A zero-day vulnerability in SonicWall VPNs is actively exploited to bypass MFA and deploy Akira ransomware, with threat actors quickly targeting domain controllers after initial access. Immediate action is advised, including disabling SonicWall VPN services or restricting access and auditing service accounts. #SonicWall #AkiraRansomware #LDAPAdmin
Keypoints
- A zero-day vulnerability is exploited in SonicWall Secure Mobile Access (SMA) and firewall appliances to bypass MFA and enable ransomware deployment.
- Attackers gain administrative access by abusing over-privileged LDAP or service accounts used by SonicWall devices.
- Threat actors establish persistence using Cloudflared tunnels and OpenSSH installed in system directories.
- Credential theft is performed through dumping Veeam Backup databases and backing up NTDS.dit for offline cracking.
- Security defenses such as Microsoft Defender and Windows Firewall are disabled using built-in Windows tools before ransomware deployment.
- Ransomware payload identified is Akira, with volume shadow copies deleted to prevent recovery.
- Immediate mitigation includes disabling SonicWall VPN or restricting it with IP allow-listing and auditing service account privileges.
MITRE Techniques
- [T1003] Credential Dumping – Attackers dumped and decrypted credentials from Veeam Backup databases and backed up NTDS.dit for offline cracking (“using wbadmin.exe to back up the NTDS.dit Active Directory database”).
- [T1078] Valid Accounts – Attackers gained administrative access by abusing over-privileged LDAP or SonicWall service accounts (“leveraging an over-privileged LDAP or service account used by the SonicWall device”).
- [T1083] File and Directory Discovery – Enumeration of network and domain information was conducted using tools like Advanced_IP_Scanner and nltest (“Used Advanced_IP_Scanner, nltest.exe to enumerate accounts and trusted domains”).
- [T1112] Modify Registry – Persistence was established by adding registry keys for new user accounts (“reg.exe add … SpecialAccountsUserList”).
- [T1140] Deobfuscate/Decode Files or Information – Attackers used scripts and tools to decrypt stolen credentials (“running scripts to dump and decrypt credentials”).
- [T1185] Man-in-the-Middle – Command and Control established through Cloudflared tunnels and OpenSSH (“deploy Cloudflared tunnels and OpenSSH, often staged out of C:ProgramData”).
- [T1499] Endpoint Denial of Service – Disabling defenses by turning off Microsoft Defender and Windows Firewall with Set-MpPreference and netsh.exe (“using Set-MpPreference to neuter Microsoft Defender and netsh.exe to disable the firewall”).
- [T1562] Impair Defenses – Before ransomware deployment, multiple security controls were disabled (“methodically disable security tools before deploying ransomware”).
- [T1486] Data Encrypted for Impact – Deployment of Akira ransomware after deleting volume shadow copies (“Vssadmin.exe delete shadows /all /quiet” and “deploying what we assess to be Akira ransomware”).
Indicators of Compromise
- [IP Addresses] Attacker infrastructure – 42.252.99[.]59, 45.86.208[.]240, 77.247.126[.]239, plus multiple others linked to Clouvider and ReliableSite ASNs.
- [File Hashes] Ransomware executable – d080f553c9b1276317441894ec6861573fa64fb1fae46165a55302e782b1614d (w.exe).
- [File Names] Ransomware executables and attacker tools – win.exe, C:ProgramDatawinrar.exe, C:ProgramDataOpenSSHa.msi, C:Program FilesOpenSSHsshd.exe.
- [User Accounts] Malicious accounts created by attackers – backupSQL, lockadmin.
- [Passwords] Passwords used by attackers – Password123$, Msnc?42da, VRT83g$%ce.
- [Domains/ASN] Hosting adversary infrastructure – AS24863 LINK-NET, AS62240 Clouvider, AS23470 ReliableSite LLC, AS174 COGENT-174.
Read more: https://www.huntress.com/blog/exploitation-of-sonicwall-vpn