Experts Warn of Widespread Sonic Wall VPN Compromise Impacting Over 100 Accounts
Summary: Huntress warned of widespread compromise of SonicWall SSL VPN devices, with threat actors authenticating into multiple accounts rapidly across compromised devices, and more than 100 SonicWall SSL VPN accounts across 16 customer accounts impacted, much of the activity beginning October 4, 2025. Authentications in the investigated cases originated from IP address 202.155.8[.]73, with some attackers disconnecting after a short period and others conducting network scanning and attempting to access local Windows accounts.
Key Takeaway: Huntress said the speed and scale of the attacks imply the attackers control valid credentials rather than brute-forcing, and the activity follows SonicWall's acknowledgment that firewall configuration backup files stored in MySonicWall accounts were exposed for all customers who used its cloud backup service.
Read the original at The Hacker News ↗
- Topics
- Threat Actors & Nation-State
- Mentions
- CVE-2024-40766
- Related
- CVE-2024-40766: Sonic Wall SonicOS Improper Access Control Vulnerability Known Exploited Vulnerabilities · Sep 09, 2024