Akira Ransomware Strikes: North Korea-Linked Hackers Bypass OTP MFA
A new wave of cyber attacks has been detected, with the Akira ransomware causing significant disruption across various sectors. The attacks, which began in July 2025, have exploited vulnerabilities in SonicWall SSL VPNs, bypassing One-Time Password (OTP) Multi-Factor Authentication (MFA).
The attacks are believed to have started with malicious SSL VPN logins from Virtual Private Server (VPS) providers. Once inside, threat actors, affiliated with North Korea, quickly spread across networks, with rapid post-login activity and short dwell times. Over half of the intrusions involved OTP MFA accounts, demonstrating the attackers' ability to circumvent this security measure.
The Akira ransomware targets SonicWall NSA and TZ series devices running SonicOS 6-8, including recent 7.3.0 builds. It exploits the CVE-2024-40766 vulnerability to gain initial access. After gaining entry, attackers use multiple techniques to evade detection, such as disabling Remote Monitoring and Management (RMM) tools and deleting Volume Shadow Copies.
Threat actors install WinRAR on servers and domain controllers to package files for exfiltration. They also search for VM storage/backups to access sensitive data and domain credentials. After SSL VPN access, attackers scan internal networks within just five minutes, indicating a high level of sophistication and speed.
The Akira ransomware campaign has highlighted the ongoing threat posed by state-affiliated cybercriminal groups. With their ability to bypass OTP MFA and exploit vulnerabilities in widely-used VPNs, organizations must remain vigilant and prioritize robust cybersecurity measures to protect against such attacks.
Read also:
- Pablo Escobar's Former Estate 'Hacienda Nápoles' to Be Transformed by Women's Organization
- Emergency services of the future revealed by Renault with the introduction of the Vision 4Rescue vehicle.
- SonicWall executive Michael Crean discusses the current state of managed security
- Companies exercise prudence towards AI adoption, ensuring secure implementation: Exploring safeguards and strategies.
