Reading time: ~9 minutes | Audience: CISOs, SOC leadership, vulnerability management owners

When the FBI, CISA, DC3, HHS, and four European partner agencies reissued the Akira advisory (AA24-109A) on 13 November 2025, they named eight CVEs. It is a short list for a group that has extracted roughly $244.17 million in ransom proceeds since March 2023, encrypts a network in under an hour, and, in at least one documented case, moved from initial access to completed exfiltration in just over two hours.

Most coverage of that advisory reprinted the eight CVEs and stopped. That is the least useful thing you can do with them.

The list is worth reading closely — but for what it reveals about Akira's operating model, not as a patch queue. Three findings stand out, and each has uncomfortable implications for how most vulnerability management programs are run.

The list

Note the CVE-2024-40766 discrepancy: SonicWall, as CNA, scored it 9.3; NVD and several trackers list it as 9.8. Both circulate in vendor reporting. Use the vendor score when reconciling against SonicWall's own advisory (SNWLID-2024-0015), and use the NVD score when feeding a scanner.

Finding one: the severity scores misprice this set

Median CVSS across Akira's eight CVEs is 7.5. Three of the eight score below 7.0. Only two clear 9.0.

If your patch SLA is severity-driven — criticals in 7 days, highs in 30, mediums in 90, which is roughly the industry default — then five of the eight vulnerabilities that the most commercially successful ransomware operation on earth actually uses fall outside your emergency lane. CVE-2023-20269, the Cisco ASA remote-access VPN flaw that CISA has named in both the 2024 and 2025 versions of this advisory, scores 5.0. A medium.

This is not an argument that CVSS is broken. It is an argument that CVSS measures what it says it measures — intrinsic technical severity under standard assumptions — and that adversary preference is an entirely different variable. Akira does not select for exploit elegance. It selects for reachability: internet-facing, present in mid-market environments, and adjacent to credentials.

The practical correction is not new, but this list is unusually clear evidence for it. Exploitation-based prioritization — CISA KEV membership, EPSS, and named-actor attribution — should override base score for anything internet-facing. If a medium-severity flaw in your VPN concentrator is in KEV and in a joint advisory, it is not a medium in your environment.

Finding two: the patch is not the remediation

The single most instructive item on the list is CVE-2024-40766.

SonicWall disclosed it on 23 August 2024 and shipped a patch the same day. CISA added it to KEV on 9 September 2024. By any conventional metric, that vulnerability was closed business by autumn 2024.

Akira's best quarter ever was Q4 2025.

From late July 2025 onward, incident responders observed a surge in intrusions targeting SonicWall SSL VPN — malicious logins were followed within minutes by port scanning, Impacket SMB activity, and ransomware deployment, frequently within an hour. Researchers initially suspected a zero-day. SonicWall's investigation of fewer than 40 incidents concluded otherwise: the activity correlated with CVE-2024-40766 and was concentrated in organizations that had migrated from Gen 6 to Gen 7 firewalls without resetting local user passwords. Credentials harvested from the device while it was vulnerable were carried forward through the upgrade and used against a patched appliance.

Two details deserve to survive the summary. First, attackers successfully authenticated to accounts with OTP-based MFA enabled, and the responders who documented the campaign were explicit that they could not fully explain the bypass. Second, one MSP's research unit counted more than 70 victims in October 2025 alone from internet-exposed SonicWall devices — a year and two months after the patch existed.

The generalizable lesson is one that vulnerability management programs are structurally bad at absorbing: for any flaw whose impact is credential exposure, patching closes the vulnerability and does nothing about the exposure. The remediation unit is the credential, not the CVE. A firewall running current firmware with seventeen stale local accounts, an unrotated LDAP bind credential, and an overpermissive default group remains unaddressed. It has newer firmware and the same attack surface.

If you have SonicWall SSL VPN in the estate and you patched in 2024 but never rotated, you are in scope today.

Finding three: the advisory's own categorization is imprecise, and it matters

CISA lists all eight CVEs under Initial Access. Two of them are not initial access vulnerabilities in any ordinary sense.

CVE-2023-28252 is a local privilege escalation in the Windows CLFS driver. It requires code execution on the host before it does anything. CVE-2024-37085 is an ESXi authentication bypass that requires sufficient Active Directory privileges to re-create a deleted group. Neither gets an attacker through the perimeter; both are what an attacker reaches for after arriving.

This is not a criticism of the advisory so much as a caution about how it gets consumed. If you build your detection strategy around the initial-access framing, you will overinvest at the edge and miss the two stages in which Akira actually converts a foothold into an enterprise-wide outcome.

