Skip to content
844-974-8669 Ask Zeus Book a call

Intelligence briefFall/Winter 2026/2027 Edition

Akira is still breaking into SonicWall VPNs two years after the patch

Akira is active in 2026 and still enters through SonicWall VPNs two years after the patch, and one affiliate now reboots into Safe Mode to blind EDR. Patch, reset VPN credentials, require MFA and watch failed logins.

Download the PDF, 884 KB Talk to the SOC

At a glance

RW-04 · Ransomware group

  • $244.17M ransomware proceeds Akira had claimed as of late September 2025[1]
  • 750 Akira leak-site claims in 2025 per the ransomware.live tracker, with 408 more through October 13, 2026[17]
  • 213,896 SonicWall VPN and management interfaces reachable online on August 24, 2026[2]
  • 7 minutes from a VPN password spray to a successful login on an account with no MFA in August 2026[3]
Status
Active, with steady operations through the first half of 2026[11]
Initial access
VPNs without MFA, reached with stolen or sprayed credentials or known Cisco and SonicWall flaws, plus spearphishing, RDP and SSH through routers[1]
Key flaw
SonicWall CVE-2024-40766, in CISA's Known Exploited Vulnerabilities catalog since September 9, 2024 with known ransomware use[6]
Speed
Encryption within four hours of first access in almost all 2025 SonicWall intrusions Arctic Wolf analyzed; data theft in just over two hours in some cases[5]
Platforms
Windows, VMware ESXi, Hyper-V and Nutanix AHV; the Rust-based Akira_v2 is the current encryptor[1]
Proceeds
About $244.17 million claimed as of late September 2025, per the FBI, CISA and partners[1]

What happened

Akira is a ransomware-as-a-service operation that has hit organizations in North America, Europe and Australia since March 2023, and on November 13, 2025 the FBI, CISA and partners updated their warning to say it presents an imminent threat to critical infrastructure. Its 2025 surge came from mass abuse of SonicWall SSL VPNs, and that pattern continued into 2026. The front door has not changed: VPN accounts without MFA and a SonicWall flaw fixed in August 2024.

  • The joint advisory update says Akira claimed about $244.17 million in proceeds as of late September 2025, encrypted Nutanix AHV virtual machine disks for the first time in June 2025, and has likely stopped using the older Megazord encryptor since 2024 in favor of the Rust-based Akira_v2.
  • Arctic Wolf documented a SonicWall SSL VPN campaign that began on July 21, 2025, with logins from hosting-provider networks, internal scanning within five minutes and encryption in under four hours in almost all intrusions; SonicWall said it had high confidence the activity was not a zero-day and found significant correlation with CVE-2024-40766.
  • ReliaQuest tied the incidents it analyzed to larger organizations that had acquired smaller ones, and counted more than 70 Akira victims in October 2025 alone from public-facing devices such as SonicWall SSL VPNs.
  • On September 8, 2026 ThreatDown reported that its managed detection team handled multiple Akira cases involving a SonicWall device in recent weeks and counted 213,896 SonicWall interfaces reachable online on August 24, 2026.
  • Huntress investigated an intrusion that began with a password spray on August 4, 2026 against a SonicWall SSL VPN with no MFA; a valid login landed within seven minutes, file shares were copied to cloud storage, the host was rebooted into Safe Mode to switch off EDR, and the encryptor then crashed on memory errors so no files were encrypted.
  • A second Huntress case published on October 6, 2026 began with Remote Desktop access from a workstation the customer did not own, followed by stopped antivirus services, an LSASS memory dump, a GOST tunnel and Rclone exfiltration.

How it works

The attack as a living map, in kill-chain order from the first foothold to impact. Point at a step to light its wiring, click to pin its story.

at risk
  • entry
  • next step
  • impact

Read the attack chain

The threat on the left, each step in order, the people at risk on the right: point at a step to light its wiring, click to pin its story here.
00the attack chain
  • entry
  • next step
  • impact

Tap a node to read its story.

Step by step

  1. Log in through an exposed VPN

    MITRE ATT&CK T1078 (opens in a new tab)

    Operators spray or reuse stolen credentials against VPNs that lack MFA and exploit flaws such as SonicWall CVE-2024-40766; Arctic Wolf saw the logins come from hosting-provider networks rather than home broadband. Spearphishing, RDP and unpatched Veeam servers are secondary routes.

