Active Reconnaissance Campaign Targets Sonic Wall Firewalls Through Commercial Proxy Infrastructure
Summary: GreyNoise recorded 84,142 scanning sessions against SonicWall SonicOS infrastructure from 4,305 unique IP addresses across 20 autonomous systems between February 22 and February 25, 2026, with 92% of sessions probing a single API endpoint to check whether SSL VPN is enabled. A commercial proxy service, ByteZero, carried 32% of the volume through 4,102 rotating exit IPs in two bursts totaling 16 hours, and CVE exploitation was negligible, indicating systematic attack surface mapping rather than active exploitation.
What's compelling: Akira and Fog ransomware groups have shown that compromised SonicWall VPN credentials lead to full encryption in under four hours, with dwell times as short as 55 minutes, and Akira alone has hit at least 250 organizations since March 2023 for an estimated $244 million. More than 430,000 SonicWall firewalls are publicly exposed, and the gap between this reconnaissance and the exploitation that follows may be shorter than your patching cycle.
Read the original at GreyNoise Blog ↗
- Topics
- Endpoint & Network Security
- Related
- Adapting to AI penetration testing orchestrators: The Modern Security Model Cyber Risks · Nov 13, 2026Introducing Spend Management: Spending limits and alerts for Cloudflare Cyber Risks · Nov 13, 2026Choosing Que Paxa, an unusual consensus algorithm Cyber Risks · Nov 11, 2026