{
  "name": "Observed Malicious Driver Use Associated with Akira SonicWall Campaign",
  "slug": "observed-malicious-driver-use-associated-with-akira-sonicwall-campaign",
  "description": "Akira affiliates have been observed exploiting two common drivers as part of a suspected AV/EDR evasion effort following initial access involving SonicWall abuse. The drivers, rwdrv.sys and hlpdrv.sys, are being used to facilitate AV/EDR evasion or disablement through a Bring Your Own Vulnerable Driver (BYOVD) exploitation chain. This behavior has been prevalent in recent Akira ransomware incident response cases. The campaign may be driven by an unreported zero-day vulnerability in SonicWall VPNs. Defenders are advised to harden SonicWall VPNs, implement recommended mitigations, and use provided YARA rules for detection and response to pre-ransomware activity.",
  "published": "2025-08-08T06:07:28+00:00",
  "created_at": "2025-08-08T06:07:28+00:00",
  "modified_at": "2025-08-10T17:36:42+00:00",
  "created_at_opencti": "2025-08-08T06:07:28+00:00",
  "author": "",
  "confidence": null,
  "report_types": [],
  "labels": [],
  "tags": [
    "2025-08-08",
    "akira",
    "av/edr evasion",
    "byovd",
    "drivers",
    "ransomware",
    "sonicwall",
    "vpn",
    "zero-day"
  ],
  "related_entities": {
    "observables": [
      {
        "id": "",
        "name": "bd1f381e5a3db22e88776b7873d4d2835e9a1ec620571d2b1da0c58f81c84a56"
      },
      {
        "id": "",
        "name": "16f83f056177c4ec24c7e99d01ca9d9d6713bd0497eeedb777a3ffefa99c97f0"
      }
    ],
    "malware": [
      {
        "id": "28206dae-800a-4dcc-9872-b7916a5f2b31",
        "name": "Akira",
        "slug": "akira"
      }
    ],
    "intrusion_sets": [
      {
        "id": "cddff1ef-0078-4fdc-8fcd-dd04e89d074d",
        "name": "Akira",
        "slug": "akira"
      }
    ],
    "attack_patterns": [
      {
        "id": "9f11a241-9abc-4c57-95dd-33955ab08826",
        "name": "T1078"
      }
    ]
  },
  "external_refs": [
    "https://www.guidepointsecurity.com/blog/gritrep-akira-sonicwall/",
    "https://otx.alienvault.com/pulse/6895b04096ab14debd24e809"
  ]
}