Attackers exploit valid logins in SonicWall SSL VPN compromise

Huntress warned of a widespread compromise of SonicWall SSL VPNs, with threat actors using valid credentials to access multiple customer accounts rapidly. Since 4 October, over 100 SonicWall SSL VPN accounts across 16 customers were compromised using valid credentials, not by brute force, according to Huntress. Logins originated from IP 202.155.8[.]73, with some attackers disconnecting quickly while others conducted post-exploitation activities such as network scanning and probing local Windows accounts.

SonicWall also warned that attackers accessed firewall backup files from its cloud service, exposing encrypted credentials and configs, and urged customers to reset credentials after these files were exposed. The company noted that initially under 5% of customers were impacted and that the breach still posed risks requiring urgent action.

On 8 October, SonicWall confirmed that threat actors accessed the preference files of all firewalls using its MySonicWall cloud backup service, with stolen files potentially aiding further attacks.