Through 2025 and 2026 security firms tracked a ransomware campaign that broke in through firewall VPNs and locked entire networks in about an hour — here is what to fix before it is your turn.
The gap between a single bad VPN login and your files being locked is now measured in minutes — not days. For years, the comfort blanket for small businesses was time: even if someone got in, you would surely notice the snooping, the odd login, the files being copied, long before anything went badly wrong. That assumption is no longer safe. Attackers are walking in through the one device that is meant to keep them out — the firewall — and finishing the job before most teams have finished their morning coffee.
What happened in the Akira ransomware attacks on SonicWall VPNs?
The Akira ransomware group broke into businesses through the SSL VPN on SonicWall firewalls and, in some cases, deployed ransomware roughly an hour after first access. Key IT's advice for Melbourne businesses is to patch and lock down any firewall VPN, rotate every VPN and admin credential, move to phishing-resistant MFA and have 24/7 SOC monitoring in place.
Through 2025 and into 2026, security firms including Arctic Wolf, Rapid7 and Darktrace tracked this aggressive campaign. The way in was the SSL VPN — the encrypted tunnel staff use to work remotely. Researchers linked the intrusions to CVE-2024-40766 (a vulnerability first disclosed in 2024) together with weak configurations and credentials that had never been rotated. Once inside, the attackers went from that first login to encryption with very little warning.
The point of this post is not "SonicWall is bad." Every major firewall vendor has shipped a serious flaw, and the next campaign will target a different brand. The lesson is about the category of device — the internet-facing edge — and the fact that it is now the front door criminals try first. Treat any specific CVE figure here as accurate at the time of writing and check the relevant vendor advisory for the current status; the advice below holds regardless of which logo is on your firewall.
Why do ransomware gangs target the firewall VPN first?
Ransomware gangs go after the firewall VPN first because it is, by design, reachable from anywhere in the world. That is what makes it useful for remote staff — and what makes it the single most valuable target on your network. If it is running old firmware, exposes its admin or VPN portal to the whole internet, or still has accounts using passwords from three years ago, you have left the front door unlocked and lit.
Patch the edge first, not last
Firewalls, VPN gateways and other internet-facing kit deserve the fastest patch cycle you have, because a flaw in them is a flaw the whole internet can reach.
Rotate credentials after any patch
Several intrusions in this campaign succeeded because old usernames and passwords were still valid even after the device was updated. Patching closes the hole; rotating credentials evicts anyone who already had a key.
Shrink the attack surface
Restrict VPN and admin access to known users and locations where you can, and turn off services you do not use.
Does MFA stop SSL VPN attacks like Akira?
Not on its own. This is the detail that unsettles most business owners: researchers observed Akira intrusions that got past a valid one-time-code MFA challenge. Multi-factor authentication still matters enormously and you should absolutely have it on — but the older style, where you type a six-digit code from an app or SMS, can be defeated. Attackers phish the code in real time (one reason the old phishing advice no longer works), or wear users down with repeated prompts until someone taps "approve" to make it stop.
The fix is not to abandon MFA — it is to move toward phishing-resistant methods (passkeys and hardware security keys), tighten conditional-access rules, and treat identity as something you actively monitor, not a box you ticked at setup. Strong identity controls sit at the heart of the Essential Eight, the framework we use to baseline every client.
If dwell time is an hour, someone has to be watching at 2am
"Dwell time" is how long an intruder sits in your network before doing damage. When that window was weeks, a business-hours IT check was enough. When it is an hour — and the attack lands at 2am on a Sunday because that is when no one is looking — there is no human safety net unless someone, or something, is watching around the clock.
This is the gap 24/7 security monitoring fills. Key IT's 24/7 SOC (Security Operations Centre) service watches client environments day and night, paired with endpoint detection and response (EDR) on every device so that the moment ransomware behaviour appears — mass file encryption, processes killing your backups — it can be isolated automatically before it spreads. A machine reacts in seconds; a Monday-morning email does not. You can see how this works on our 24/7 SOC page.
How do you stop ransomware spreading across your network?
