F5 Threat Report - October 1st, 2025

Smash and Grab: Aggressive Akira Campaign Targets SonicWall VPNs, Deploys Ransomware in an Hour or Less

An aggressive Akira ransomware campaign, active since late July 2025, targets SonicWall firewalls through malicious SSL VPN logins, often bypassing One-Time Password (OTP) Multi-Factor Authentication. This activity is linked to prior exploitation of CVE-2024-40766, an improper access control vulnerability affecting SonicOS versions 6 and 7. Upon gaining initial access, threat actors rapidly perform internal network scanning using tools like SoftPerfect Network Scanner and Advanced IP Scanner, and utilize the Impacket library for SMB activity and lateral movement via RDP. Active Directory enumeration is conducted with built-in tools and specialized utilities such as SharpShares, NetExec, BloodHound, and ldapdomaindump. A key tactic involves extracting Veeam Backup & Replication credentials from SQL or PostgreSQL databases using a custom PowerShell script that decrypts DPAPI secrets and temporarily modifies PostgreSQL configurations. For persistence and command and control, attackers create local and domain administrator accounts, install RMM tools like AnyDesk, TeamViewer, and RustDesk, and establish SSH reverse tunnels or Cloudflare Tunnels using `cloudflared`. Defense evasion techniques include disabling legitimate RMM tools, deleting Volume Shadow Copies, disabling User Account Control, and attempting to disable EDR and Windows Defender. A sophisticated Bring-Your-Own-Vulnerable-Driver (BYOVD) technique is employed, using Microsoft-signed `consent.exe` to load malicious DLLs (`wmsgapi.dll`, `msimg32.dll`) that deploy vulnerable drivers (`rwdrv.sys`, ``churchill_driver.sys`)` to tamper with Windows Access Control Lists and neutralize security software. Data staging involves WinRAR for archiving, followed by exfiltration using `rclone` or FileZilla to virtual private server infrastructure. Ransomware deployment, typically within four hours of initial access, uses executables like `akira.exe` or `locker.exe` to encrypt drives and network shares. To mitigate these threats, organizations should reset all SSL VPN and associated Active Directory credentials on SonicWall devices that ran vulnerable firmware, monitor for VPN logins originating from untrusted hosting infrastructure and anomalous Impacket SMB activity, block logins from non-business regions and VPS providers, and consider implementing SSO/SAML for VPN authentication and App Control for Business (WDAC) to restrict execution from untrusted paths and enforce kernel-mode code integrity.

Severity: Critical

Sources

• https://arcticwolf.com/resources/blog/smash-and-grab-aggressive-akira-campaign-targets-sonicwall-vpns/
• https://arcticwolf.com/resources/blog-uk/september-2025-update-on-aggressive-ongoing-akira-ransomware-campaign/
• https://blog.intellibron.io/static-analysis-of-akira-ransomware/
• https://buaq.net/go-366327.html
• https://cyberpress.org/akira-ransomware-3/
• https://cyberscoop.com/sonicwall-akira-ransomware-attacks-surge/
• https://gbhackers.com/sonicwall-firewalls/
• https://it.slashdot.org/story/25/09/27/2055246/escalation-in-akira-campaign-targeting-sonicwall-vpns-deploying-ransomware-with-malicious-logins?utm_source=rss1.0mainlinkanon&utm_medium=feed
• https://meterpreter.org/akira-ransomware-exploits-unpatched-sonicwall-flaws-are-you-at-risk/
• https://www.bleepingcomputer.com/news/security/akira-ransomware-breaching-mfa-protected-sonicwall-vpn-accounts/
• https://www.bleepingcomputer.com/news/security/akira-ransomware-exploiting-critical-sonicwall-sslvpn-bug-again/
• https://www.helpnetsecurity.com/2025/09/11/akira-ransomware-sonicwall-firewalls/
• https://www.helpnetsecurity.com/2025/09/16/akira-ransomware-disable-edr/
• https://www.hendryadrian.com/akira-ransomware-exploits-sonicwall-vpn/
• https://www.hendryadrian.com/akira-ransomware-group-utilizing-sonicwall-devices-for-initial-access/
• https://www.scworld.com/news/sonicwall-ssl-vpns-still-under-attack-from-akira-ransomware-group
• https://www.securityweek.com/akira-ransomware-attacks-fuel-uptick-in-exploitation-of-sonicwall-flaw/
• https://www.securityweek.com/akira-ransomwares-exploitation-of-sonicwall-vulnerability-continues/
• https://www.theregister.com/2025/09/10/akira_ransomware_abusing_sonicwall/
• https://www.theregister.com/2025/09/15/ransomware_recovery_codes_plaintext/

