security measures. Organizations using SonicWall products are advised to review their configurations, ensure all patches are applied, and consider additional security measures such as network segmentation and enhanced monitoring to detect and respond to suspicious activities promptly. The Akira ransomware group has reportedly amassed significant ransom proceeds, further incentivizing their continued attacks. As the group evolves its tactics, including the development of new variants targeting different platforms, organizations must remain vigilant and proactive in their cybersecurity efforts.