Escalation in Akira Campaign Targeting SonicWall VPNs, Deploying Ransomware, With Malicious Logins

Friday the security researchers at Arctic Wolf Labs wrote:

In late July 2025, Arctic Wolf Labs began observing a surge of intrusions involving suspicious SonicWall SSL VPN activity. Malicious logins were followed within minutes by port scanning, Impacket SMB activity, and rapid deployment of Akira ransomware. Victims spanned across multiple sectors and organization sizes, suggesting opportunistic mass exploitation.

This campaign has recently escalated, with new…