# Team Cymru Infrastructure Analysis: Seven Active Ransomware Gangs (Akira, DragonForce, Clop, MedusaLocker, Qilin, INC Ransom, Lynx) Abuse Dual-Use Tools and Exploit SonicWall, Gladinet CentreStack, and FortiGate Devices

> Team Cymru's year-long infrastructure analysis (April 2025-April 2026) of seven active ransomware operations finds heavy convergence on legitimate dual-use tools (Rclone, Cobalt Strike, AnyDesk, FileZilla, SimpleHelp, Chisel) over custom malware, VPN/Tor/SOCKS-proxy obfuscation, and exploitation of internet-facing SonicWall SSL VPN devices (CVE-2024-40766), the Gladinet CentreStack/Triofox managed file transfer service (CVE-2025-30406, CVE-2025-11371, CVE-2025-14611), and Fortinet FortiGate appliances.

- **Published:** 2026-09-15T00:00:00Z
- **Last reviewed:** 2026-11-04T12:14:40.353Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-2517
- **ID:** TL-2026-2517
- **Severity:** HIGH
- **Category:** RANSOMWARE
- **Status:** ACTIVE
- **Actor:** Akira (Malaysia)
- **Detections:** 9 (1 shown free below) · **IOCs:** 31
- **CVEs:** CVE-2024-40766, CVE-2025-30406, CVE-2025-11371, CVE-2025-14611

## Description

Team Cymru's Ransomware Infrastructure Analysis synthesizes 20+ incident investigations between April 2025 and April 2026 into cross-gang infrastructure and TTP patterns for seven active ransomware operations -- Akira, DragonForce, Clop, MedusaLocker, Qilin, INC Ransom, and Lynx (a rebrand of INC Ransom sharing over 90% of its source code) -- with a LockBit3 (leaked-builder) incident also documented. The analysis, which primarily covers intrusions against UK small-to-medium enterprises, finds a decisive shift away from custom-coded malware toward abuse of legitimate dual-use tools: Rclone and FileZilla for exfiltration, Cobalt Strike for post-exploitation C2, and AnyDesk/SimpleHelp for hands-on-keyboard remote access -- a pattern Team Cymru's Scout platform tags consistently across all seven groups.

Initial access converges on three exploitation vectors. First, Akira's sustained 2025 campaign against SonicWall SonicOS SSL VPN devices via CVE-2024-40766 (CVSS 9.3), an improper access-control flaw in which local account passwords carried over from Gen5/Gen6 firmware migrations were never reset; CISA and Arctic Wolf documented dozens of intrusions moving from SSL VPN login to full encryption in under four hours, with some as fast as 55 minutes. Second, Clop's December 2025 mass-exploitation of internet-facing Gladinet CentreStack/Triofox managed file transfer servers, chaining a hardcoded IIS machineKey (CVE-2025-30406, CVE-2025-14611) with an unauthenticated local file inclusion flaw (CVE-2025-11371) into a ViewState deserialization remote code execution primitive, staged from commercial VPN egress (Cloudflare WARP, Private Internet Access) across AS396073, AS51852, and AS50049. Third, DragonForce's continued reliance on RDP brute-forcing for both initial access and lateral movement. Lynx's February 2026 incident followed exploitation of a Fortinet FortiGate appliance, a vector later connected to the wider 'FortiBleed' mass credential-theft campaign (86,644+ affected devices across 194 countries) that SOCRadar publicly attributed to INC Ransom and Lynx ransomware deployments in July 2026.

Post-compromise, the gangs converge again on VPN/Tor/SOCKS-proxy obfuscation: DragonForce anonymizes operator traffic over Tor; multiple groups route through commercial VPN services (1VPN, Cloudflare WARP, Private Internet Access) and low-reputation VPS hosting spread across dozens of distinct ASNs to frustrate attribution and takedown; and MedusaLocker's March 2026 incident chained an open-source Chisel tunneling implant with a Cloudflare Worker to stand up a reverse SOCKS proxy for covert command and control. Qilin and MedusaLocker both exfiltrated over SFTP/OpenSSH from single staging nodes supporting multiple post-compromise objectives, while Akira and INC Ransom relied on Rclone syncs to cloud storage. No group in this analysis window deployed custom-coded lateral-movement or C2 malware, consistent with CISA's Akira advisory (AA24-109A), which documents Akira's reliance on commodity tools (Mimikatz, AdFind, PowerTool/Zemana-driver AV killers, Cobalt Strike, AnyDesk) and living-off-the-land techniques -- including volume shadow copy deletion and EDR/AV tampering ahead of ChaCha20/RSA hybrid encryption -- over bespoke malware.

