SonicWall devices are coming under attack from major assault

Ransomware
(Image credit: Pixabay)

A recently discovered bug in SonicWall SonicOS firewall instances is being used in ransomware attacks, multiple researchers have confirmed.

SonicWall recently reported finding, and patching, an improper access control vulnerability affecting its Gen 5, Gen 6, and Gen 7 firewalls, as well as the firewalls’ SSLVPN feature. The bug is tracked as CVE-2024-40766, and does not yet have a severity score assigned.

Now, the company has warned the bug is being actively exploited in the wild, and urged its users to apply the patch without hesitation. Soon after, security researchers from both Arctic Wolf and Rapid7 said the same thing, with the former pinning the attacks on Akira ransomware affiliates.

False sense of privacy

Akira was first spotted in March 2023 and has since raided dozens of companies. Akira’s affiliates target mostly enterprises, but they don’t seem to favor any specific vertical, as so far they targeted firms in education, finance, real estate, manufacturing, and consulting industries.

Besides operating flawed instances, the companies that recently fell prey to Akira did another thing - kept MFA disabled for high-value accounts.

“MFA was disabled for all compromised accounts, and the SonicOS firmware on the affected devices were within the versions known to be vulnerable to CVE-2024-40766,” commented Stefan Hostetler, a Senior Threat Intelligence Researcher at Arctic Wolf.

CVE-2024-40766 has also been added to CISA’s Known Exploited Vulnerabilities (KEV) catalog, which also means federal agencies have a deadline to patch up, or stop using the instances entirely. The deadline is September 30.

Those who are unable to apply the patch immediately are advised to restrict firewall management and SSLVPN access to trusted sources, and to enable multi-factor authentication for all SSLVPN users using TOTP or email-based one-time passwords (OTP).

Via BleepingComputer

More from TechRadar Pro

Sead is a seasoned freelance journalist based in Sarajevo, Bosnia and Herzegovina. He writes about IT (cloud, IoT, 5G, VPN) and cybersecurity (ransomware, data breaches, laws and regulations). In his career, spanning more than a decade, he’s written for numerous media outlets, including Al Jazeera Balkans. He’s also held several modules on content writing for Represent Communications.

Read more
A VPN runs on a mobile phone placed on a laptop keyboard
SonicWall firewalls hit by worrying cyberattack
Best free Linux firewalls
SonicWall tells admins to patch worrying SSLVPN flaw immediately
Representational image depecting cybersecurity protection
Hackers are breaking SonicWall products to target business networks
Best free Linux firewalls
Fortinet warns a critical vulnerability in its systems could let attackers breach company networks
Ransomware
Fortinet firewall bugs are being targeted by LockBit ransomware hackers
The best free firewall
Palo Alto warns another major firewall hack has been detected
Latest in Security
A stylized depiction of a padlocked WiFi symbol sitting in the centre of an interlocking vault.
Broadcom warns of worrying security flaws affecting VMware tools
URL phishing
HaveIBeenPwned owner suffers phishing attack that stole his Mailchimp mailing list
Ransomware
Cl0p resurgence drives ransomware attacks to new highs in 2025
Google Chrome
Google Chrome security flaw could have let hackers spy on all your online habits
cybersecurity
Chinese government hackers allegedly spent years undetected in foreign phone networks
Data leak
A major Keenetic router data leak could put a million households at risk
Latest in News
inZOI promotional material.
inZOI has become the most wishlisted game on Steam, but I wouldn't get too caught up in the hype
Xbox Series X and Xbox wireless controller set to a green background
Xbox Insiders are currently testing a new Game Hub feature that looks useful, but I've got mixed feelings about it
A stylized depiction of a padlocked WiFi symbol sitting in the centre of an interlocking vault.
Broadcom warns of worrying security flaws affecting VMware tools
Microsoft Surface Laptop and Surface Pro devices on a table.
Hate Windows 11’s search? Microsoft is fixing it with AI, and that almost makes me want to buy a Copilot+ PC
Oura Ring 4
Activity tracking on Oura Ring is about to get a whole lot better, but I've got bad news about your step count
Google Pixel Buds Pro 2
Cleaned your Pixel Buds Pro 2 recently? If not, you might be getting worse sound