Threat Details and IOCs

Mitigation Advice

• Immediately reset passwords for all local user accounts on SonicWall firewalls configured for SSL VPN access.
• Immediately reset passwords for all Active Directory user and service accounts that are permitted to authenticate to the SonicWall SSL VPN or are used for LDAP synchronization.
• Create firewall rules to block all inbound and outbound traffic from the IP addresses and ASNs listed as malicious in the article's Indicators of Compromise table.
• Use your EDR solution to run a targeted threat hunt across all endpoints for the file names, file paths, and file hashes associated with the Akira ransomware campaign as listed in the article.
• Configure your network monitoring tools or SIEM to generate an alert for SMB session setup requests that match the signature of the Impacket library, particularly originating from the VPN client subnet.
• Review Veeam logs for signs of compromise, such as unauthorized access to the configuration database or the execution of the credential extraction PowerShell script detailed in the article.

Compliance Best Practices

• Initiate a project to migrate SonicWall SSL VPN authentication from local credentials and LDAP to a centralized identity provider using SSO/SAML.
• Use an application control solution like Windows Defender Application Control (WDAC) to create and enforce a policy that blocks known vulnerable drivers, including `rwdrv.sys` and `churchill_driver.sys`.
• Develop and deploy an application control policy to block the execution of unauthorized remote management and tunneling software, including AnyDesk, RustDesk, and Cloudflared.
• Harden the Veeam Backup & Replication server by placing it in a secure network segment, restricting administrative access, and applying strict access controls to the underlying SQL or PostgreSQL database.
• Analyze business requirements and implement geofencing policies on the firewall to block SSL VPN connections from countries and regions where there is no business need for access.
• Create a custom detection rule in your EDR or SIEM to alert on the execution of PowerShell commands containing `Set-MpPreference` with parameters aimed at disabling Windows Defender's security features.
• Design and implement a network segmentation strategy to isolate critical systems, such as domain controllers and backup servers, from general user subnets and the VPN client address pool.
• Implement an application control policy, such as with Windows Defender Application Control (WDAC), to deny the execution of executables, scripts, and DLLs from common user-writable directories like `%ProgramData%`, `%TEMP%`, and user `Downloads` folders.

---

UK and US Security Agencies Order Urgent Fixes as Cisco Firewall Bugs Exploited in Wild

Cybersecurity agencies, including the Cybersecurity and Infrastructure Security Agency (CISA) and the UK's National Cyber Security Centre (NCSC), have issued urgent warnings regarding active exploitation of Cisco Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD) firewall vulnerabilities, tracked as CVE-2025-20333 and CVE-2025-20362, by an "advanced threat actor." CISA issued an Emergency Directive, mandating federal agencies to identify affected devices, check logs for compromise, and apply Cisco's fixes within 24 hours, also requiring the removal of end-of-life ASA boxes. These flaws, when chained, allow attackers to remotely implant malware, execute commands, exfiltrate data, and gain complete control of devices. Cisco confirmed it was aware of exploitation since May, linking the activity with "high confidence" to the ArcaneDoor campaign, attributed to a state-sponsored threat group dubbed UAT4356, which previously exploited zero-day flaws in ASA and FTD firewalls in April 2024 to compromise government and telecom networks globally using bespoke tooling for espionage. This incident follows closely on the heels of another actively exploited zero-day in Cisco IOS software.

Severity: Critical

Sources

• https://eclypsium.com/blog/cisco-asa-scanning-surge-cyberattack/
• https://thehackernews.com/2025/09/urgent-cisco-asa-zero-day-duo-under.html
• https://www.cyberkendra.com/2025/09/hackers-exploit-cisco-firewall-zero.html
• https://www.infosecurity-magazine.com/news/arcanedoor-attacks-against-cisco/
• https://www.securityweek.com/cisco-firewall-zero-days-exploited-in-china-linked-arcanedoor-attacks/
• https://www.theregister.com/2025/09/26/cisco_firewall_flaws/

Threat Details and IOCs

Mitigation Advice

• Inventory all network devices to identify Cisco Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD) models.
• Apply the patches released by Cisco for vulnerabilities CVE-2025-20333 and CVE-2025-20362 on all identified Cisco ASA and FTD firewalls immediately.
• Analyze firewall logs on all Cisco ASA and FTD devices for indicators of compromise associated with the ArcaneDoor campaign, such as unexpected reboots, unauthorized configuration changes, or suspicious outbound connections.
• Immediately identify and remove any Cisco ASA devices that are at or near their end-of-life date from the network.

