What the Akira MFA bypass campaign on SonicWall SSL VPNs says about OTP MFA at the edge of a higher-ed network

Arctic Wolf’s late-September 2025 report on the ongoing Akira ransomware campaign against SonicWall SSL VPN appliances centers on one fact: the actors logged in on accounts with one-time password MFA enabled, and the logins went through.¹ The usual assumption, that a password leak is survivable because a second factor stands behind it, does not hold when the second factor was stolen along with the password.

The stolen second factor

The bypass is not a new hole in the product. SonicWall ties the malicious logins to CVE-2024-40766, an improper access control flaw it patched in August 2024 and disclosed in September, which exposed administrative functions such as configuration backups on affected firewalls.¹ Arctic Wolf’s read is that the actors harvested local SSL VPN accounts and OTP seeds from those boxes and kept using the credentials after the patches landed.¹ A TOTP seed is a static secret. Whoever holds it generates a valid code for every challenge the appliance issues, and no firmware update changes that. BleepingComputer reported a parallel finding from Google’s threat intelligence team, which tracked a separate actor, UNC6148, that maintained access to fully patched, end-of-life SMA 100 series appliances with the OVERSTEP rootkit by replaying OTP seeds from earlier intrusions.² Patch the box, keep the accounts and seeds, and the MFA keeps passing.

The story continued in 2026

A second path into these firewalls appeared in the wild in 2026. Between February and March 2026, ReliaQuest responded to multiple intrusions into SonicWall Gen6 SSL-VPN appliances and assessed, with medium confidence, that they were the first in-the-wild exploitation of CVE-2024-12802 across multiple environments.³ That flaw works differently. SonicWall’s SSL-VPN treats UPN and SAM account names as different inputs when it integrates with Active Directory, so MFA can be enforced on one login format and left off the other. An attacker holding a valid credential logs in through the unenforced path and skips the OTP challenge.⁴ The appliances in ReliaQuest’s environments ran updated firmware and remained exposed, because those environments had skipped the advisory’s manual remediation: rebuild the LDAP configuration without a userPrincipalName in the qualified login name, remove cached LDAP users and the SSL VPN user domain, reboot, and make a fresh backup so the vulnerable config cannot be restored from an old file.⁴ On Gen7 and Gen8, the firmware update alone closes the hole.³

Dwell time in the single digits

The Akira campaign is fast by ransomware standards. Arctic Wolf measured internal port scanning within five minutes of the malicious logins, followed by Impacket SMB session setup requests, RDP logins, and Active Directory enumeration with dsquery, SharpShares, and BloodHound.¹ The actors aimed at backup infrastructure: a custom PowerShell script that pulled stored MSSQL and PostgreSQL credentials out of a Veeam Backup & Replication database and decrypted DPAPI secrets, plus new local administrator accounts under names like sqlbackup so the fresh logins would look routine.¹ To get past endpoint protection, they ran a bring-your-own-vulnerable-driver attack: a repackaged, Microsoft-signed consent.exe loading kernel drivers that disable EDR processes, staged under folder names that imitate known EDR products.¹ Encryption followed within four hours of initial access in almost every intrusion Arctic Wolf examined, with a staging interval as short as 55 minutes in some cases.¹

Early signals at the edge

A window this small changes what detection has to catch. The signals that matter sit at the VPN edge or one hop past it. A VPN login from a hosting-provider ASN, where your remote users should be sitting at home or on campus. A run of repeated OTP challenges on one account that still ends in a successful login, which is the log signature of token generation on the attacker’s side of the wire.¹ Impacket SMB session setup traffic, which is distinctive enough that I would alert on it on its own. Arctic Wolf used the first two to interrupt intrusions before encryption started, and that is the whole game when dwell time is measured in hours.¹

The higher-ed edge

Student and faculty VPN accounts, shared accounts, and Windows boxes with a shared local administrator password: this is where the attack shape lands first. Deployment in my environment is automated, and my work stops at the recommendation, so the check I would relay to the teams that own the firewalls is a short one. Inventory the SSL VPN appliances and compare their firmware history against the CVE-2024-40766 exposure window. Reset every local VPN account and its OTP seed on any appliance that ran vulnerable firmware, including the Active Directory accounts behind them. Verify that someone completed the CVE-2024-12802 remediation steps on Gen6 appliances with an LDAP integration, because the firmware update alone leaves the MFA bypass in place. Confirm whether cloud backup features were ever enabled, since SonicWall disclosed a separate incident in its MySonicWall cloud backup service in September 2025 with the same credential-reset shape.¹

MFA only guards the door while the seed stays yours. Patching the appliance closes the hole the credentials came through, and the reset is the step that closes the door.