Experts Warn of Widespread SonicWall VPN Compromise Impacting Over 100 Accounts

According to Huntress, there was a widespread compromise of SonicWall SSL VPN devices, with threat actors authenticating into multiple accounts across compromised devices. The activity appears to have begun on 4 October 2025, and more than 100 SonicWall SSL VPN accounts across 16 customer accounts were impacted.

Investigations found that authentications originated from the IP address 202.155.8[.]73, and in some cases the attackers disengaged after a short period, while in others they conducted network scanning and attempted to access numerous local Windows accounts. The disclosure comes amid SonicWall acknowledging a separate security incident that exposed firewall configuration backup files stored in MySonicWall accounts, an issue that reportedly affects all customers who used the cloud backup service.

Given that sensitive credentials can be stored in firewall configurations, organisations using MySonicWall cloud backups are advised to reset credentials on live devices and implement additional safeguards such as restricting WAN management and MFA for admin and remote accounts.