Ransomware Groups Still Exploiting SonicWall Firewall Vulnerability Despite Patch

More than a year after SonicWall released a patch for CVE-2024-40766, a critical vulnerability affecting its next-generation firewalls, attackers linked to the Akira ransomware-as-a-service operation continue to exploit the flaw to breach organizations.

Similar to incidents in September 2024 and earlier this year, affiliates of the Akira group are behind the latest wave of attacks. The spike observed in July 2025 was partly due to organizations upgrading from Gen 6 to Gen 7 SonicWall firewalls without resetting local user passwords as recommended by SonicWall.

Attackers have also expanded their techniques. According to Rapid7’s Incident Response team, there has been “an uptick in intrusions involving SonicWall appliances” since early August 2025. Their findings indicate that the Akira group may be chaining together three different security weaknesses to gain access and deploy ransomware.

CVE-2024-40766, which remains unpatched in some environments.

A misconfiguration in the SSLVPN Default Users Group setting. SonicWall explains:

“This setting automatically adds every successfully authenticated LDAP user to a predefined local group, regardless of their actual membersh

[…]
Content was cut in order to protect the source.Please visit the source for the rest of the article.