Compliance Best Practices

• Evaluate and develop a strategy to diversify network security vendors for critical perimeter devices to avoid over-reliance on a single manufacturer.
• Implement a formal asset lifecycle and patch management policy that mandates regular hardware refresh cycles and enforces strict timelines for applying critical security patches.
• Design and implement a network segmentation architecture to isolate critical server environments from user workstations and other less-sensitive network zones.
• Deploy egress traffic filtering rules on the network perimeter to block all outbound traffic by default and only allow connections necessary for business operations.

---

Cisco ASA Firewall Zero-Day Exploits Deploy RayInitiator and LINE VIPER Malware

Threat actors, attributed to the suspected China-linked group UAT4356 (Storm-1849) and the ArcaneDoor cluster, have exploited zero-day vulnerabilities in Cisco Adaptive Security Appliance (ASA) 5500-X Series devices since May 2025, targeting government agencies. These attacks leverage CVE-2025-20362 (CVSS 6.5) and CVE-2025-20333 (CVSS 9.9) to bypass authentication and execute malicious code, deploying sophisticated, previously undocumented malware families: RayInitiator and LINE VIPER. RayInitiator is a persistent GRUB bootkit that survives reboots and firmware upgrades, sometimes modifying ROMMON on older, end-of-support ASA 5500-X models lacking Secure Boot, to load LINE VIPER. LINE VIPER, a user-mode shellcode loader, enables command execution, packet capture, VPN authentication bypass, syslog suppression, CLI command harvesting, and delayed reboots, communicating via WebVPN/HTTPS or ICMP/raw TCP, and employs advanced evasion techniques like modifying the "lina" binary. Cisco has released patches for these and a third critical flaw, CVE-2025-20363 (CVSS 8.5/9.0), urging organizations to update their Cisco ASA and FTD products to counter these threats.

Severity: Critical

Sources

• https://cyberinsider.com/cisa-orders-emergency-action-on-malware-targeting-cisco-firewalls/
• https://thehackernews.com/2025/09/cisco-asa-firewall-zero-day-exploits.html

Threat Details and IOCs

Mitigation Advice

• Immediately create an inventory of all Cisco ASA, FTD, IOS, IOS XE, and IOS XR devices on the network to identify potentially affected systems.
• Apply the latest security patches from Cisco to all identified Adaptive Security Appliance (ASA) and Secure Firewall Threat Defense (FTD) devices to mitigate CVE-2025-20362 and CVE-2025-20333.
• Apply the latest security patches from Cisco to all identified ASA, FTD, IOS, IOS XE, and IOS XR devices to mitigate the critical remote code execution vulnerability CVE-2025-20363.
• Analyze network traffic logs for unusual ICMP traffic paired with raw TCP responses or suspicious WebVPN client authentication sessions over HTTPS, which are indicators of LINE VIPER C2 communications.
• Review system logs on all Cisco ASA devices for evidence of compromise, such as unexplained reboots, gaps in logging, or unauthorized configuration changes.

Compliance Best Practices

• Develop and execute a phased plan to replace all End-of-Support (EoS) Cisco ASA 5500-X series firewalls with modern devices that support features like Secure Boot.
• Update the organization's hardware procurement policy to mandate that all new network infrastructure devices must include Secure Boot and hardware trust anchor technologies.
• Implement strict access control lists (ACLs) to restrict public internet access to the management interfaces and VPN web services of all network boundary devices.
• Establish a formal asset lifecycle management program to track all network hardware and software, ensuring that equipment is replaced before it reaches its End-of-Support (EoS) date.

---

Critical Flaw in Linux ksmbd (CVE-2025-38561) Enables Remote Code Execution in the Kernel

A critical remote code execution vulnerability, CVE-2025-38561, has been discovered in the Linux kernel's ksmbd component by Nicholas Zubriski of Trend Research. This flaw affects all Linux distributions that utilize the built-in ksmbd-based SMB server, enabling attackers to execute arbitrary code with the highest system privileges. The vulnerability originates from a threading synchronization error during SMB2 session establishment, specifically improper handling of the `Preauth_HashValue` field, which creates a race condition leading to memory corruption and execution flow manipulation within kernel space. Although exploitation requires valid credentials, the severity is high, with a CVSS score of 8.5, given the common exposure of SMB services and the potential for credential theft. The vulnerability was privately reported on July 22, 2025, with public disclosure on September 24, 2025. Fixes, which introduce proper locking mechanisms to prevent race conditions, have been incorporated into the latest Linux kernel versions. Administrators are strongly advised to immediately apply these updates from their distribution maintainers, reboot affected machines, and reassess SMB service exposure, as no temporary mitigations or workarounds are available.

