Widespread SonicWall SSL VPN Compromise Detected
HighWhat happened
Cybersecurity firm Huntress identified a widespread compromise of SonicWall SSL VPN devices, with attackers using valid credentials to access multiple customer environments. The rapid authentication into numerous accounts suggests that the attackers possess legitimate credentials rather than employing brute-force methods. The activity began on October 4, 2025, affecting over 100 accounts across 16 customers. In some cases, attackers conducted network scanning and attempted access to local Windows accounts.
Who is affected
Organizations utilizing SonicWall SSL VPN devices, particularly those with accounts accessed from IP address 202.155.8[.]73, are impacted.
Why it matters
The compromise of SSL VPN devices poses significant security risks, including unauthorized network access, potential data breaches, and the possibility of further exploitation within affected networks. The use of valid credentials indicates a sophisticated attack vector that may bypass traditional security measures.
How it could have been prevented
Implementing robust multi-factor authentication (MFA) for all remote access accounts can mitigate unauthorized access. Regularly monitoring and auditing VPN access logs for unusual activity can help in early detection of compromises. Restricting VPN access to trusted IP addresses and disabling unused accounts can further reduce the attack surface.
Relevant professional terms
- SSL VPN
- A Secure Sockets Layer Virtual Private Network that allows users to securely access a private network over the internet.
- Multi-Factor Authentication (MFA)
- A security process that requires users to provide multiple forms of verification to gain access to a system.
Recommended reading: Arctic Wolf Observes July 2025 Uptick in Akira Ransomware Activity Targeting SonicWall SSL VPN