SonicWall SSL VPN Accounts in Attacker Crosshairs

Threat actors have rapidly compromised more than 100 SonicWall SSL VPN accounts across 16 environments, in what SecurityWeek describes as a widespread campaign. Most activity occurred on 4 October, with further clusters over the following days; by 10 October the figure exceeded 100.

The authentication attempts originated from the same IP address, and in many cases the attackers disconnected from the compromised network without performing additional activities, though Huntress notes some post-exploitation network scanning and attempts to access numerous local Windows accounts.

The warning follows SonicWall’s announcement that all users who stored firewall configuration files via its cloud backup service MySonicWall were affected by a September data breach, with attackers accessing the preference files containing encrypted credentials and configuration data. According to Huntress, there is no evidence that the new campaign is linked to the MySonicWall breach, though a connection cannot be ruled out.

The cybersecurity firm recommends restricting WAN management, resetting credentials, disabling remote management until credentials are rotated, revoking external APIs, and enforcing MFA for all administrator and remote access accounts.