  2. Scan the network and move laterally

    MITRE ATT&CK T1021.001 (opens in a new tab)

    Within minutes of login operators scan with tools such as Advanced IP Scanner, NetExec and BloodHound, then move over RDP, SSH and SMB and add remote tools such as AnyDesk and RustDesk to blend in with administrators.

  3. Create admin accounts, take credentials

    MITRE ATT&CK T1003.001 (opens in a new tab)

    Operators create domain accounts, in some cases named itadm, dump LSASS memory, run Mimikatz or LaZagne, and in one case copied domain controller disk files to extract the Active Directory database.

  4. Blind the security tools

    MITRE ATT&CK T1562.001 (opens in a new tab)

    They uninstall or stop EDR, load vulnerable drivers (Arctic Wolf named rwdrv.sys and hlpdrv.sys), and in an August 2026 case rebooted a host into Safe Mode with Networking so EDR and Defender real-time protection did not start.

  5. Steal data before encrypting

    MITRE ATT&CK T1048 (opens in a new tab)

    WinRAR gathers file shares and tools such as Rclone, WinSCP, FileZilla or s5cmd copy them to cloud storage or attacker servers, in some cases within about two hours of first access.

  6. Encrypt and extort

    MITRE ATT&CK T1486 (opens in a new tab)

    Akira_v2 uses ChaCha20 with RSA, can encrypt only virtual machines or stop running ones, deletes shadow copies and drops fn.txt or akira_readme.txt; victims contact the group on a Tor site with a unique code and pay in Bitcoin.

Who is at risk

CISA says Akira mostly targets small and medium-sized businesses but also larger organizations, with a preference for manufacturing, educational institutions, information technology, healthcare, financial services and food and agriculture. Any organization with a SonicWall or other VPN that lacks MFA, or that kept old passwords after a firewall migration, is in scope.

  • Schools and universities are named in CISA's list of preferred sectors.
  • Manufacturing leads recent claims: 125 of the 408 Akira leak-site claims the ransomware.live tracker held for January 1 to October 13, 2026 were manufacturing, followed by professional services at 85 (a Z7 tally of the tracker's data, and the claims are the group's own).
  • The United States is the most-listed country, with 216 of the 324 claims that carry a country tag in the same 2026 tracker data.
  • Inherited or migrated VPN appliances are a repeat problem: ReliaQuest flags acquisitions, and SonicWall and ThreatDown flag local passwords that were not reset after a move from Gen 6 to Gen 7 firewalls.
  • Managed service providers are exposed through customer VPNs: ThreatDown saw one MSP appear twice in its case data, hit through two separate customer environments.

Sectors in scope

  • Manufacturing
  • Education
  • Information technology
  • Healthcare and public health
  • Financial services
  • Food and agriculture
  • Construction
04What changed

What changed since the last edition

Fall/Winter 2026/2027 Edition7 changes

  1. SonicWall VPNs are still the main door two years after the fix. ThreatDown reported on September 8, 2026 that its managed detection team handled multiple Akira cases involving a SonicWall device in recent weeks and counted 213,896 SonicWall VPN portals and management interfaces reachable on August 24, 2026, against the 438,000 Bitsight figure the original edition quoted; the methods differ and reachable does not mean vulnerable.

    Source 2

  2. A new defense evasion was documented. Huntress reported on August 12, 2026 an Akira affiliate who sprayed an SSL VPN with no MFA on August 4, logged in within seven minutes, copied file shares to a cloud bucket and rebooted into Safe Mode to disable EDR; the encryptor failed on memory errors, but the stolen data remains an extortion risk.

    Source 3

  3. Another 2026 case started at Remote Desktop. Huntress (October 6, 2026) described Akira access over RDP from a workstation the customer did not own, followed by Bitdefender services stopped, an LSASS dump with procdump, a GOST tunnel and Rclone exfiltration to the cloud.

    Source 4

  4. Akira is no longer the clear number two by leak-site volume. Check Point's Q2 2026 report names Qilin (279 victims) and The Gentlemen (269) as the top two, and the ransomware.live tracker shows 180 Akira claims in Q1 2026 and 124 in Q2, against 750 in all of 2025.

