Fog Ransomware greift SonicWall VPNs an, um in Unternehmensnetzwerke einzudringen

Teilen:

Fog and Akira ransomware operators are increasingly breaching corporate networks through SonicWall VPN accounts, with the threat actors believed to be exploiting CVE-2024-40766, a critical SSL VPN access control flaw.

SonicWall fixed the SonicOS flaw in late August 2024, and roughly a week later, it warned that it was already under active exploitation.

At the same time, Arctic Wolf security researchers reported seeing Akira ransomware affiliates leveraging the flaw to gain initial access to victim networks.

A new report by Arctic Wolf warns that Akira and the Fog ransomware operation have conducted at least 30 intrusions that all started with remote access to a network through SonicWall VPN accounts.

Of these cases, 75% are linked to Akira, with the rest attributed to Fog ransomware operations.

Interestingly, the two threat groups appear to share infrastructure, which shows the continuation of an unofficial collaboration between the two, as previously documented by Sophos.

While the researchers aren’t 100% positive the flaw was used in all cases, all of the breached endpoints were vulnerable to it, running an older, unpatched version.

In most cases, the time from intrusion to data encryption was short, at about ten hours, even reaching 1.5-2 hours on the quickest occasions.

In many of these attacks, the threat actors accessed the endpoint via VPN/VPS, obfuscating their real IP addresses.

Arctic Wolf notes that apart from operating unpatched endpoints, compromised organizations did not appear to have enabled multi-factor authentication on the compromised SSL VPN accounts and run their services on the default port 4433.

“In intrusions where firewall logs were captured, message event ID 238 (WAN zone remote user login allowed) or message event ID 1080 (SSL VPN zone remote user login allowed) were observed,” explains Artic Wolf.

“Following one of these messages, there were several SSL VPN INFO log messages (event ID 1079) indicating that login and IP assignment had completed successfully.”

In the subsequent stages, the threat actors engaged in rapid encryption attacks targeting mainly virtual machines and their backups.

Data theft from breached systems involved documents and proprietary software, but the threat actors didn’t bother with files that were older than six months, or 30 months old for more sensitive files.

Launched in May 2024, Fog ransomware is a growing operation whose affiliates tend to use compromised VPN credentials for initial access.

Akira, a far more established player in the ransomware space, has recently had Tor website access problems, as observed by BleepingComputer, but those are gradually returning online now.

Update 10/28: Japanese researcher Yutaka Sejiyama reports that ther are approximately 168,000 SonicWall endpoints vulnerable to CVE-2024-40766 right now, exposed to the internet.

Sejiyama also told BleepingComputer he has indications that Black Basta ransomware may also be leveraging the same flaw in attacks.

Bill Toulas

Kommentar verfassen

Deine E-Mail-Adresse wird nicht veröffentlicht. Erforderliche Felder sind mit * markiert

lade-bild
London, GB
1:30 pm, März 3, 2025
Wetter-Symbol 11°C
L: 10° | H: 13°
klarer Himmel
Luftfeuchtigkeit: 51 %
Druck: 1030 mb
Wind: 5 mph NE
Windböe: 0 mph
UV-Index: 0
Niederschlag: 0 mm
Wolken: 0%
Regen Chance: 0%
Sichtbarkeit: 10 km
Sonnenaufgang: 6:41 am
Sonnenuntergang: 5:43 pm
TäglichStündlich
Tägliche VorhersageStündliche Vorhersage
Today 9:00 pm
Wetter-Symbol
10° | 13°°C 0 mm 0% 4 mph 62 % 1029 mb 0 mm/h
Tomorrow 9:00 pm
Wetter-Symbol
4° | 12°°C 0 mm 0% 5 mph 75 % 1028 mb 0 mm/h
Mi. März 05 9:00 pm
Wetter-Symbol
4° | 14°°C 0 mm 0% 8 mph 71 % 1024 mb 0 mm/h
Do. März 06 9:00 pm
Wetter-Symbol
6° | 14°°C 0 mm 0% 12 mph 88 % 1020 mb 0 mm/h
Fr. März 07 9:00 pm
Wetter-Symbol
10° | 14°°C 0.72 mm 72% 12 mph 85 % 1012 mb 0 mm/h
Today 3:00 pm
Wetter-Symbol
11° | 11°°C 0 mm 0% 3 mph 46 % 1029 mb 0 mm/h
Today 6:00 pm
Wetter-Symbol
9° | 9°°C 0 mm 0% 4 mph 49 % 1029 mb 0 mm/h
Today 9:00 pm
Wetter-Symbol
7° | 7°°C 0 mm 0% 2 mph 62 % 1029 mb 0 mm/h
Tomorrow 12:00 am
Wetter-Symbol
6° | 6°°C 0 mm 0% 1 mph 68 % 1028 mb 0 mm/h
Tomorrow 3:00 am
Wetter-Symbol
5° | 5°°C 0 mm 0% 1 mph 72 % 1027 mb 0 mm/h
Tomorrow 6:00 am
Wetter-Symbol
4° | 4°°C 0 mm 0% 2 mph 75 % 1027 mb 0 mm/h
Tomorrow 9:00 am
Wetter-Symbol
6° | 6°°C 0 mm 0% 2 mph 53 % 1028 mb 0 mm/h
Tomorrow 12:00 pm
Wetter-Symbol
10° | 10°°C 0 mm 0% 2 mph 39 % 1026 mb 0 mm/h
Name Preis24H (%)
Bitcoin(BTC)
€89,327.55
8.76%
Ethereum(ETH)
€2,274.16
7.06%
XRP(XRP)
€2.56
18.23%
Fesseln(USDT)
€0.96
0.01%
Solana(SOL)
€157.72
16.04%
USDC(USDC)
€0.96
0.01%
Dogecoin(DOGE)
€0.212390
7.89%
Shiba Inu(SHIB)
€0.000013
3.53%
Pepe(PEPE)
€0.000008
8.24%
Peanut das Eichhörnchen(PNUT)
€0.231883
10.89%
Nach oben scrollen