# Akira, Fog ransomware exploit patched SonicWall misconfigurations

Published: 2026-06-23 · Severity: high
Canonical: https://vorant.io/reports/6d4cac2c-a9e9-5346-80b1-7c551223689e/akira-fog-ransomware-exploit-patched-sonicwall-misconfigurations

> Akira and Fog ransomware groups exploit CVE-2024-40766 and CVE-2024-12802 on patched SonicWall firewalls by leveraging stale accounts, weak LDAP configs, and stolen credentials from MySonicWall breach.

Since September 2024, Akira and Fog ransomware operators have actively exploited CVE-2024-40766, an improper access control vulnerability in SonicWall Gen 5, 6, and 7 firewalls affecting the management interface and SSLVPN service. While patches became available in August 2024, threat actors continue to succeed by exploiting post-patch configuration gaps rather than unpatched systems. Attackers leverage stale local accounts, unreset passwords from Gen 6-to-Gen 7 migrations, overpermissive LDAP default user groups granting unintended SSLVPN access, and credentials stolen from the September 2025 MySonicWall cloud platform breach where all customer backup files were compromised. Dwell times are alarmingly short, with Arctic Wolf documenting encryption in under four hours and some cases as fast as 55 minutes.

In February-March 2026, ReliaQuest identified exploitation of CVE-2024-12802, a separate authentication bypass allowing MFA circumvention on SonicWall SSLVPN appliances. On Gen 6 devices, the firmware patch alone does not remediate this flaw—six manual LDAP reconfiguration steps are required, which most organizations have not performed. Attackers use automated tooling identifiable by sess="CLI" session types in authentication logs, brute-force credentials, bypass MFA without triggering alerts, and reach file servers within 30 minutes. Gen 6 devices reached end-of-life on April 16, 2026, with no further patches forthcoming. A SANS ISC audit of 14 patched firewalls found 12 had stale local accounts, 11 had unreset passwords, 10 lacked source-IP restrictions, and 9 had misconfigured LDAP default groups granting excessive permissions. Half exposed the Virtual Office Portal publicly, allowing attackers to self-enroll TOTP devices and bypass MFA. Organizations must audit local accounts, rotate passwords including LDAP bind credentials, restrict the Virtual Office Portal to internal networks, reconfigure LDAP default user groups, terminate long-running sessions, and on Gen 6 devices verify all six manual remediation steps for CVE-2024-12802 are complete. Upgrading to SonicOS 7.3.0+ and migrating off Gen 6 hardware are critical next steps.

## Mentioned in this report

- Vulnerabilities: CVE-2024-12802, CVE-2024-40766 (KEV)
- Threat actors: Akira, Fog
- Malware: Akira, Fog

## Detection guidance (public sample)

### SonicWall SSLVPN Authentication with CLI Session Type (Automated Tooling / MFA Bypass)

ATT&CK: T1556

Detects SonicWall SSLVPN authentication events with sess="CLI" session type, associated with automated tooling used to brute-force credentials and bypass MFA per CVE-2024-12802 exploitation. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: SonicWall SSLVPN CLI Session Authentication
id: 3e48f036-7379-50b5-89da-7d80aedf0d0a
status: experimental
description: 'Detects SonicWall SSLVPN authentication log entries with session type
  "CLI", which ReliaQuest identified as the signature of automated tooling used by
  Akira/Fog affiliates to brute-force credentials and bypass MFA on CVE-2024-12802-vulnerable
  Gen 6 devices. Legitimate administrative CLI sessions are rare and typically originate
  from known management IPs.

  '
references:
- https://www.reliaquest.com
author: Vorant
tags:
- attack.t1556
- attack.t1110
logsource:
  category: authentication
  product: sonicwall
detection:
  selection:
    sess: CLI
  filter_known_admin:
    src_ip:
    - 10.0.0.0/8
    - 192.168.0.0/16
    - 172.16.0.0/12
  condition: selection and not filter_known_admin
falsepositives:
- Legitimate scripted administrative access to SonicWall CLI from internal management
  hosts
- Vendor-supported automation tools performing bulk configuration via CLI session
level: high
```

### SonicWall SSLVPN Repeated Authentication Failures Indicating Brute Force

ATT&CK: T1110

Detects repeated SonicWall SSLVPN authentication failure events against local or LDAP accounts, consistent with brute-force credential attacks exploiting stale accounts and unrotated passwords; volumetric thresholds (e.g., many failures within minutes followed by a success) should be tuned in the SIEM correlation layer rather than in this single-event rule. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: SonicWall SSLVPN Authentication Failure Against Local/LDAP Account
id: 3dd8234d-2a3c-5b49-a31a-a1f665df2d86
status: experimental
description: 'Detects failed SSLVPN authentication attempts on SonicWall appliances.
  Akira/Fog operators brute-force stale local accounts and unreset LDAP-migrated passwords
  following Gen 6-to-Gen 7 migrations. A high volume of failures from a single source
  or against a single account within a short window (minutes) followed by a success
  is highly suspicious and should be correlated downstream; this rule flags the base
  failure event for that correlation.

  '
references:
- https://arcticwolf.com
author: Vorant
tags:
- attack.t1110
- attack.t1078.003
- attack.t1078.001
logsource:
  category: authentication
  product: sonicwall
detection:
  selection:
    EventType: authentication
    Status: failure
    Service:
    - SSLVPN
    - VirtualOffice
  condition: selection
falsepositives:
- Users mistyping passwords or locked-out accounts during normal password rotation
- Misconfigured VPN clients retrying stale cached credentials
level: medium
```

### External Access to SonicWall Virtual Office Portal from Untrusted Network

ATT&CK: T1133

Detects connections to the SonicWall Virtual Office Portal (self-enrollment TOTP/MFA endpoint) originating from external/WAN-facing sources, which allows attackers to self-enroll TOTP devices and bypass MFA when the portal is not restricted to internal networks. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: SonicWall Virtual Office Portal Access From External Source
id: 1c0a3682-bec3-5a06-84e3-289fb874efb3
status: experimental
description: 'Detects HTTP/HTTPS requests to the SonicWall Virtual Office Portal (used
  for SSLVPN self-service and TOTP/MFA device enrollment) coming from a WAN or untrusted
  zone. The report notes that half of audited firewalls exposed this portal publicly,
  letting attackers self-enroll TOTP devices and bypass MFA. Legitimate use is expected
  only from internal or VPN-terminated networks.

  '
references:
- https://www.sans.org/blog
author: Vorant
tags:
- attack.t1133
- attack.t1078.003
logsource:
  category: proxy
  product: sonicwall
detection:
  selection:
    url|contains:
    - virtualoffice
    - VirtualOffice
    - /sslvpn/
  filter_internal:
    src_ip:
    - 10.0.0.0/8
    - 192.168.0.0/16
    - 172.16.0.0/12
  condition: selection and not filter_internal
falsepositives:
- Remote employees or partners intentionally granted external access to the Virtual
  Office Portal on properly source-IP-restricted deployments
- Third-party vulnerability scanners authorized to probe the portal
level: medium
```

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://isc.sans.edu/diary/rss/33094

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/6d4cac2c-a9e9-5346-80b1-7c551223689e/akira-fog-ransomware-exploit-patched-sonicwall-misconfigurations.
Full IOC sets, deployable detections, the entity graph, TAXII 2.1 feed and real-time alerts: https://vorant.io/signup