Undisclosed SonicWall Zero Day Leading to Akira Ransomware

THE THREAT

[Updated August 7, 2025]

SonicWall has determined that recent SSLVPN security incidents affecting Gen 7 and newer firewalls are linked to CVE-2024-40766, not a zero-day vulnerability. With less than 40 identified incidents, mostly involving Gen 6 to Gen 7 migrations where passwords weren't reset, SonicWall strongly urges customers to update to SonicOS 7.3.0, reset all SSLVPN local user passwords, enable security features like Botnet Protection and Geo-IP Filtering, implement MFA, and remove unused accounts. The company continues working with security partners to monitor the situation.

A potential undisclosed zero-day vulnerability in SonicWall Gen 7 firewall appliances is believed to be exploited by threat actors, leading to the deployment of Akira ransomware. Recent attacks have impacted organizations globally with rapid progression from initial compromise to complete network takeover. The threat actor has demonstrated sophisticated capabilities to bypass MFA controls, leverage privileged access, and move laterally to domain controllers within hours. The Akira ransomware group has generated over $42 million in ransom payments from 250+ victims, targeting enterprises across all sectors, with notable compromises including Nissan, Hitachi, and Stanford University.

The active exploitation pattern shows automated initial access via SonicWall SSLVPN, followed by hands-on-keyboard activity utilizing both custom tools and native Windows utilities for persistence, credential theft, and defense evasion. Technical analysis indicates systematic compromise of backup systems, Active Directory infrastructure, and endpoint security controls before ransomware deployment.

Immediate action is required: (1) Disable SonicWall SSL VPN services until an official patch is released, (2) If VPN must remain active, implement strict IP allowlisting and network segmentation to protect critical assets, (3) Conduct privilege audit of service accounts, particularly those used for SonicWall integration, (4) Initiate threat hunting activities focusing on provided Indictor of Compromise (IoC), and (5) Prepare incident response plans for potential compromise. Organizations using the impacted product should assume a compromise has occurred, until proven otherwise, and implement detection and response measures accordingly.

What we’re doing about it

• eSentire Threat Response Unit (TRU) is proactively tracking this topic for further information
• eSentire Threat Response Unit (TRU) is conducting threat hunting using the provided IoC
• eSentire MDR for Endpoint detects Tactic, Technique, and Procedures (TTPs) used by Akira Ransomware group, including deletion of Volume Shadow Copies, usage of RMM tools like AnyDesk, and enumeration activity using tools like Nltest
• eSentire MDR for Log has detections in place to identify suspicious user logons in SonicWall VPN
• Malicious IPs has been added to eSentire Global Block List

What you should do about it

• Disable SonicWall SSLVPN Services where practical until an official patch or guidance is available
  • This is most effective way to protect your network, if disabling SSLVPN is not possible, following the steps below to lockdown your network with enhanced monitoring
• Limit SonicWall SSLVPN connectivity to trusted source IPs
• Enable Security Services
  • Activate services such as Botnet Protection and Geo-IP Filtering
  • This help detect and block known threat actors targeting SSLVPN endpoints
• Enforce Multi-Factor Authentication (MFA)
  • This will not stop the attack according to the details released, however, enabling MFA for all remote access can reduce the risk of credential abuse
• Remove Unused Accounts
  • Delete any inactive or unused local user accounts on the firewall
  • Pay special attention to those with SSLVPN access
• Implement enhanced logging
  • Ensure SonicWall VPN logs are integrated with eSentire MDR for Log for monitoring
• Practice Good Password Hygiene
  • Encourage regular password updates across all user accounts.
• Block VPN authentication from the following hosting-related providers:
  • ReliableSite.Net LLC (AS23470)
  • Global Connectivity Solutions LLP (AS215540)
  • UnReal Servers, LLC (AS64236)
  • 1GSERVERS, LLC (AS14315)
  • Clouvider Limited (AS62240)
• Review systems for signs of compromise using the provided IoC

Additional information

A suspected zero-day vulnerability affecting SonicWall Gen 7 firewall appliances (TZ and NSa-series) running firmware version 7.2.0-7015 and earlier with SSLVPN enabled. The exploit appears to bypass Time-based, One-Time Password (TOTP) Multi-Factor Authentication (MFA) implementations and provides threat actors with immediate network access. Initial compromise timestamps indicate exploitation began around July 15, 2025, with attack patterns suggesting automated initial access followed by hands-on-keyboard post-exploitation activities.

The attack chain demonstrates sophisticated TTPs including abuse of over-privileged LDAP/service accounts (notably 'sonicwall' and 'LDAPAdmin'), deployment of Cloudflared tunnels and OpenSSH for C2 persistence (typically staged in C:\ProgramData), and extensive use of WMI/PowerShell Remoting for lateral movement. Attackers consistently target Veeam Backup credential and exfiltrated Active Directory database NTDS.dit via wbadmin.exe. Pre-ransomware activities include systematic defense evasion using native Windows utilities (Set-MpPreference for Defender disruption, netsh.exe for firewall manipulation) followed by Volume Shadow Copies deletion via vssadmin.exe before Akira ransomware deployment.

Technical indicators show attackers leveraging both custom tooling (Advanced_IP_Scanner, WinRAR, FileZilla) and Living Off the Land Binaries (LOLBins) for network enumeration, establishing persistence through RMM tools (AnyDesk, ScreenConnect) and SSH backdoors. Command patterns suggest standardized operational procedures, including targeted AD enumeration (using RSAT PowerShell modules), credential harvesting from browser data stores, and systematic firewall rule modifications to maintain access. Attack dwell time is notably short, with progression from initial access to domain controller compromise often occurring within hours.

References:

[1] https://arcticwolf.com/resources/blog/arctic-wolf-observes-july-2025-uptick-in-akira-ransomware-activity-targeting-sonicwall-ssl-vpn/
[2] https://www.sonicwall.com/support/notices/gen-7-sonicwall-firewalls-sslvpn-recent-threat-activity/250804095336430
[3] https://www.huntress.com/blog/exploitation-of-sonicwall-vpn
[4] https://www.bleepingcomputer.com/news/security/surge-of-akira-ransomware-attacks-hits-sonicwall-firewall-devices/
[5] https://www.helpnetsecurity.com/2025/08/04/sonicwall-firewalls-ssl-vpn-ransomware-akira/