## MITRE ATT&CK

- T1595 Active Scanning
- T1583.006 Web Services
- T1190 Exploit Public-Facing Application
- T1133 External Remote Services
- T1078 Valid Accounts
- T1021.001 Remote Desktop Protocol
- T1219 Remote Access Tools
- T1572 Protocol Tunneling
- T1090 Proxy
- T1090.003 Multi-hop Proxy
- T1071.001 Web Protocols
- T1048 Exfiltration Over Alternative Protocol
- T1567.002 Exfiltration to Cloud Storage
- T1685 Disable or Modify Tools
- T1490 Inhibit System Recovery
- T1110 Brute Force
- T1021.004 Remote Services
- T1570 Lateral Tool Transfer
- T1486 Data Encrypted for Impact
- T1657 Financial Theft
- T1583.003 Acquire Infrastructure
- T1588.002 Obtain Capabilities

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**SonicWall SSL VPN Rapid Login-to-Internal-Access Pivot (CVE-2024-40766)** (`TL-2026-2517-SPL-001`)

Detects the Akira-pattern exploitation of CVE-2024-40766 (improper access control letting local SonicWall SSL VPN accounts with passwords carried over from Gen5/Gen6 firmware migrations authenticate unexpectedly). Flags SSL VPN logins from local/legacy accounts that are immediately followed (within minutes) by internal SMB/RDP/WinRM connections from the VPN-assigned address -- the sub-hour login-to-encryption pattern CISA and Arctic Wolf documented, with some intrusions completing in under 55 minutes.

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1190, T1133, T1078
- **Data sources:** sonicwall_ssl_vpn_logs, network_firewall_logs, windows_security
- **Severity:** critical
- **Confidence:** high

### Splunk SPL

```spl
`comment("CVE-2024-40766: SonicWall SSL VPN local-account login followed by rapid internal pivot")`
index=network sourcetype=sonicwall:vpn OR sourcetype="cisco:cef" tag=vpn tag=authentication action=success user_type=local
| eval vpn_login_time=_time
| table _time, user, src_ip, dest_ip, vpn_assigned_ip, vpn_login_time
| join type=inner vpn_assigned_ip
    [ search index=network (sourcetype="cisco:asa" OR sourcetype="stream:tcp") dest_port IN (445,3389,5985,5986)
      | eval internal_conn_time=_time
      | table src_ip AS vpn_assigned_ip, dest_ip AS internal_dest, dest_port, internal_conn_time ]
| eval minutes_to_pivot=round((internal_conn_time-vpn_login_time)/60,1)
| where minutes_to_pivot>=0 AND minutes_to_pivot<=15
| table _time, user, src_ip, vpn_assigned_ip, internal_dest, dest_port, minutes_to_pivot
| sort - minutes_to_pivot
```

### Microsoft KQL

```kql
// CVE-2024-40766: SonicWall SSL VPN (CEF/CommonSecurityLog) local-account login -> rapid internal pivot
let vpnLogins = CommonSecurityLog
| where TimeGenerated > ago(24h)
| where DeviceVendor == "SonicWall" and Activity has "SSLVPN" and DeviceEventClassID has "login"
| where AdditionalExtensions has "local" or SourceUserName !contains "@"
| project LoginTime = TimeGenerated, SourceUserName, SourceIP, DestinationIP;
let internalConns = DeviceNetworkEvents
| where TimeGenerated > ago(24h)
| where RemotePort in (445, 3389, 5985, 5986)
| project ConnTime = TimeGenerated, LocalIP, RemoteIP, RemotePort, DeviceName;
vpnLogins
| join kind=inner (internalConns) on $left.DestinationIP == $right.LocalIP
| extend MinutesToPivot = datetime_diff('minute', ConnTime, LoginTime)
| where MinutesToPivot between (0 .. 15)
| project LoginTime, SourceUserName, SourceIP, DestinationIP, ConnTime, RemoteIP, RemotePort, DeviceName, MinutesToPivot
| sort by MinutesToPivot asc
```

### Sigma

```yaml
title: SonicWall SSL VPN Local Account Login With Rapid Internal Pivot (CVE-2024-40766)
id: a1e4c9b2-7d3f-4a1e-9c5a-2f6b8d1e4a01
status: experimental
description: Detects a SonicWall SSL VPN authentication from a local/legacy account immediately followed by internal SMB/RDP/WinRM connections, consistent with CVE-2024-40766 exploitation and the Akira sub-hour login-to-encryption pattern.
references:
    - https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-40766
    - https://arcticwolf.com/resources/blog/smash-and-grab-aggressive-akira-campaign-targets-sonicwall-vpns/
author: AII-Detector — ThreadLinqs Intelligence
date: 2026-09-15
tags:
    - attack.initial-access
    - attack.t1190
    - attack.t1133
    - attack.t1078
    - cve.2024.40766
    - attack.group.akira
logsource:
    category: firewall
    product: sonicwall
detection:
    selection_login:
        Activity|contains: 'SSLVPN'
        AccountType: 'local'
        EventOutcome: 'success'
    selection_pivot:
        DestinationPort:
            - 445
            - 3389
            - 5985
            - 5986
    timeframe: 15m
    condition: selection_login | near selection_pivot
falsepositives:
    - Legitimate remote administrators using a documented local break-glass VPN account followed immediately by scheduled RDP/SMB maintenance
level: high
```

