SonicWall investigates possible zero-day amid Akira ransomware surge

SonicWall has issued an urgent advisory following a marked increase in cyberattacks against its Generation 7 firewalls with SSLVPN functionality, reported over a concentrated 72-hour period. The company is investigating a possible zero-day vulnerability, as multiple cybersecurity firms, including Arctic Wolf and Huntress, have identified that these attacks may involve the Akira ransomware, capable of bypassing multi-factor authentication (MFA). 'The initial access methods have not yet been confirmed in this campaign,' Arctic Wolf researchers stated, emphasizing the potential for various credential access techniques. SonicWall has advised customers to disable SSLVPN services immediately to mitigate the risk of exploitation. The incidents are concerning given that they have been reported even on fully updated firewall devices with MFA enabled, suggesting sophisticated attack methodologies. SonicWall is working closely with prominent threat research organizations to ascertain the nature of the attacks and whether they are linked to previously disclosed vulnerabilities. The collaboration with firms such as Google Mandiant and Huntress is crucial in assessing the severity and scope of the incidents. SonicWall has reported that the attacks involve post-exploitation activities such as privilege escalation, lateral movement, and data exfiltration, with the Akira ransomware being deployed in several instances. The cybersecurity community is on high alert, with Huntress confirming the exploitation of a likely zero-day vulnerability in SonicWall VPNs. 'We're seeing threat actors pivot directly to domain controllers within hours of the initial breach,' a Huntress representative indicated. To counteract the rising threat, SonicWall has recommended limiting SSLVPN connectivity to trusted IPs, enabling security services like botnet protection, and removing inactive user accounts. As the investigation continues, SonicWall pledges to release any necessary security updates as quickly as possible. The situation remains dynamic, and administrators are urged to remain vigilant and proactive in their security measures.