CVE-2024-40766Active Exploitation(sonicwall / nsa_2650)

DFIR Weekly Recap | This week brought zero-days, supply chain hits, and persistent access campaigns across nearly every layer of the enterprise stack. - CVE-2024-40766: SonicWall patch closed the bug but misconfigured devices stayed exposed. - Turla's STOCKSTAY expands the Russian 🇷🇺 group's intelligence-gathering toolset. - CVE-2026-33017 Langflow flaw weaponized to drop a Monero cryptominer. - VBScript campaign uses WhatsApp to distribute RMM software for stealthy access. - CVE-2026-20245 zero-day actively exploited in Cisco Catalyst SD-WAN Manager. - Klue supply chain attackdetectable through artifacts left in Salesforce instances. - Photo ZIP phishing hits hospitality sector, delivering a Node.js implant for persistence. - netlogon.log captures Kerberos authentication detail that Event 1644 simply misses. - StealC and Amadey expose the layered cybercrime-as-a-service economy behind infostealer delivery. - Payouts King ransomware broker deploys new Edgecution malware as an initial access tool. Top stories in the thread below. #DFIR_Radar

CVE-2024-40766 (CVSS 9.3) in SonicWall SSLVPN has been exploited by Akira and Fog ransomware since Sept 2024. Patching firmware is not remediation: stale accounts, broken LDAP config, and an exposed MFA enrollment portal are keeping patched firewalls wide open. Key findings: - Akira and Fog operators compromised SonicWall Gen 5/6/7 firewalls at scale, with encryption occurring in under 4 hours and some cases in 55 minutes. In Sept 2025 SonicWall confirmed the MySonicWall cloud platform was breached and all configuration backup files containing encrypted credentials were exposed. Any org with a MySonicWall account should treat its backup as compromised and rotate credentials now. - CVE-2024-12802 adds a second layer on Gen 6: a firmware patch alone does not fix this MFA bypass. Six manual LDAP reconfiguration steps from SNWLID-2025-0001 are required. Devices that looked patched by version were still fully exploitable. Gen 6 reached end-of-life April 16, 2026. No more patches are coming. - Across 14 audited firewalls: 12 had stale local accounts not in AD, including usernames with non-printable characters (a strong indicator of automated account creation by exploitation tooling). 11 had never rotated local passwords post-upgrade. 9 had the Default LDAP User Group granting implicit SSLVPN access to every AD account. - The Virtual Office Portal (MFA/TOTP enrollment) was internet-exposed on 7 of 14 firewalls. #DFIR_Radar

Ransomware groups Akira and Fog have exploited CVE-2024-40766 in SonicWall SonicOS firewalls since September 2024, with nearly 49,000 vulnerable devices exposed publicly as of December 2024, http://Isc.Sans.Edu reported. #Ransomware #Vulnerability https://t.co/UtbedyaMpp

Akira ransomware operators exploited CVE-2024-40766 via SSL VPNs on SonicWall Gen 7 firewalls, breaching networks and pivoting to domain controllers, Bitdefender and Huntress reported. #Vulnerability #InfoSec https://t.co/ZyPVJmnHp9

Sonic's whole thing is speed. Akira didn't even need to hustle. 🦔 213,900 SonicWall interfaces are reachable right now, the same components tied to CVE-2024-40766. A fix has existed for two years, but Akira is still getting in. Patch it. https://bit.ly/4xgqpfu

How do you pass an OTP prompt you cannot see? Researchers assess the operators are replaying stolen OTP seeds, most likely harvested from earlier exploitation of CVE-2024-40766. Steal the seed, generate the codes forever.

📌 CVE-2024-40766: The Patch Fixed the Bug. Nobody Fixed the Configuration., (Tue, Jun 23rd)