**Known false positives:**

- Documented break-glass local VPN accounts used by MSPs/admins performing legitimate rapid post-VPN RDP/SMB maintenance from the same session

**Tuning notes:** Baseline the normal population of local (non-SSO) SonicWall accounts per tenant and exclude known MSP break-glass accounts; tighten the pivot window to <5 minutes for high-confidence Akira-speed intrusions and widen to 60 minutes for a lower-severity hunting variant. Cross-reference source/assigned IPs against CISA KEV CVE-2024-40766 advisory guidance.

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- Gladinet CentreStack/Triofox ViewState Deserialization RCE Chain (CVE-2025-30406/CVE-2025-11371/CVE-2025-14611) (locked: unlock with TL Creds)
- High-Volume Rclone/SFTP Exfiltration to Cloud Storage or External SSH Endpoint (locked: unlock with TL Creds)
- Chisel Tunnel Chained With Cloudflare Worker Reverse SOCKS Proxy / Tor and Multi-Hop Proxy Egress (locked: unlock with TL Creds)
- FortiGate FortiBleed Mass Credential-Theft Scan Pattern Followed by VPN Logon (locked: unlock with TL Creds)
- Unsanctioned SimpleHelp/AnyDesk RMM Install Followed by Rclone Staging (locked: unlock with TL Creds)
- Cobalt Strike Named-Pipe Beacon Combined With SOCKS Proxy Egress to Reported C2 Infrastructure (locked: unlock with TL Creds)
- Dual-Use RMM/Exfil Tool Install Chain Post-Exploitation (Rclone/AnyDesk/FileZilla/SimpleHelp) (locked: unlock with TL Creds)
- RDP Brute-Force to Lateral Movement Chained With Cobalt Strike Beacon Pattern (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sources

- [Ransomware Infrastructure Analysis](https://www.team-cymru.com/post/ransomware-infrastructure-analysis)
- [#StopRansomware: Akira Ransomware](https://www.cisa.gov/news-events/cybersecurity-advisories/aa24-109a)
- [CISA Known Exploited Vulnerabilities Catalog - CVE-2024-40766](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-40766)
- [SonicWall SSL VPN Flaw and Misconfigurations Actively Exploited by Akira Ransomware Hackers](https://thehackernews.com/2025/09/sonicwall-ssl-vpn-flaw-and.html)
- [Akira ransomware exploiting critical SonicWall SSLVPN bug again](https://www.bleepingcomputer.com/news/security/akira-ransomware-exploiting-critical-sonicwall-sslvpn-bug-again/)
- [Smash and Grab: Aggressive Akira Campaign Targets SonicWall VPNs](https://arcticwolf.com/resources/blog/smash-and-grab-aggressive-akira-campaign-targets-sonicwall-vpns/)
- [CVE-2025-30406: Investigating a CVSS Score That Didn't Add Up](https://www.intruder.io/research/cve-2025-30406-gladinet-centrestack)
- [RCE flaw in MSP-friendly file sharing platform exploited by attackers (CVE-2025-30406)](https://www.helpnetsecurity.com/2025/04/09/rce-gladinet-centrestack-file-sharing-exploited-cve-2025-30406/)
- [Active Attacks Exploit Gladinet's Hard-Coded Keys for Unauthorized Access and Code Execution](https://thehackernews.com/2025/12/hard-coded-gladinet-keys-let-attackers.html)
- [CISA Adds Gladinet and CWP Flaws to KEV Catalog Amid Active Exploitation Evidence](https://thehackernews.com/2025/11/cisa-adds-gladinet-and-cwp-flaws-to-kev.html)
- [Clop ransomware targets Gladinet CentreStack servers for extortion](https://www.bleepingcomputer.com/news/security/clop-ransomware-targets-gladinet-centrestack-servers-for-extortion/)
- [CLOP targets Gladinet CentreStack servers in large-scale extortion campaign](https://securityaffairs.com/185875/cyber-crime/clop-targets-gladinet-centrestack-servers-in-large-scale-extortion-campaign.html)
- [Lynx Ransomware: A Rebranding of INC Ransomware](https://unit42.paloaltonetworks.com/inc-ransomware-rebrand-to-lynx/)
- [FortiBleed: The Campaign That Cracked 86,644 Firewalls](https://socradar.io/blog/fortibleed-fortinet-firewalls-compromised/)
- [FortiBleed Credential Theft Linked to INC and Lynx Ransomware Operations](https://thehackernews.com/2026/07/fortibleed-credential-theft-linked-to.html)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-2517