Ransomware hackers attack SMBs being acquired to try and gain access to multiple companies

Ransomware.

• ReliaQuest warns Akira ransomware often spreads via compromised assets inherited during mergers and acquisitions
• Most infections stem from unpatched SonicWall SSL VPN appliances, exploited for lateral movement and encryption
• SonicWall recently patched CVE-2025-40601, a high-severity buffer overflow flaw affecting Gen7 and Gen8 firewalls

Companies buy and sell other companies all the time, but besides the clients, earnings, a different market, or talented staff, buyers often get something unexpected with their acquisition, too - a ransomware infection.