Researchers report an evolving campaign in which Akira ransomware affiliates are using compromised SonicWall SSL VPN credentials (and apparently stolen OTP seeds) to log into accounts even when one-time-password (OTP) MFA is enabled. Initial access has been tied back to credentials harvested via the improper access control flaw CVE-2024-40766 (disclosed and patched in 2024), but attackers continue to regain access to patched devices by reusing previously stolen credentials and seeds (Google’s GTIG similarly linked UNC6148 to reuse of stolen OTP seeds and the OVERSTEP rootkit on SMA appliances). Once inside, attackers move fast (internal scans within minutes), abuse Impacket SMB, RDP, and AD enumeration tools (dsquery, SharpShares, BloodHound), and focus on Veeam Backup & Replication servers; exfiltrating/decrypting MSSQL/Postgres credentials and DPAPI secrets via custom PowerShell. They also employ evasive techniques such as Bring Your Own Vulnerable Device (BYOVD) via Microsoft’s consent.exe to sideload malicious DLLs and vulnerable drivers that disable endpoint protections so ransomware can execute. CTIX analysts strongly urge users to follow the SonicWall guidance, installing the recommended SonicOS firmware (7.3.0 where applicable) and resetting all SSL VPN credentials on devices that ever ran vulnerable firmware, because patched devices may still be at risk from reused/stolen account material.