Severity: Critical

Sources

• https://cyberpress.org/linux-kernel-ksmbd-vulnerability/
• https://gbhackers.com/linux-kernel-ksmbd-flaw-2/
• https://meterpreter.org/critical-flaw-in-linux-ksmbd-cve-2025-38561-enables-remote-code-execution-in-the-kernel/
• https://www.zerodayinitiative.com/advisories/ZDI-25-916/
• https://www.zerodayinitiative.com/advisories/ZDI-25-917/

Threat Details and IOCs

Mitigation Advice

• Use a vulnerability scanner or asset inventory system to identify all Linux hosts on the network that are running the ksmbd service.
• Apply the latest kernel security updates from your Linux distribution's package manager to all identified vulnerable systems.
• Reboot all Linux systems immediately after the kernel update is applied to ensure the new, patched kernel is loaded into memory.

Compliance Best Practices

• Review and update firewall rules to ensure that SMB services are not exposed to the internet and are only accessible from trusted internal network zones.
• Implement and enforce a policy for strong, unique passwords for all user and service accounts, and prioritize deploying multi-factor authentication (MFA) on all administrative accounts.
• Develop a formal patch management policy that defines service level agreements (SLAs) for applying security updates based on vulnerability severity, with a specific, accelerated timeline for critical kernel vulnerabilities.

---

Salesforce Patches Critical ForcedLeak Bug Exposing CRM Data via AI Prompt Injection

A critical vulnerability, codenamed ForcedLeak (CVSS 9.4), was identified by Noma Security in Salesforce Agentforce, an AI agent platform, enabling the exfiltration of sensitive CRM data. This flaw specifically impacted organizations utilizing Agentforce with the Web-to-Lead functionality enabled, leveraging an indirect prompt injection. Attackers would submit a malicious description within a Web-to-Lead form; when an internal employee processed this lead via a standard AI query, Agentforce executed both legitimate and hidden instructions. This allowed the system to query the CRM for sensitive lead information and transmit it to an attacker-controlled, previously Salesforce-allowlisted, expired domain. The vulnerability exploited weaknesses in context validation, overly permissive AI model behavior, and a Content Security Policy bypass, as the underlying Large Language Model (LLM) could not distinguish between legitimate data and malicious instructions. Salesforce has since addressed the issue by re-securing the expired domain and implementing patches that enforce a URL allowlist mechanism for Agentforce and Einstein AI agents, preventing output to untrusted URLs. Users are advised to enforce Trusted URLs, audit existing lead data for suspicious submissions, implement strict input validation, and sanitize data from untrusted sources.

Severity: Critical

Sources

• https://cyberpress.org/flaw-in-salesforce-ai/
• https://gbhackers.com/salesforce-ai-agent-vulnerability/
• https://hackread.com/forcedleak-salesforce-agentforce-ai-agent-crm-data/
• https://thehackernews.com/2025/09/salesforce-patches-critical-forcedleak.html
• https://www.cyberkendra.com/2025/09/critical-forcedleak-flaw-lets-attackers.html
• https://www.infosecurity-magazine.com/news/critical-flaw-salesforce-agentforce/

Threat Details and IOCs

Mitigation Advice

• For Salesforce administrators, immediately configure and enforce the 'Trusted URL allowlist' for Agentforce and Einstein AI agents to prevent data exfiltration to unauthorized domains.
• Scan all existing Salesforce 'Web-to-Lead' form submissions, specifically looking for suspicious instructions or code-like syntax within the 'Description' field to identify past or ongoing attacks.

Compliance Best Practices

• Develop and implement a policy for strict input validation on all 'Web-to-Lead' forms to detect and block submissions containing characters or patterns indicative of prompt injection attacks.
• Establish an automated data sanitization pipeline for all data ingested from untrusted sources, such as public-facing web forms, before it is processed by Salesforce Agentforce or any other internal AI system.
• Initiate a security review of all AI agent configurations, including Salesforce Agentforce, to ensure they operate under the principle of least privilege and cannot perform sensitive actions or access data beyond their intended function.
• Implement a recurring process to audit all security allow-lists, including Salesforce Trusted URLs, to verify domain ownership and remove any domains that are expired or no longer controlled by the trusted entity.

---