GuidePoint Security’s latest report reveals a sophisticated Akira ransomware campaign exploiting SonicWall VPNs through the strategic use of malicious Windows drivers. The campaign, which began in late July 2025, represents a significant escalation in the group’s tactics for evading security controls.
From late July through early August 2025, multiple security vendors reported a surge in Akira ransomware deployments following SonicWall VPN exploitation. While the underlying cause remains disputed—potentially involving a zero-day vulnerability—SonicWall has acknowledged the activity but hasn’t disclosed specific vulnerability details.
Key technical findings
GuidePoint’s incident response teams identified two drivers consistently used by Akira affiliates in a Bring Your Own Vulnerable Driver (BYOVD) attack chain:
Primary Driver – rwdrv.sys: This legitimate driver from ThrottleStop, a Windows perf
[…]
Content was cut in order to protect the source.Please visit the source for the rest of the article.
[…]
Content was cut in order to protect the source.Please visit the source for the rest of the article.
This article has been indexed from CySecurity News – Latest Information Security and Hacking Incidents
Read the original article: