ReliaQuest Details SonicWall VPN Exploitation Despite Patching
Summary
ReliaQuest says, with medium confidence, it observed the first known in-the-wild exploitation of CVE-2024-12802 in SonicWall SSL VPNs. Gen6 devices require six manual LDAP reconfiguration steps after patching; attackers brute-forced credentials and bypassed MFA.
Key points
- ReliaQuest assessed with medium confidence that it observed the first known in-the-wild exploitation of CVE-2024-12802 across multiple environments between February and March 2026.
- On SonicWall Gen6 devices, a firmware patch alone does not remediate the vulnerability; six manual LDAP reconfiguration steps are also required.
- ReliaQuest observed scripted VPN credential brute-forcing and MFA bypass through an unprotected login format, without obvious failed-login or anomalous-login alerts.
- The session type `sess="CLI"`, particularly when followed by a transition to `GMS`, was identified as a detection signal in SonicWall authentication logs.
- In one case, an attacker reached an internal file server within about 30 minutes using reused credentials and attempted to deploy Cobalt Strike and a vulnerable driver; endpoint detection blocked both.
- ReliaQuest recommends verifying all six Gen6 remediation steps, monitoring VPN authentication logs, blocking vulnerable drivers, and auditing VPN account privileges.
Article Details
- Attack Vectors
- Attackers scripted brute-force attempts against SonicWall VPN accounts, with as few as 13 attempts preceding a successful login.
- On Gen6 devices missing the required manual LDAP reconfiguration, attackers used an unprotected UPN login format to bypass MFA.
- Attackers used compromised VPN credentials and credential reuse to access internal systems; in one case, they established an RDP session to a file server using a shared local administrator password.
- In one intrusion, attackers attempted to deploy a Cobalt Strike beacon and load a vulnerable signed driver to disable endpoint protection; EDR blocked both attempts.
- Attackers swept internal networks and, in one case, manually reviewed files on a server with Notepad.
- Defensive Notes
- On Gen6 SonicWall devices, verify completion of all six manual LDAP reconfiguration steps in advisory SNWLID-2025-0001; a firmware update alone does not remediate the vulnerability.
- Monitor SonicWall authentication logs for sess="CLI", particularly transitions to GMS and correlation with Event ID 238 or Event ID 1080. Enable syslog forwarding and include the Authentication log category.
- Baseline authorized CLI-based VPN authentication to reduce false positives, and investigate unusual source IPs, volume, and timing.
- Block known vulnerable drivers using vendor-recommended block rules, such as those available through Windows Defender Application Control.
- Restrict VPN account privileges and direct access from VPN-assigned IPs to sensitive servers; use unique, regularly rotated local administrator credentials, such as through LAPS.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| IPV4 | 193[.]160[.]216[.]221 | Source IP identified in the article as used for interactive logins to SonicWall. |
| IPV4 | 69[.]10[.]60[.]250 | Source IP identified in the article as used for interactive logins to SonicWall. |
| MD5 | 2a461175f181e0440e0ff45d5fb60939 | Hash listed among campaign artifacts; the article associates the artifact set with an EDR-disabling executable and a malicious file. |
| MD5 | 6a6aaeed4a6bbe82a08d197f5d40c259 | Hash listed among campaign artifacts; the article associates the artifact set with an EDR-disabling executable and a malicious file. |
MITRE ATT&CK
T1018 · Remote System DiscoveryAfter VPN access, attackers swept the internal network to assess accessible systems.T1021.001 · Remote Desktop ProtocolIn one intrusion, the attacker established an RDP session to a domain-joined file server using a shared local administrator password.T1068 · Exploitation for Privilege EscalationIn one intrusion, the attacker attempted a BYOVD attack, loading a vulnerable signed driver to gain kernel-level access; EDR blocked the driver load.T1078 · Valid AccountsAttackers used compromised VPN credentials to authenticate as legitimate users and access internal systems.T1110.001 · Password GuessingAttackers used rapid, scripted password guessing against VPN accounts; the article reports that as few as 13 attempts preceded a valid credential.T1562.001 · Disable or Modify ToolsThe attempted BYOVD activity targeted endpoint protection, but EDR blocked the driver load.
CVE
CVE-2023-4966Citrix · NetScaler ADC; Citrix · NetScaler Gatewaythat’s a systemic gap in patch-management tooling and processes, and it extends well beyond SonicWall.CVE-2023-4966 (“Citrix Bleed”), for example, required administrators to manually terminate all active sessions andCVE-2024-12802Vendor / Product unavailableReliaQuest reported the first known in-the-wild exploitation of CVE-2024-12802 against SonicWall SSL VPN appliances, where Gen6 devices remained vulnerable after patching unless six manual reconfiguration steps were
Threat Actors
Vendors
ReliaQuestReliaQuest reported the first known in-the-wild exploitation of CVE-2024-12802 against SonicWall SSL VPN appliances, where Gen6 devices remained vulnerable after patching unless six manual reconfiguration steps wereSonicWallReliaQuest reported the first known in-the-wild exploitation of CVE-2024-12802 against SonicWall SSL VPN appliances, where Gen6 devices remained vulnerable after patching unless six manual reconfiguration steps were
Products
GreyMatterReliaQuest GreyMatter provides several capabilities directly relevant to the TTPs observed in this activity:SonicWall SSL VPNReliaQuest reported the first known in-the-wild exploitation of CVE-2024-12802 against SonicWall SSL VPN appliances, where Gen6 devices remained vulnerable after patching unless six manual reconfiguration steps wereWindows Defender Application ControlDeploy vendor-recommended vulnerable-driver block rules, such as those available via Windows Defender Application Control (WDAC), to prevent known vulnerable drivers from loading.