SonicWall devices are coming under attack from major assault
Recently discovered SonicWall vulnerability is being actively abused
When you purchase through links on our site, we may earn an affiliate commission.Here’s how it works.
A recently discovered bug in SonicWall SonicOS firewall instances is being used inransomwareattacks, multiple researchers have confirmed.
SonicWall recently reported finding, and patching, an improper access control vulnerability affecting its Gen 5, Gen 6, and Gen 7 firewalls, as well as the firewalls’ SSLVPN feature. The bug is tracked as CVE-2024-40766, and does not yet have a severity score assigned.
Now, the company has warned the bug is being actively exploited in the wild, and urged its users to apply the patch without hesitation. Soon after, security researchers from both Arctic Wolf and Rapid7 said the same thing, with the former pinning the attacks on Akira ransomware affiliates.
False sense of privacy
Akira was first spotted in March 2023 and has since raided dozens of companies. Akira’s affiliates target mostly enterprises, but they don’t seem to favor any specific vertical, as so far they targeted firms in education, finance, real estate, manufacturing, and consulting industries.
Besides operating flawed instances, the companies that recently fell prey to Akira did another thing - kept MFA disabled for high-value accounts.
“MFA was disabled for all compromised accounts, and the SonicOS firmware on the affected devices were within the versions known to be vulnerable to CVE-2024-40766,” commented Stefan Hostetler, a Senior Threat Intelligence Researcher at Arctic Wolf.
CVE-2024-40766 has also been added to CISA’s Known Exploited Vulnerabilities (KEV) catalog, which also means federal agencies have a deadline to patch up, or stop using the instances entirely. The deadline is September 30.
Are you a pro? Subscribe to our newsletter
Sign up to the TechRadar Pro newsletter to get all the top news, opinion, features and guidance your business needs to succeed!
Those who are unable to apply the patch immediately are advised to restrict firewall management and SSLVPN access to trusted sources, and to enable multi-factor authentication for all SSLVPN users using TOTP or email-based one-time passwords (OTP).
ViaBleepingComputer
More from TechRadar Pro
Sead is a seasoned freelance journalist based in Sarajevo, Bosnia and Herzegovina. He writes about IT (cloud, IoT, 5G, VPN) and cybersecurity (ransomware, data breaches, laws and regulations). In his career, spanning more than a decade, he’s written for numerous media outlets, including Al Jazeera Balkans. He’s also held several modules on content writing for Represent Communications.
Cisco issues patch to fix serious flaw allowing possible industrial systems takeover
Washington state court systems taken offline following cyberattack
Your doctor may have an AI assistant taking notes during your next Zoom call
