The Akira ransomware group has been actively targeting SonicWall VPN accounts, even those protected by multi-factor authentication (MFA). This alarming development highlights the evolving tactics of ransomware operators who are bypassing traditional security measures to gain unauthorized access. SonicWall VPNs, widely used by enterprises for secure remote access, have become a prime target due to their critical role in network security. Akira ransomware's ability to breach MFA protections indicates sophisticated attack techniques, possibly involving credential theft, exploitation of vulnerabilities, or social engineering. Organizations using SonicWall VPNs are urged to enhance their security posture by implementing additional layers of defense, monitoring for unusual login activities, and applying all relevant patches promptly. This incident underscores the importance of continuous vigilance and advanced threat detection to combat ransomware threats effectively. Cybersecurity teams must stay informed about emerging ransomware tactics and adapt their defenses accordingly to protect sensitive data and maintain operational continuity.
This Cyber News was published on www.bleepingcomputer.com. Publication date: Sun, 28 Sep 2025 18:50:18 +0000