Cyber Attack & Data Breach · darktrace.com

Akira-Linked SonicWall Intrusion Exfiltrated 2 GB Before Darktrace Contained the Attack

Oct 9, 2025 · Original article ↗

Summary

Darktrace describes a suspected Akira intrusion at a US customer involving a SonicWall VPN, credential abuse, lateral movement, and about 2 GB of data exfiltration. MDR and automated response helped contain activity before further escalation.

Key points

Darktrace observed the intrusion on August 20, 2025, at a US customer; a compromised SonicWall VPN suggested a link to the Akira campaign.
Activity included network scanning, WinRM and RDP lateral movement, and certificate-based Kerberos activity consistent with the “UnPAC the hash” credential-access technique.
Darktrace reported that at least 15 credentials were used during the attack, with an obtained credential later used in an RDP session to a domain controller.
A domain controller and likely SonicWall VPN uploaded approximately 2 GB of data via SSH to an endpoint identified in open-source reporting as associated with Akira.
Darktrace blocked selected external connections and sensitive internal traffic; suspected compromised devices were quarantined around 08:05 UTC and the customer was notified.
Darktrace identified at least three other incidents likely linked to the campaign, involving US organizations that appeared to use SonicWall VPNs.
The article advises patching CVE-2024-40766 and reviewing VPN credentials and configurations; the vulnerability had been patched in August 2024.

Article Details

Victim Organization: Not disclosed
Incident Type: Ransomware-related intrusion involving suspected Akira activity, credential access, lateral movement, and data exfiltration; further escalation was contained before encryption was reported.
Incident Date: 2025-08-20
Affected Data Size: Approximately 2 GiB of data was observed leaving the network; the data type and whether it was accessed or used are not disclosed.
Operational Impact: Darktrace reports restricting activity on affected devices and quarantining suspected compromised devices at approximately 08:05 UTC. The customer was notified, and further escalation was stopped; no business disruption is reported.
Ransom Or Extortion: No ransom demand or extortion targeting the customer is reported. The article describes Akira's general use of double extortion, but does not report such a demand in this incident.
Claim Status: alleged

Indicators of compromise

Type	Indicator	Context
DOMAIN	`advanced-ip-scanner[.]com`	Domain contacted during reconnaissance and blocked by Darktrace as a rare external endpoint.
DOMAIN	`temp[.]sh`	Domain contacted by a domain controller; the article says OSINT reporting indicates the service is commonly used to host and distribute malicious payloads, but does not confirm the resource contacted was malicious.
IPV4	`107[.]155[.]69[.]42`	Endpoint used for SSH data exfiltration in other incidents likely linked to the campaign; described as a probable exfiltration endpoint.
IPV4	`107[.]155[.]93[.]154`	Endpoint used for SSH data exfiltration in other incidents likely linked to the campaign; described as a likely exfiltration endpoint and reported as Akira-associated.
IPV4	`137[.]184[.]126[.]86`	Listed in the article’s IOC appendix as a possible C2 endpoint.
IPV4	`137[.]184[.]243[.]69`	Rare external endpoint from which the ESXi device downloaded an executable named “vmwaretools”; repeated connections suggested potential C2 activity.
IPV4	`66[.]165[.]243[.]39`	Endpoint used for approximately 2 GB of SSH data uploads; identified by OSINT as an Akira-associated data-exfiltration indicator.
IPV4	`85[.]239[.]52[.]96`	Endpoint from which a suspicious executable was downloaded in other incidents likely linked to the campaign; listed as a likely C2 endpoint.
URL	`hxxp[:]//137[.]184[.]126[.]86:8080/vmwaretools`	Listed in the article’s IOC appendix as a file-download URL.
URL	`hxxp[:]//85[.]239[.]52[.]96:8000/vmwarecli`	Listed in the article’s IOC appendix as a file-download URL.