    Source 14

  5. Incident-response data tells the same story. Coveware ranks Akira third with 9 percent of its Q2 2026 cases, down one place from Q1 2026.

    Source 12

  6. A federal measure now exists beside the FBI's. FinCEN's December 2025 analysis of Bank Secrecy Act reports found Akira was the most-reported ransomware variant from 2022 to 2024, with 376 incidents and about $120.9 million in reported payments, a US-reported measure separate from the $244.17 million in claimed proceeds in the CISA advisory.

    Source 16

  7. No arrest, takedown, sanction or indictment naming Akira was found. Halcyon's profile, updated July 27, 2026, lists no law enforcement action and describes steady operations through the first half of 2026.

    Source 11

What to do now

In priority order, highest impact first.

  1. Do firstRequire MFA on every VPN account, including local accounts on SonicWall and other firewalls, and alert on bursts of failed logins across many usernames from one source followed by a success.

    The August 2026 Huntress intrusion began with an MFA-less VPN account and a valid login seven minutes after the spray started.

  2. Update SonicWall firewalls to SonicOS 7.3.0 or later, then reset every local and Active Directory account that ever used the SSL VPN, including after any Gen 6 to Gen 7 migration.

    Patching does not undo credentials stolen earlier, and ThreatDown still ties Akira cases to the August 2024 flaw in September 2026.

  3. Disable SSL VPN if it is not needed, restrict management interfaces to trusted networks, and block or alert on VPN logins from hosting providers and countries where you do not operate.

    ThreatDown counted 213,896 SonicWall interfaces reachable online, and Arctic Wolf saw Akira logins arrive from hosting-provider networks.

  4. Run EDR with tamper protection on every server and endpoint, and alert on Safe Mode boots, msconfig or bcdedit changes, vulnerable driver loads and stopped security services.

    Akira uninstalls EDR, loads vulnerable drivers and in August 2026 used Safe Mode to switch protection off; Huntress noted its agent covered only a fraction of the hosts the attacker mapped.

  5. Alert on WinRAR archive creation across file shares, Rclone, s5cmd, FileZilla and large outbound transfers, and on unapproved remote tools such as AnyDesk, RustDesk, Ngrok and Cloudflare tunnels.

    Data theft comes first, often within hours of access, and a stopped encryptor still leaves stolen data to extort with.

  6. Patch Veeam Backup and Replication and VMware ESXi (CVE-2023-27532, CVE-2024-40711, CVE-2024-37085), keep backups offline and immutable, and test a restore of virtualized servers each quarter.

    CISA lists these flaws in Akira intrusions, and Akira encrypts ESXi, Hyper-V and Nutanix AHV virtual machines directly.

  7. After any acquisition or firewall migration, inventory every inherited VPN appliance and reset every credential before trusting it.

    ReliaQuest tied Akira's 2025 incidents to larger organizations that had acquired smaller ones, and migrated devices kept old local passwords.

  8. Decide in advance who declares a data breach and who talks to counsel and regulators, and treat any Akira indicator as a theft event even when nothing was encrypted.

    In the Safe Mode case the attacker had already stolen credentials and files, so extortion stayed possible; a 24/7 SOC, which Z7 Solutions™ provides for mid-size organizations, school districts and public agencies, is built to act in that early window.

Indicators

Indicators the sources publish, shown as they print them. Use them to hunt and to enrich alerts, and check the source before you block.

Indicators published by the sources
TypeIndicatorSource
file Ransom notes named akira_readme.txt or fn.txt in C:\ and in each user's home directory [1]
file Encrypted files ending in .akira, .powerranges, .akiranew or .aki [1]
behavior Domain administrative account named itadm created after initial access [1]
hash d2fd0654710c27dcf37b6c1437880020824e161dd0bf28e3a133ed777242a0ca (w.exe, Akira encryptor, SHA-256) [1]
hash 3298d203c2acb68c474e5fdad8379181890b4403d6491c523c13730129be3f75 (Akira_v2, SHA-256) [1]
ip 38.114.123[.]167 (example SSL VPN login source published by Arctic Wolf, who also named hosting ASNs AS62240 and AS63023) [5]
behavior SSL VPN logins from virtual private server hosting networks rather than broadband providers [5]
file Repackaged consent.exe used to load vulnerable drivers rwdrv.sys, churchill_driver.sys and hlpdrv.sys [5]
behavior Burst of failed VPN logins across many usernames from one source, followed by a success from the same address [3]
behavior msconfig.exe or bcdedit forcing a Safe Mode with Networking reboot; Kernel-Boot event 27 with SAFEBOOT:NETWORK and Kernel-General event 12 with BootMode 2 [3]
registry AnyDesk added to the SafeBoot Network registry list before the reboot [3]

Sources

Every number and claim in this brief traces to a source below. Each source opens in a new tab at the publisher.

