It's been a bit quiet over the last 24 hours, but we have a significant update on the Akira ransomware group's evolving tactics, particularly their ability to bypass MFA on SonicWall VPNs. Let's dive in:

Akira Ransomware Bypassing MFA on SonicWall VPNs ⚠️

- Akira ransomware affiliates are actively breaching SonicWall SSL VPNs, successfully authenticating even when one-time password (OTP) multi-factor authentication is enabled.
- This bypass is believed to stem from the use of credentials and OTP seeds previously stolen via the improper access control vulnerability CVE-2024-40766, allowing threat actors to regain access even after devices have been patched.
- Once inside, Akira moves quickly, performing internal network scanning, enumerating Active Directory, targeting Veeam servers for credential extraction, and employing Bring-Your-Own-Vulnerable-Driver (BYOVD) attacks to disable endpoint protection. Admins are urged to reset all VPN credentials on any device that previously used vulnerable firmware.

🤖 Bleeping Computer | https://www.bleepingcomputer.com/news/security/akira-ransomware-breaching-mfa-protected-sonicwall-vpn-accounts/

#CyberSecurity #ThreatIntelligence #Ransomware #Akira #SonicWall #VPN #MFA #Vulnerability #CVE202440766 #BYOVD #IncidentResponse #InfoSec

SonicWall SMA 100 devices are under threat from a stealthy malware that clings even after updates, stealing sensitive credentials. Could your network be at risk? Dive into this unfolding security saga.

https://thedefendopsdiaries.com/the-persistent-threat-of-overstep-malware-on-sonicwall-sma-100-devices/

#overstepmalware
#sonicwall
#rootkit
#firmwareupdate
#cybersecurity
#unc6148
#ransomware
#cve202440766
#networksecurity
#threatintel

A tiny flaw in SonicWall’s SSLVPN is giving Akira ransomware a free pass—hackers are exploiting it with simple HTTP requests and 100+ companies have already paid the price. Is your network prepared?

https://thedefendopsdiaries.com/understanding-the-akira-ransomware-exploitation-of-sonicwall-vulnerability-cve-2024-40766/

#akira
#ransomware
#sonicwall
#cve202440766
#cybersecurity