Read the list as three functional clusters instead:

Entry (Cisco ASA/FTD, SonicWall SonicOS). Internet-facing remote access, historically without enforced MFA. Four of the eight.

Credential and backup plane (Veeam). CVE-2023-27532 exposes credentials stored in the backup configuration database; CVE-2024-40711 provides unauthenticated RCE, and CISA separately documents Akira being abused Veeam.Backup.MountService.exe for privilege escalation. Backup infrastructure is uniquely valuable to a double-extortion operator: it holds broad credentials, it has reach into everything worth encrypting, and destroying it removes the victim's alternative to paying. Rapid7 has noted that Veeam access or exploitation has featured in a meaningful share of its 2024 incident response caseload.

Impact multiplier (ESXi, and now Nutanix AHV). CVE-2024-37085 converts AD privilege into hypervisor control. In a June 2025 incident, Akira encrypted Nutanix AHV virtual machine disk files for the first time, exploiting CVE-2024-40766 — extending a capability that previously covered VMware ESXi and Hyper-V.

Detection coverage should be weighted accordingly. Akira's technique density is highest in privilege escalation, defense evasion, and credential access — not in the exploit itself.

What changed in 2026

The SonicWall vector is decaying. GuidePoint's tracking put Akira at 226 observed victims in Q4 2025 and 176 in Q1 2026 — a 22% decline, largely attributed to the diminishing yield of the SSL VPN campaign that produced the group's outlier quarters in Q3 and Q4 2025. Other trackers observed 84 victims in March 2026. The group remains active and near the top of the ransomware landscape; it is not what it was in late 2025.

Read that as vector rotation, not decline. Akira's affiliate model has repeatedly demonstrated that when one edge-appliance campaign exhausts itself, another begins. Fortinet SSO and SAML bypass flaws disclosed across late 2025 and January 2026 have already drawn broad ransomware interest and are the obvious candidates for the next cycle. Plan for the pattern, not the product.

Also worth tracking: an Akira-imitating campaign against Windows users in South America surfaced in early 2026, using a Babuk-derived encryptor that appends the .akira extension and mimics the group's ransom note and Tor URLs. If your attribution pipeline keys on file extension or note content, it will now produce false positives.

Six priorities, in order

1. Rotate before you patch, or immediately after. Every credential that ever lived on an appliance affected by CVE-2024-40766, CVE-2020-3259, or CVE-2023-27532 should be treated as disclosed. Local firewall accounts, LDAP-synchronized AD accounts, and the LDAP bind credential.
2. Phishing-resistant MFA on all remote access. Akira has bypassed OTP-based MFA in the wild. TOTP is no longer a sufficient control on an internet-facing VPN.
3. Treat the backup plane as tier-zero. Veeam and equivalent backup servers should be isolated from the internet, segmented from general user networks, credentialed independently, and monitored as closely as domain controllers.
4. Reprioritize by exploitation, not base score. KEV membership and named-actor attribution should escalate anything internet-facing, regardless of the CVSS score.
5. Build detections for the middle of the chain. BYOVD driver loads (POORTRY and its STONESTOP loader), EDR uninstall attempts, nltest /dclist: and nltest /DOMAIN_TRUSTSnew local accounts added to administrator groups, unexpected AnyDesk/LogMeIn/Ngrok/Cloudflare traffic, and NTDS.dit extraction via VMDK detach-and-mount.
6. Assume a sub-two-hour window. Alert-to-containment targets built around a multi-day dwell time do not apply here. When exfiltration completes in two hours, detection engineering and IR runbooks have to be tuned to the minute.

Why Organizations Choose Zaxtron

Organizations face increasingly sophisticated ransomware campaigns that exploit unpatched systems, stolen credentials, exposed remote access, and third-party weaknesses. To stay protected, they need actionable intelligence, not just alerts, to identify and reduce cyber risks before disruption occurs. Zaxtron provides Cybersecurity Risk Management, AI Risk Management, and Cyber Threat Intelligence services that deliver continuous visibility and risk-based insights. By combining attack surface intelligence, vulnerability data, threat and breach intelligence, and third-party risk analysis, Zaxtron offers a complete view of cyber exposure. This helps security leaders respond to threats, improve vendor security, and make informed decisions. Contact Zaxtron to strengthen cyber resilience today.

