AKIRA RANSOMWARE BREACHING MFA-PROTECTED SONICWALL VPN ACCOUNTS

Summary from the TLDR InfoSec newsletter

In July, BleepingComputer reported that the Akira ransomware operation was exploiting SonicWall SSL VPN devices to breach corporate networks. SonicWall eventually linked the attacks to an improper access control flaw that was patched and disclosed in late 2024. Security firm Arctic Wolf now reports an ongoing campaign against SonicWall firewalls, where threat actors are successfully logging into accounts even when one-time passwords (OTPs) are enabled. Google Threat Intelligence Group suggests that the attackers may have harvested the OTP seeds earlier and waited to use them.