A recently discovered bug in SonicWall SonicOS firewall instances is being used in ransomware attacks, multiple researchers have confirmed.
SonicWall recently reported finding, and patching, an improper access control vulnerability affecting its Gen 5, Gen 6, and Gen 7 firewalls, as well as the firewalls’ SSLVPN feature. The bug is tracked as CVE-2024-40766, and does not yet have a severity score assigned.
Now, the company has warned the bug is being actively exploited in the wild, and urged its users to apply the patch without hesitation. Soon after, security researchers from both Arctic Wolf and Rapid7 said the same thing, with the former pinning the attacks on Akira ransomware affiliates.
False sense of privacy
Akira was first spotted in March 2023 and has since raided dozens of companies. Akira’s affiliates target mostly enterprises, but they don’t seem to favor any specific vertical, as so far they targeted firms in education, finance, real estate, manufacturing, and consulting industries.
Besides operating flawed instances, the companies that recently fell prey to Akira did another thing – kept MFA disabled for high-value accounts.
“MFA was disabled for all compromised accounts, and the SonicOS firmware on the affected devices were within the versions known to be vulnerable to CVE-2024-40766,” commented Stefan Hostetler, a Senior Threat Intelligence Researcher at Arctic Wolf.
CVE-2024-40766 has also been added to CISA’s Known Exploited Vulnerabilities (KEV) catalog, which also means federal agencies have a deadline to patch up, or stop using the instances entirely. The deadline is September 30.
Those who are unable to apply the patch immediately are advised to restrict firewall management and SSLVPN access to trusted sources, and to enable multi-factor authentication for all SSLVPN users using TOTP or email-based one-time passwords (OTP).
Via BleepingComputer
More from TechRadar Pro
https://cdn.mos.cms.futurecdn.net/cJtFPyQYv7tobzbzvGKgSX-1200-80.jpg
Source link
