The Akira ransomware group has intensified its attacks on SonicWall devices, exploiting misconfigurations and a year-old flaw (CVE-2024-40766) to gain initial access. Rapid7 and SonicWall warn that Akira actors are combining brute-force credential attacks, LDAP SSL VPN misconfigurations, and abuse of the Virtual Office Portal to bypass access controls and establish persistence. This activity aligns with Akira’s broader surge in 2025, where it ranked as the third most active ransomware group, responsible for at least seventy-nine (79) incidents in Q2, particularly targeting manufacturing and transportation sectors. Recent campaigns also leveraged SEO poisoning to drop Bumblebee malware, which delivers AdaptixC2 for post-exploitation, remote access, and eventual ransomware deployment. CTIX analysts urge organizations utilizing SonicWall next-generation firewalls to follow the security guidance to rotate and remove unused accounts, enforce MFA/TOTP, restrict portal access, and audit SonicWall configurations to prevent compromise.