Active Exploitation of SonicWall VPNs

Threat Score:
50
Huntress
2 days ago

Overview

A likely zero-day vulnerability in SonicWall VPNs is being actively exploited to bypass MFA and deploy ransomware. Huntress advises disabling the VPN service immediately or severely restricting access via IP allow-listing. We're seeing threat actors pivot directly to domain controllers within hours of the initial breach....

Related Articles

5 articles
1

CISA Warns of D-Link Vulnerabilities Actively Exploited in Attacks

Cybersecurity News • 5 hours ago

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has issued a new alert, adding three vulnerabilities affecting D-Link devices to its Known Exploited Vulnerabilities (KEV) Catalog. The inclusion of these flaws in the catalog signifies that they are being actively exploited by malicious cyber actors in real-world attacks, posing a significant threat to networks. The […]

Score
84
Read more
5

SonicWall Probes Potential Zero-Day After Ransomware Hits

Data Breach Today UK • 11 hours ago

Akira Ransomware Exploited MFA-Protected SonicWall SSL VPNs, Say Researchers SonicWall said it is probing a surge in attacks against its Gen 7 firewalls, running various firmware versions, which have SSL VPN enabled. Researchers said attackers may have been exploiting a zero-day vulnerability and that multiple victims have been infected with Akira ransomware.

Score
78
Read more