You stop ransomware spreading by assuming something will get through and making sure it cannot finish the job: segment the network, keep immutable offline backups and rehearse your response. Good security is layered precisely because no single layer is perfect — even with a patched firewall and strong identity, you plan for the day something slips past.
Segment your network
If the VPN connects to a flat network where every server and PC can reach every other one, one compromised login becomes everything. Segmentation contains the blast radius: when Key IT handles business network setup in Melbourne, staff, guest, device and payment traffic each get their own network, with firewall rules deciding what may talk to what. A penetration test then shows whether those internal walls actually hold.
Keep backups offline and tested
Akira and groups like it go after backups first. Immutable, off-network copies — that you have actually restored from in a drill — are what turn a catastrophe into a bad afternoon. That is the job of disaster recovery and business continuity.
Have an incident response plan you have rehearsed
When the clock is measured in minutes, "who do we call and what do we do first" cannot be invented on the day. Our incident response team is built for exactly that moment.
What a Melbourne business owner should do this week
Find out what is on your edge
What firewall and VPN do you run, what firmware version, and when was it last patched? If no one can answer in five minutes, that is the first thing to fix. Key IT's vulnerability scanning (from $149 per month, Australia-wide) checks your firewall and other internet-facing systems every month for known weaknesses, so a missed firewall patch gets flagged rather than quietly forgotten.
Rotate VPN and admin credentials
Especially any that pre-date your last firmware update.
Check who is watching after hours
If the honest answer is "nobody", you are relying on luck against attacks that arrive overnight on purpose.
Confirm your backups are offline and recently tested
A backup you have never restored is a hope, not a plan.
Frequently asked questions
Does this only affect SonicWall firewalls?
No. This particular campaign focused on SonicWall SSL VPNs, but the underlying lesson applies to every brand of internet-facing firewall and VPN. The risk comes from the type of device — anything reachable from the public internet — not from one vendor. Any major firewall is a target if it is unpatched, exposed or using old credentials.
I have MFA turned on. Am I safe from this?
MFA is essential and you should keep it on, but in this campaign researchers saw intrusions that defeated older one-time-code MFA through real-time phishing and prompt fatigue. The stronger position is phishing-resistant MFA such as passkeys or hardware keys, combined with conditional-access rules and identity monitoring, so a stolen code alone is not enough.
How can ransomware encrypt a whole network in under an hour?
Once an attacker is through the VPN, a flat internal network and unmonitored servers let them move sideways quickly, disable backups and trigger encryption everywhere at once. Speed comes from automation and a lack of internal barriers. Network segmentation, EDR and 24/7 monitoring are what slow it down and stop it — see what happens during a ransomware attack.
Are small Melbourne businesses really a target for ransomware groups?
Yes. These campaigns scan the internet for vulnerable firewalls automatically — they do not check your size first. A smaller business with an unpatched VPN and no after-hours monitoring is often an easier win than a large enterprise, which is why the "too small to be a target" idea is a myth.
What is CVE-2024-40766?
CVE-2024-40766 is a critical access-control flaw in SonicWall's SonicOS firewall software, published in August 2024 and added to the US CISA list of actively exploited vulnerabilities. Researchers linked it to the Akira VPN intrusions. Where old local passwords were never reset, patching alone did not lock attackers out, so treat a password reset as part of the fix.
How do I check whether my firewall VPN is exposed?
Find your firewall's model and firmware version and compare it with the vendor's latest security advisory. Then check whether the VPN or admin portal can be reached from the whole internet, and whether MFA is enforced on every VPN account. An external vulnerability scan shows you much of what an outside attacker can see.
What should we do if we think our firewall VPN has been breached?
Do not wipe or rebuild anything yet, as you may destroy evidence. Disable the VPN at the firewall, disconnect affected machines from the network and call your IT provider (or Key IT on 1300 053 948) straight away so credentials can be reset safely. Report it to ASD's ACSC through ReportCyber at cyber.gov.au or on 1300 CYBER1.
How exposed is your business? A free cybersecurity health check gives you an Essential Eight snapshot and your top three risks.
Request the Free Check