Huntress Reports SonicWall VPN Intrusions Linked to Akira Ransomware and Vulnerable-Driver Abuse

Aug 13, 2025 · Original article ↗

Summary

Huntress details SonicWall VPN intrusions involving credential theft, lateral movement, defense evasion and Akira ransomware. SonicWall says activity correlates with CVE-2024-40766, not a zero-day; Huntress also observed vulnerable-driver abuse.

Key points

Huntress reported at least 28 incidents in the activity cluster as of August 6, with the first observed on July 25.
SonicWall said the activity correlates with CVE-2024-40766, not a zero-day, and cited unreset local passwords carried over during some firewall migrations.
Huntress observed attackers using privileged accounts, WMI and PowerShell for lateral movement, and stealing credentials from Veeam databases and Active Directory.
Attackers disabled security tools, cleared event logs, and used Cloudflared tunnels, OpenSSH, and other tools for persistence or access.
Huntress assessed that attackers deployed Akira ransomware and reported vulnerable-driver use in multiple Akira-linked incidents.
SonicWall advised affected customers to update firmware to 7.3.0 and reset local SSL VPN account passwords; Huntress also recommended rotating LDAP passwords and restricting or disabling VPN access.

Article Details

Attack Vectors: Attackers breached SonicWall seventh-generation firewall appliances with SSL VPN enabled; the initial report suspected a zero-day, but SonicWall later said the activity correlated with CVE-2024-40766 and was not connected to a zero-day flaw.
Attackers leveraged over-privileged LDAP or service accounts, including accounts used by SonicWall, to gain administrative access.
Attackers logged in through RDP, brute-forced accounts, and used compromised accounts.
Attackers used WMI and PowerShell Remoting for lateral movement and credential theft, including dumping and decrypting credentials from Veeam Backup databases.
Attackers backed up the Active Directory NTDS.dit database for offline cracking and copied browser login data.
Attackers used Cloudflared tunnels, OpenSSH, new accounts, AnyDesk, and ScreenConnect for persistence or remote access.
Attackers staged and exfiltrated data using WinRAR and FileZilla.
Attackers disabled security tools and firewall protections, cleared event logs, and attempted to delete Volume Shadow Copies.
Attackers deployed Akira ransomware; Huntress assessed the ransomware attribution, and reported that the executable was run repeatedly before and after vulnerable-driver installation.
In incidents linked to Akira ransomware, attackers installed rwdrv.sys and hlpdrv.sys in BYOVD activity to evade or disable security tools.
Defensive Notes: Huntress initially advised disabling SonicWall SSL VPN access or restricting it to a minimal allow-list of trusted IP addresses, and segmenting networks to limit access to critical servers such as domain controllers.
SonicWall advised affected customers who migrated configurations from Gen 6 to newer firewalls to update firmware to version 7.3.0 and reset local user passwords for accounts with SSL VPN access.
Huntress recommended rotating local user and LDAP account passwords used for Active Directory integration.
Audit service accounts and ensure they follow least privilege; SonicWall or LDAP service accounts should not have Domain Admin privileges.
Huntress advised hunting for malicious activity using the listed indicators of compromise.

Indicators of compromise

Type	Indicator	Context
IPV4	`104[.]238[.]205[.]105`	Listed as an attacker IP and associated with adversary infrastructure.
IPV4	`104[.]238[.]220[.]216`	Listed as an attacker IP and associated with adversary infrastructure.
IPV4	`142[.]252[.]99[.]59`	Listed in the article's IOC table as an attacker IP.
IPV4	`181[.]215[.]182[.]64`	Listed as an attacker IP and associated with adversary infrastructure.
IPV4	`193[.]163[.]194[.]7`	Listed as an attacker IP and associated with adversary infrastructure.
IPV4	`193[.]239[.]236[.]149`	Listed as an attacker IP and associated with adversary infrastructure.
IPV4	`194[.]33[.]45[.]155`	Listed as an attacker IP and associated with adversary infrastructure.
IPV4	`45[.]86[.]208[.]240`	Listed as an attacker IP and associated with adversary infrastructure.
IPV4	`77[.]247[.]126[.]239`	Listed as an attacker IP and associated with adversary infrastructure.
SHA256	`16f83f056177c4ec24c7e99d01ca9d9d6713bd0497eeedb777a3ffefa99c97f0`	SHA-256 hash of rwdrv.sys, a driver the article says attackers installed.
SHA256	`1b153070934033deace7f04e77a72abe4e7e259271f885e25d81dc6337a9313d`	SHA-256 hash listed for win.exe in the IOC table.
SHA256	`bd1f381e5a3db22e88776b7873d4d2835e9a1ec620571d2b1da0c58f81c84a56`	SHA-256 hash of hlpdrv.sys, a driver the article says attackers installed.
SHA256	`d080f553c9b1276317441894ec6861573fa64fb1fae46165a55302e782b1614d`	SHA-256 hash identified for the ransomware executable w.exe.