Increased Fog and Akira Ransomware Activity Linked to SonicWall SSL VPN
Essential information
- Published
- 24/10/2024 18:23
- Modified
- 24/10/2024 20:22
- Tags
- 2024-10-24 CVE-2024-40766 akira data exfiltration fog initial access ransomware sonicwall vpn
- Related entities
- 1 vulnerabilities (cve), 16 observables, 22 techniques (mitre), 2 malware
Description
Since early August, there has been a significant increase in Fog and Akira ransomware intrusions targeting SonicWall SSL VPN users across various industries. The attacks appear opportunistic rather than targeting specific sectors. All affected devices lacked patches for CVE-2024-40766. Initial access involved VPN logins from VPS hosting IPs, with rapid progression to data encryption and exfiltration, often within hours. Shared infrastructure was observed across multiple intrusions. Defenders are advised to prioritize firmware updates, monitor for suspicious VPN logins, maintain secure offsite backups, and watch for post-compromise activities on endpoints.