Ep.676 - RadioCSIRT Édition Française - Flash info Au sommaire de cette édition : 🔐 GnuPG corrige la CVE-2026-57062 dans gpgsm : l'analyse du format CMS accepte une longueur ICV de quatre octets au lieu des douze attendus pour AES-GCM, affaiblissant le contrôle d'intégrité. GnuPG jusqu'à 2.5.20 est concerné, en lien avec la CVE-2026-34182. CVSS 3.1 à 2.9. (CVEFeed / MITRE) 🐧 Le noyau Linux 7.1 est publié par Linus Torvalds le 14 juin 2026 : nouveau pilote NTFS en espace noyau (iomap, folios), Intel FRED activé par défaut, contrôles Landlock étendus aux sockets UNIX et suppression de plus de 140 000 lignes de code hérité. (Linux Journal) 🚨 Les agences Five Eyes publient une déclaration commune le 22 juin 2026 sur la transformation du risque cyber par l'intelligence artificielle : réduction de la fenêtre entre découverte et exploitation, appel à traiter le risque comme un enjeu métier, priorité aux fondamentaux et intégration de l'IA dans la défense. (CISA) 🔓 MISP Core corrige la CVE-2026-56423 : un défaut de contrôle d'accès dans les suppressions en masse permettait à un utilisateur contributeur de supprimer définitivement des Event Reports et Sharing Groups d'autres organisations à l'échelle de l'instance. Exploitable à distance. CVSS 3.1 HIGH à 9.4, CVSS 4.0 CRITICAL. (CVEFeed / CIRCL) 🛡️ Le SANS ISC détaille les configurations SonicWall vulnérables après correctif de la CVE-2024-40766 (CVSS 9.3, exploitée par Akira et Fog depuis septembre 2024) : comptes locaux obsolètes, mots de passe non renouvelés, groupe LDAP par défaut trop permissif, portail Virtual Office exposé permettant un contournement MFA. La CVE-2024-12802 vise le contournement MFA sur les équipements Gen 6 en fin de vie. (SANS Internet Storm Center) Pour écouter l'épisode: https://www.radiocsirt.org/podcast/ep-676-radiocsirt-edition-francaise-flash-info-cybersecurite-du-mardi-23-juin-2026/

🚨 #GüvenlikBülteni #SiberGüvenlik: SonicWall Güvenlik Duvarlarında Kritik Yetkisiz Erişim Riski (CVE-2024-40766) Bülten Tarihi: 23 Haziran 2026 Referans: CVE-2024-40766 / CISA KEV Etkilenen Cihazlar: SonicWall Gen 5, Gen 6 ve Gen 7 (SonicOS 7.0.1-5035 ve altı) Etki Seviyesi: KRİTİK (Yetkisiz Erişim / Kimlik Doğrulama Atlama - CVSS: 9.3) SonicWall SonicOS'ta bulunan kritik bir güvenlik açığının fidye yazılımı grupları tarafından aktif olarak istismar edildiği bildirildi. Uzmanlar, yalnızca yama uygulamanın yeterli olmayabileceği konusunda uyarıyor. 📌 Ne Oluyor? CVE-2024-40766, yönetim arayüzleri ve SSLVPN servislerindeki erişim kontrolü eksikliğinden kaynaklanıyor. Saldırganlar, internete açık yönetim panelleri veya VPN servisleri üzerinden yetkisiz erişim sağlamaya çalışabiliyor. ⚠️ Riskler Neler? • Yetkisiz erişim girişimleri • SSLVPN hesaplarının hedef alınması • MFA korumalarının aşılması • Fidye yazılımı saldırıları • Ağ kaynaklarının ele geçirilmesi Araştırmalara göre #Akira ve #Fog grupları bu açığı aktif olarak kullanıyor. 🛡️ Alınabilecek Önlemler 1️⃣ SonicOS'u güncel sürüme yükseltin. 2️⃣ Yönetim arayüzlerini internet erişimine kapatın. 3️⃣ SSLVPN erişimlerini IP kısıtlamalarıyla sınırlandırın. 4️⃣ VPN loglarını düzenli inceleyin. 5️⃣ EOL durumundaki Gen 6 cihazları değiştirin. 📊 Neden Önemli? Bu açık, fidye yazılımı operasyonlarında ilk erişim noktası olarak kullanılıyor. İnternete açık güvenlik duvarları kurumsal ağlar için ciddi risk oluşturuyor. 🔚 Sonuç SonicWall kullanan kurumların yalnızca yamalara değil, erişim politikaları ve cihaz sıkılaştırmalarına da odaklanması gerekiyor.

A security update without a clear owner can become a ransomware entry point. Microsoft reported: “In September 2025, Microsoft tracked a four-week surge in Akira ransomware across 50+ organizations—mostly small and medium-sized businesses—tied to CVE-2024-40766 (SonicWall SSL VPN exploitation).” Source: Microsoft Digital Defense Report 2026, published October 5, 2026. The problem isn’t always a lack of security tools. It’s often a lack of structure. When updates are managed separately, it can be hard to see which system is exposed, who’s responsible for patching it, and whether the work was finished. Think of a repair bench where every piece of equipment needs a service tag. If an urgent tag gets buried or has no assigned owner, the equipment can return to service with the problem still inside. Our security protocol work brings those tags into one practical system: a complete inventory, clear ownership, urgency rankings, documented update routines, and a dashboard that tracks completion. See how clearer patch ownership can strengthen your digital foundation. Visit http://moveworth.com #Cybersecurity #SmallBusinessSecurity #DigitalInfrastructure #SystemsBeforeGrowth #TurnUpYourDigital