  1. [1]
    #StopRansomware: Akira Ransomware (AA24-109A, updated with new TTPs and IOCs) (opens in a new tab) CISA, FBI, DC3, HHS, Europol EC3 and international partners · April 18, 2024; updated November 13, 2025 · cisa.gov
  2. [2]
    This SonicWall bug is 2 years old. Akira ransomware is still exploiting it. (opens in a new tab) ThreatDown (Malwarebytes) · September 8, 2026 · threatdown.com
  3. [3]
  4. [4]
  5. [5]
  6. [6]
    Known Exploited Vulnerabilities Catalog, entry for CVE-2024-40766 (SonicWall SonicOS) (opens in a new tab) CISA · added September 9, 2024; catalog feed released October 13, 2026 · cisa.gov
  7. [7]
    CVE-2024-40766 record (opens in a new tab) NIST National Vulnerability Database · published August 23, 2024 · nvd.nist.gov
  8. [8]
    Akira ransomware exploiting critical SonicWall SSLVPN bug again (opens in a new tab) BleepingComputer · September 11, 2025 · bleepingcomputer.com
  9. [9]
  10. [10]
    Hitachi Vantara takes servers offline after Akira ransomware attack (opens in a new tab) BleepingComputer · April 28, 2025 · bleepingcomputer.com
  11. [11]
    Threat group profile: Akira (opens in a new tab) Halcyon · updated July 27, 2026 · halcyon.ai
  12. [12]
  13. [13]
    The State of Ransomware, Q1 2026 (opens in a new tab) Check Point Research · May 11, 2026 · research.checkpoint.com
  14. [14]
    The State of Ransomware, Q2 2026 (opens in a new tab) Check Point Research · August 13, 2026 · research.checkpoint.com
  15. [15]
    The State of Ransomware, Q3 2025 (opens in a new tab) Check Point Research · November 13, 2025 · research.checkpoint.com
  16. [16]
  17. [17]
    Akira group victim records (public API, Z7 tally by discovery date) (opens in a new tab) ransomware.live · retrieved October 13, 2026 · api.ransomware.live

Z7 Weekly Intelligence

One email a week: the threats that matter, new Z7 intelligence briefs and articles, and what to do about them. Unsubscribe anytime.

By subscribing, you agree to our Terms of Use. Our Privacy Policy explains how we use your email.

All Z7 Cyber Intelligence briefs
  • RW-03Ransomware group active

    LockBit 5.0 returns after Operation Cronos

    TakeawayPatch edge devices and protect hypervisors now.

    • 163 victims posted by LockBit in Q1 2026 (Check Point)
    • 7,000+ attacks built with LockBit services (NCA)
    • LockBit
    • Ransomware group
    • Business services
    PDF849 KB
  • RW-05Ransomware group dormant

    ALPHV BlackCat dormant, Change breach 192.7M

    TakeawayRequire MFA on remote access and vet your vendors.

    • 192.7M people in the Change Healthcare breach, final estimate
    • $395.3M ALPHV/BlackCat ransom payments reported to FinCEN
    • ALPHV BlackCat
    • Ransomware group
    • Healthcare and health insurance
    PDF849 KB
  • RW-02Ransomware group active

    Part 2 of 2

    Qilin still hits hospitals and infrastructure

    TakeawayPatch edge gateways, enforce MFA and vet IT provider access.

    • 2,367 victims listed on Qilin's leak site since October 2022
    • 1 patient death linked to the Synnovis outage
    • Qilin
    • Ransomware group
    • Healthcare and diagnostic suppliers
    PDF875 KB

Want this threat watched in your environment?

Talk to the team that runs the Z7 SOC about what this brief means for you. We will tell you what applies to your environment and what does not.

Talk to the SOCContact Z7 Call 844-974-8669
Ask Zeus AI assistant