Full Report
Researchers identified active exploitation of CVE-2024-40766 in SonicWall's seventh-generation firewalls, specifically impacting SSL VPN functionality. Threat actors are bypassing multi-factor authentication (MFA), gaining privileged access, and deploying Akira ransomware. The...
Analysis Summary
# Vulnerability: SonicWall SSL VPN MFA Bypass Leading to Akira Ransomware Deployment
## CVE Details
- CVE ID: CVE-2024-40766
- CVSS Score: (Score not provided in context, generally high for MFA bypass/initial access)
- CWE: (CWE not provided in context)
## Affected Systems
- Products: SonicWall firewalls (Seventh-generation series)
- Versions: TZ and NSa-series running firmware version `7.2.0-7015` or earlier.
- Configurations: Impacting SSL VPN functionality.
## Vulnerability Description
The vulnerability, tracked as CVE-2024-40766, affects the SSL VPN functionality on specified SonicWall firewalls. When successfully exploited, it allows remote threat actors to bypass Multi-Factor Authentication (MFA) controls, resulting in unauthorized privileged access to the network perimeter.
## Exploitation
- Status: Exploited in the wild (Used for initial access by Akira ransomware operators)
- Complexity: (Complexity not explicitly stated, but MFA bypass often implies moderate complexity)
- Attack Vector: Network (Remote exploitation via SSL VPN)
## Impact
- Confidentiality: High (Privileged access allows data exfiltration, e.g., Veeam backups, NTDS.dit)
- Integrity: High (Ability to disable defenses and deploy ransomware)
- Availability: High (Deployment of Akira ransomware, wiping of recovery artifacts)
## Remediation
### Patches
- [Specific patching information not detailed in the context; users must consult SonicWall advisories for patched versions.]
### Workarounds
- [No specific workarounds provided in the context.]
## Detection
- Indicators of Compromise (IoCs):
- Anomalous logins using over-privileged service accounts (e.g., `sonicwall`, `LDAPAdmin`) bypassing MFA.
- Presence of persistence mechanisms such as Cloudflared tunnels or OpenSSH on the network.
- Execution of defense evasion commands (`Set-MpPreference`, `netsh`).
- Use of tools like `vssadmin.exe` to delete shadow copies preceding ransomware deployment.
- Detection methods and tools:
- Monitoring SSL VPN authentication logs for unexpected successful logins without MFA challenges.
- Endpoint Detection and Response (EDR) monitoring for abnormal lateral movement using WMI and PowerShell Remoting by perimeter accounts.
- Monitoring for the execution footprint associated with Akira ransomware deployment.
## References
- Vendor Advisories: (Requires external lookup based on CVE-2024-40766)
- Relevant links:
- hxxps://www.huntress.com/blog/exploitation-of-sonicwall-vpn