Manage IT NY official logo

Ransomware

How the Akira SonicWall attack chain works

Updated Steve Greenberg, President

Akira is a ransomware group. In 2025 they used internet-facing SonicWall SSL VPNs. This page teaches the chain so a non-expert can see where it can be stopped. It is not a how-to. For the generic story of email, identity, and backup, read Anatomy of a ransomware attack.

The bug, in buyer language

A CVE is a public ID for a software flaw. You do not need the internals. You need to know the product, how serious the rating is, and whether it is already being used.

  • Primary CVE

    CVE-2024-40766

    SonicWall SonicOS improper access control (NVD). Vendor mapping is CWE-284. NVD CVSS 3.1 scores it 9.8 Critical. It can allow unauthorized access to management functions and, in some conditions, crash the firewall. Affected: Firewall Gen 5 and Gen 6, and Gen 7 running SonicOS 7.0.1-5035 and older.

    CISA added it to the Known Exploited Vulnerabilities catalog on 9 September 2024 (KEV alert). Vendor write-up: SNWLID-2024-0015.

  • Other Akira CVEs

    Same group, other doors

    CISA’s #StopRansomware: Akira advisory also lists other VPN and backup flaws this group has used. This page stays on the SonicWall SSL VPN chain. Follow that CISA link for the full list — we are not adding exploit detail here.

    As of late September 2025, CISA reported that Akira had claimed about $244.17 million in proceeds. That figure is CISA’s, dated to that advisory, not a Manage IT NY estimate.

Why a one-time password can still look real

A firewall one-time password is a short code. The secret that makes those codes sits on the appliance. If an older, unpatched SonicWall was abused to take VPN passwords and those OTP secrets — or a config backup that holds them — a later login can look like a real staff MFA success. That can still be true after firmware is updated, until someone resets the secrets.

That is why SonicWall and Arctic Wolf tell customers to reset SSL VPN passwords and OTP secrets, not only to patch. Arctic Wolf also reported SSL VPN logins that passed OTP, and dwell time measured in hours.

This is a different layer from phishing-resistant MFA on identity — passkeys or a hardware key with Conditional Access on Microsoft 365. Stolen appliance OTP secrets do not replace that. You want the firewall rotated and identity MFA that phishing cannot replay. See Zero Trust access.

What a defender can actually see

Six stages, in the order they show up in logs and in CISA’s picture of Akira — not a recipe. Open each stage for the teaching point and a source.

Stage 1

SSL VPN on the internet

The SonicWall SSL VPN is a front door for staff who work from home. If that door is on the public internet, anyone can knock. CISA’s Akira advisory starts here: stolen or guessed VPN logins, and internet-facing appliances, are how this group often gets in. This page does not teach how to break in. It teaches what a buyer can see from the outside.

CISA #StopRansomware: Akira

The same chain as a labeled diagram

No commands. No addresses. Each node is a place you can still stop the story: take the VPN off the open internet where you can, patch and rotate, watch the login, keep a restore off this path.

  1. If the SSL VPN is reachable from the open internet, the first question is not malware. It is whether that door had to be public, and who is watching the knocks.

If backups sit only behind the same firewall, they are inside the last node. That is the backup problem, not a malware curiosity.

What good looks like

Patching without rotating secrets leaves the stolen login in place. These checks are the ones SonicWall, CISA, and Arctic Wolf keep repeating.

Patch the firewall, then reset VPN passwords and one-time-password secrets.

  • Patch, then rotate

    Firmware alone is not enough. SonicWall and Arctic Wolf both say to reset SSL VPN passwords and the one-time-password secrets stored on the appliance after this class of incident — including after a Gen 6 to Gen 7 upgrade that may have carried old passwords forward.

  • No spare local VPN accounts

    Local accounts that nobody uses are spare keys. Remove them. Keep the list of who can still VPN in short and named.

  • Lockout and Geo-IP as the vendor advises

    SonicWall’s 7.3 notes cover brute-force lockout and extra MFA hardening. Use the controls they document. This page will not list every checkbox — your partner should, against the current notice.

  • Phishing-resistant MFA on identity

    A one-time code on the firewall is not the same as phishing-resistant MFA on Microsoft 365 or another identity provider (passkeys or a hardware key, with Conditional Access). Stolen appliance OTP secrets do not replace that layer. You want both.

  • Someone watching VPN logins

    Arctic Wolf flagged SSL VPN sessions from hosting-provider networks that still passed OTP. Managed detection should alert on that class of login the same day — not in a monthly PDF.

  • Restores off the office path

    A backup that only lives behind the same VPN is in the path of this chain. Test a restore from a copy the office firewall cannot rewrite, on a calendar, and write down what worked.

Patching workflow is covered on vulnerability and patch management. Restore tests belong in monthly care, not a weekend surprise.

Questions buyers actually ask

No. This page teaches what a buyer can see and what to fix: an internet-facing SSL VPN, an unpatched access-control bug, a login that still looks like staff, and backups in the same path. It does not include exploit steps, payloads, or how to operate ransomware.

Sources

Every external claim on this page points here. Open the primary document, not a recap.