---
title: Hackers Bypass SonicWall Security to Deploy Akira Ransomware in Lightning-Fast Attacks
description: Cybercriminals exploit SonicWall firewalls to deploy Akira ransomware in 55 minutes, targeting organizations since July 2025.
canonical_url: https://codekeeper.co/ticker/cybercriminals-exploit-sonicwall-firewalls-for-akira-ransomware
---

# Hackers Bypass SonicWall Security to Deploy Akira Ransomware in Lightning-Fast Attacks

Cybercriminals exploit SonicWall firewalls to deploy Akira ransomware in 55 minutes, targeting organizations since July 2025.

![Content Team](https://codekeeper.co/hubfs/_sized/Codekeeper_21_beeldmerkL-800.png)

By Content Team Sep 28, 2025

Share [![Share on facebook](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Facebook.svg)](http://www.facebook.com/share.php?u=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fcybercriminals-exploit-sonicwall-firewalls-for-akira-ransomware%3Futm_medium%3Dsocial%26utm_source%3Dfacebook) [![Share on linkedin](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Linkedin.svg)](http://www.linkedin.com/shareArticle?mini=true&url=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fcybercriminals-exploit-sonicwall-firewalls-for-akira-ransomware%3Futm_medium%3Dsocial%26utm_source%3Dlinkedin) [![Share on twitter](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20X.svg)](https://twitter.com/intent/tweet?original_referer=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fcybercriminals-exploit-sonicwall-firewalls-for-akira-ransomware%3Futm_medium%3Dsocial%26utm_source%3Dtwitter&url=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fcybercriminals-exploit-sonicwall-firewalls-for-akira-ransomware%3Futm_medium%3Dsocial%26utm_source%3Dtwitter&source=tweetbutton&text=) [![Share on email](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Mail.svg)](mailto:?subject=Check%20out%20https%3A%2F%2Fcodekeeper.co%2Fticker%2Fcybercriminals-exploit-sonicwall-firewalls-for-akira-ransomware%3Futm_medium%3Dsocial%26utm_source%3Demail%20&body=Check%20out%20https%3A%2F%2Fcodekeeper.co%2Fticker%2Fcybercriminals-exploit-sonicwall-firewalls-for-akira-ransomware%3Futm_medium%3Dsocial%26utm_source%3Demail) ![Copy link](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Copy.svg)

ON THIS PAGE

### Want more insights like this?

Subscribe to our newsletter to get the latest software protection strategies delivered to your inbox.

By submitting your email, you consent to Codekeeper contacting you and agree to our [privacy policy](https://codekeeper.co/privacy-policy) .

Cybercriminals are exploiting SonicWall firewalls to deploy Akira ransomware, moving from initial breach to full encryption in as little as 55 minutes. Arctic Wolf Labs detected this ongoing campaign that began in late July 2025, targeting organizations across multiple sectors. The attackers gain access through stolen SSL VPN credentials linked to CVE-2024-40766, a vulnerability from 2024. Even devices with multi-factor authentication and current patches are being compromised because hackers are using previously harvested credentials. Once inside, attackers quickly scan networks, create admin accounts, disable security software, steal data, and deploy ransomware. Arctic Wolf urges organizations to immediately reset all SSL VPN credentials and monitor for suspicious logins from hosting providers. **Source:** [Cybersecurity News](https://cybersecuritynews.com/sonicwall-firewalls-akira-ransomware/)

Share this article [![Share on facebook](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Facebook.svg)](http://www.facebook.com/share.php?u=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fcybercriminals-exploit-sonicwall-firewalls-for-akira-ransomware%3Futm_medium%3Dsocial%26utm_source%3Dfacebook) [![Share on linkedin](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Linkedin.svg)](http://www.linkedin.com/shareArticle?mini=true&url=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fcybercriminals-exploit-sonicwall-firewalls-for-akira-ransomware%3Futm_medium%3Dsocial%26utm_source%3Dlinkedin) [![Share on twitter](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20X.svg)](https://twitter.com/intent/tweet?original_referer=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fcybercriminals-exploit-sonicwall-firewalls-for-akira-ransomware%3Futm_medium%3Dsocial%26utm_source%3Dtwitter&url=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fcybercriminals-exploit-sonicwall-firewalls-for-akira-ransomware%3Futm_medium%3Dsocial%26utm_source%3Dtwitter&source=tweetbutton&text=) [![Share on email](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Mail.svg)](mailto:?subject=Check%20out%20https%3A%2F%2Fcodekeeper.co%2Fticker%2Fcybercriminals-exploit-sonicwall-firewalls-for-akira-ransomware%3Futm_medium%3Dsocial%26utm_source%3Demail%20&body=Check%20out%20https%3A%2F%2Fcodekeeper.co%2Fticker%2Fcybercriminals-exploit-sonicwall-firewalls-for-akira-ransomware%3Futm_medium%3Dsocial%26utm_source%3Demail) ![Copy link](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Copy.svg)

![blog_book_a_demo_cta_3x](https://codekeeper.co/hubfs/_sized/Codekeeper%202025/blog_book_a_demo_cta_3x-768x512.webp)

Have questions about protecting your software?

Our escrow experts are standing by to help.

[Book a free demo](https://codekeeper.co/book-a-demo)

YOU MAY ALSO LIKE

[Malware Can Hijack Windows Hello Keys to Break Into Microsoft Cloud Accounts Aug 11, 2026](https://codekeeper.co/ticker/malware-abuses-windows-hello-for-entra-id-access)

[Cyberattacks Claude AI Used to Run Nearly Every Stage of a Live Ransomware Campaign Aug 20, 2026](https://codekeeper.co/ticker/ai-driven-ransomware-attacks-gambit-security-report)

[Cyberattacks Red Heron Hackers Exploit Critical Gitea Flaw to Hijack Servers Sep 16, 2026](https://codekeeper.co/ticker/red-heron-exploits-gitea-flaw-cve-2026-60004)

[Hackers Are Actively Exploiting a Critical VeloCloud Orchestrator Vulnerability Aug 11, 2026](https://codekeeper.co/ticker/critical-velocloud-flaw-cve-2026-16812)