InfoSecBulletin Cybersecurity for mankind
Arctic Wolf noted a significant rise in Akira ransomware attacks since late July 2025, focusing on SonicWall SSL VPN accounts. This campaign is still active, with new infrastructure spotted as recently as September 20, 2025.
Akira affiliates are exploiting stolen credentials, even in environments where multi-factor authentication (MFA) is enabled. According to the report, “Threat actors are accessing SSL VPN accounts through credentials likely to have been previously exfiltrated with CVE-2024-40766, including accounts with OTP MFA enabled.”
Daily Cyber security update for 24. 10. 2026
PHP shares new RCE flaw (CVE 2026-115560) with no patch but mitigation
US banks faced unauthorized access by AI agents in customer accounts: Axios reports
Atlassian patched 176 flaw in Jira and Confluence: Fortinet Urges to Patch Flaws Affecting FortiOS, FortiManager
Hacker claim to access Rajasthan Police data: 70,000 records allegedly exposed
Update now! PHP2Shell: Critical PHP vulnerabilities patched
Trump says data centres should pay dividends to local community
Hackers Actively Exploiting Palo Alto VPN Flaw Via CVE-2026-0257
DeepSeek AI banned by U.S. Government; federal agencies must remove all related tools
CISA, NSA and NIST Publish New 10 AI Agent Control Guidelines
The campaign highlights Akira’s ongoing focus on VPNs. Previous attacks exploited vulnerabilities such as CVE-2023-20269 in Cisco ASA and CVE-2020-3259 in Cisco AnyConnect.
Perhaps the most alarming element is the extremely short dwell time. Arctic Wolf warns: “In dozens of recent intrusions, attackers moved from credential access to lateral movement, exfiltration, and encryption in under four hours—with some as fast as 55 minutes.”
This quick timeline gives defenders very little time to react.
To stay ahead of detection, the group continuously shifts its infrastructure. “Threat actors are rotating VPS-based client infrastructure, attempting to evade detection.”
Indicators of compromise include logins from VPS hosting providers instead of standard broadband or enterprise networks, which is something defenders can track.
Victimology spans industries and company sizes, suggesting mass exploitation. As the report notes, “Victims span multiple industries and organisation sizes, indicating opportunistic mass exploitation rather than targeted intrusions.”
SonicWall confirmed that CVE-2024-40766 is being exploited and warned that patched devices could still be at risk if credentials were compromised prior to updates. Their advice includes:
- Reset all credentials stored on the firewall, including SSL VPN passwords and OTP MFA secrets.
- Update to SonicOS 7.3.0, which introduces brute-force and MFA hardening.
- Remove unused accounts and enforce MFA across all remote access.
- Enable Botnet Protection and other security services.