Sources

• FBI, CISA, DC3, HHS, Europol EC3, and partners. #StopRansomware: Akira Ransomware, AA24-109A. Originally 18 April 2024; updated 13 November 2025. https://www.cisa.gov/news-events/cybersecurity-advisories/aa24-109a (advisory PDF: https://www.ic3.gov/CSA/2025/251113.pdf)
• Arctic Wolf Labs. Smash and Grab: Aggressive Akira Campaign Targets SonicWall VPNs, Deploys Ransomware in an Hour or Less. September 2025. https://arcticwolf.com/resources/blog/smash-and-grab-aggressive-akira-campaign-targets-sonicwall-vpns/
• SonicWall product notice / The Hacker News. SonicWall Confirms Patched Vulnerability Behind Recent VPN Attacks, Not a Zero-Day. August 2025. https://thehackernews.com/2025/08/sonicwall-confirms-patched.html
• Rapid7. Critical Improper Access Control Vulnerability Affecting SonicWall Devices (CVE-2024-40766). September 2024. https://www.rapid7.com/blog/post/2024/09/09/etr-cve-2024-40766-critical-improper-access-control-vulnerability-affecting-sonicwall-devices/
• Rapid7. Multiple Vulnerabilities in Veeam Backup & Replication (CVE-2024-40711). September 2024. https://www.rapid7.com/blog/post/2024/09/09/etr-multiple-vulnerabilities-in-veeam-backup-and-replication/
• SANS Internet Storm Center. CVE-2024-40766: The Patch Fixed the Bug. Nobody Fixed the Configuration. June 2026. https://isc.sans.edu/diary/33094
• ConnectWise CRU. Akira Ransomware. 2026. https://www.connectwise.com/blog/akira-ransomware
• GuidePoint Security ransomware reporting, via Industrial Cyber. April 2026. https://industrialcyber.co/reports/ransomware-reaches-elevated-new-normal-as-attack-volumes-hold-steady-into-2026-reshape-baseline-risk-expectations/
• Darktrace. Inside Akira's SonicWall Campaign. October 2025. https://www.darktrace.com/blog/inside-akiras-sonicwall-campaign-darktraces-detection-and-response
• Tenable. CVE-2023-20269: Zero-Day Vulnerability in Cisco ASA and FTD. September 2023. https://www.tenable.com/blog/cve-2023-20269-zero-day-vulnerability-in-cisco-asa-and-ftd-reportedly-exploited-ransomware-groups
• Agenzia per la Cybersicurezza Nazionale (Italy). Akira perimeter exploitation campaign analysis. https://www.acn.gov.it/portale/en/w/akira-campagne-di-sfruttamento-sistematico-di-vulnerabilita-perimetrali-e-accessi-vpn

Editorial notes — remove before publication

1. CVSS figures should be re-verified against NVD on the day of publication. Scores are revised. CVE-2024-40766 already carries two competing values (9.3 vendor / 9.8 NVD), and the table flags this; the others are single-sourced to ACN and vendor advisories.
2. The $244.17M figure is FBI-reported as of late September 2025 and is a claimed-proceeds estimate, not an audited total. It is now roughly ten months stale. Consider presenting "more than $244 million as of late 2025" rather than as current.
3. Victim counts are leak-site and IR-derived, not confirmed breaches. GuidePoint's 226/176 and the 84-in-March-2026 figure count claimed victims. Different vendors count differently, and the numbers are not directly comparable across sources. The post uses them for trend direction only, which is defensible; do not let an editor turn them into precise claims.
4. The MFA bypass remains unexplained in public reporting. The post says so. Do not let this be tightened to "Akira bypasses MFA" as a general capability claim — the documented cases are specifically OTP-based MFA on SonicWall SSL VPN.
5. The critique of CISA's initial-access categorization is our analysis, not a documented error. It is defensible and useful, but it is an editorial position. If Zaxtron would rather not appear to correct a joint government advisory, soften to "worth reading functionally rather than by advisory heading."
6. The Fortinet-as-next-vector claim is a forecast at moderate confidence. It is an inference based on Akira's demonstrated pattern of edge-appliance rotation and the existence of exploitable Fortinet auth-bypass flaws. It is not attributed to Akira's activity. Keep the hedging language intact.
7. The "seventeen stale local accounts" phrasing is a paraphrased illustration drawn from the SANS ISC diary's argument about post-patch configuration debt, not a Zaxtron finding. If you would rather not carry a borrowed specific, change to "a dozen-plus stale local accounts."
8. Akira attribution names (Storm-1567, Howling Scorpius, Punk Spider, Gold Sahara) and the possible Conti lineage were omitted from the body to keep the post focused. Add a sentence if the audience expects actor-tracking context. The Conti link is characterized by CISA as possible, not established — keep that qualifier if you add it.