NØØT Security Alerts Classification: Critical CVE: CVE-2024-40766 Product: SonicWall / SonicOS Summary: VulnCheck reports real-world exploitation activity affecting SonicWall / SonicOS. Evidence: Ransomware use confirmed; Active exploitation reported; Severe impact class Impact: The vulnerability is associated with ransomware activity and may contribute to compromise of exposed systems. Action: Prioritize vendor remediation, identify exposed affected systems, and investigate for evidence of exploitation when applicable. Date: 23 Apr 2024 Source: https://vulncheck.com/ #NØØT #CyberSecurity #InfoSec #ThreatIntelligence #CyberThreats #CVE #CyberDefense #SonicWall #SonicOS #CVE_2024_40766 #ActiveExploitation #Exploit #Ransomware #RansomwareAttack

⏱️ 90 MINUTES TO BLACKOUT: Fog Ransomware on SonicWall! 🌫️💻 Adversaries weaponize SonicOS CVE-2024-40766 to breach perimeters & encrypt VMware ESXi VMDKs in 90 min. 👉 Analysis: https://sh3llc0d3.com/blog/fog-ransomware-weaponizes-sonicwall-ssl-vpn-vulnerability-cve-2024-40766-rapid-90-minute-intrusions-leading-to-esxi-hypervisor-encryption/ #sh3llc0d3 #shellcode #Ransomware #SonicWall #ESXi

Attackers are chaining CVE-2024-40766 and CVE-2024-29014 to achieve unauthenticated RCE on SonicWall SMA 1000 appliances. Following edge device compromise, threat actors pivot into internal network segments and establish persistent C2 channels. Runtime segmentation can help limit blast radius from compromised network infrastructure. #ZeroDay #CloudSecurity :link: Full breakdown: https://aviatrix.ai/threat-research-center/sonicwall-sma1000-cve-2026-83548-cve-2026-83549-zero-days-actively-exploited

A SANS audit of 14 patched SonicWall firewalls shows Akira ransomware still getting in via stale accounts and LDAP misconfigurations the firmware update never touched. SonicWall CVE-2024-40766 Proves Patching Is Not Rem... https://f.mtr.cool/koakeembxl

CVE-2024-40766 in #SonicWall firewalls actively exploited for persistent unauthorized access. Threat actors establish rogue accounts, harvest credentials, and enroll malicious TOTP devices within compromised environments to maintain long-term network access. https://t.co/fbERXRPHMl

#SonicWall CVE-2024-40766 Proves #Patching Is Not Remediation https://latesthackingnews.com/2026/06/23/sonicwall-cve-2024-40766-patching-not-enough/

TRC analysis shows ransomware groups exploiting CVE-2024-40766 in SonicWall SSL VPNs to achieve data encryption within 55 minutes of initial compromise. Attackers leverage VPN access for persistent C2 and lateral movement through compromised credentials. Runtime segmentation can help contain post-compromise pivoting across network segments. #ZeroTrust #Vulnerability 🔗 Full breakdown: https://aviatrix.ai/threat-research-center/cve-2024-40766-sonicwall-ransomware-exploitation

SonicWall CVE-2024-40766 Proves Patching Is Not Remediation: A SANS audit of 14 patched SonicWall firewalls shows Akira ransomware still getting in via stale accounts and LDAP misconfigurations the firmware update never touched. SonicWall… https://latesthackingnews.com/2026/06/23/sonicwall-cve-2024-40766-patching-not-enough/?utm_source=dlvr.it&utm_medium=twitter https://t.co/Ma8VzuiZ71

🔴 Critical CVE-2024-40766 (CVSS: N/A) [CISA KEV: ACTIVELY EXPLOITED] [EPSS: 15.7%]: A vulnerability was patched but still exploited because misconfigured systems weren't fixed. via SANS ISC https://t.co/jOkFMknPJo

🚨 #CVE-2024-40766: The Patch Was Installed The Breach Path Remained Open + Video -Fact Checker: ✅: 3 ❌: 2 || 3/5 → Score: 60% ⚖️ -Prediction: 📈 3 Positive | 📉 3 Negative http://undercodenews.com/cve-2024-40766-the-patch-was-installed-the-breach-path-remained-open-video/