Akira, Fog ransomware exploit patched SonicWall misconfigurations
Akira and Fog ransomware groups exploit CVE-2024-40766 and CVE-2024-12802 on patched SonicWall firewalls by leveraging stale accounts, weak LDAP configs, and stolen credentials from MySonicWall breach.
Sourceisc.sans.edu — open the original
What to check
- Applies to
- The 2 CVEs named below. Whether you run an affected version is not assessed: check the versions the source lists.
- Exploitation
- CISA lists CVE-2024-40766 as exploited in the wild.
Since September 2024, Akira and Fog ransomware operators have actively exploited CVE-2024-40766, an improper access control vulnerability in SonicWall Gen 5, 6, and 7 firewalls affecting the management interface and SSLVPN service. While patches became available in August 2024, threat actors continue to succeed by exploiting post-patch configuration gaps rather than unpatched systems. Attackers leverage stale local accounts, unreset passwords from Gen 6-to-Gen 7 migrations, overpermissive LDAP default user groups granting unintended SSLVPN access, and credentials stolen from the September 2025 MySonicWall cloud platform breach where all customer backup files were compromised. Dwell times are alarmingly short, with Arctic Wolf documenting encryption in under four hours and some cases as fast as 55 minutes.
In February-March 2026, ReliaQuest identified exploitation of CVE-2024-12802, a separate authentication bypass allowing MFA circumvention on SonicWall SSLVPN appliances. On Gen 6 devices, the firmware patch alone does not remediate this flaw—six manual LDAP reconfiguration steps are required, which most organizations have not performed. Attackers use automated tooling identifiable by sess="CLI" session types in authentication logs, brute-force credentials, bypass MFA without triggering alerts, and reach file servers within 30 minutes. Gen 6 devices reached end-of-life on April 16, 2026, with no further patches forthcoming. A SANS ISC audit of 14 patched firewalls found 12 had stale local accounts, 11 had unreset passwords, 10 lacked source-IP restrictions, and 9 had misconfigured LDAP default groups granting excessive permissions. Half exposed the Virtual Office Portal publicly, allowing attackers to self-enroll TOTP devices and bypass MFA. Organizations must audit local accounts, rotate passwords including LDAP bind credentials, restrict the Virtual Office Portal to internal networks, reconfigure LDAP default user groups, terminate long-running sessions, and on Gen 6 devices verify all six manual remediation steps for CVE-2024-12802 are complete. Upgrading to SonicOS 7.3.0+ and migrating off Gen 6 hardware are critical next steps.
Mentioned in this report
Source reporting: https://isc.sans.edu/diary/rss/33094
Free public brief. The indicators are in the app with a free account, no card. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them.
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its extracted indicators and live profiles of the CVEs, actors, and malware it names. The paid plans add the security research and news reporting the free tier leaves out.
It sits in a corpus of 16,445 reports from 149 sources, 666 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them, not the rest of the week's. Nothing is charged unless you subscribe.
Create a free account What it costs