Akira's SonicWall Hacks Are Taking Down Large Enterprises

Businesses That Inherit SSL VPNs Through M&A Activity Falling Victim, Warn Experts Mathew J. Schwartz (euroinfosec) • November 26, 2025

A ransomware operation has discovered it can target large corporations by going after network security devices pitched to smaller enterprises. The market for SonicWall SSL VPN devices tends to be small- and medium-sized firms - but when those businesses are bought by larger businesses, the devices suddenly are part of a network worth real money to hackers.

See Also: On Demand | Ransomware in 2025: Evolving Threats, Exploited Vulnerabilities, and a Unified Defense Strategy

Often misconfigured and buggy, SonicWall devices are nonetheless popular for their ease of deployment and remote access features. It's a combination also prized by hackers for the Akira ransomware-as-a-service operation, which the group spent this summer popping overlooked devices folded into large corporations.

"This isn't just the usual story of hidden technologies slipping through ...