Credential-Stuffing Campaign Compromises 30 Organizations Using SonicWall VPNs and Firewalls

Jul 28, 2026 · Original article ↗

Summary

Huntress reports an active credential-stuffing campaign that has compromised 30 organizations through SonicWall VPN and firewall accounts since July 25, 2026. The activity used five DigitalOcean-hosted IPs; Huntress recommends reviewing logs, resetting credentials, and強

Key points

Since July 25, Huntress has observed successful unauthorized logins to SonicWall VPN and firewall accounts at 30 organizations.
The campaign used five primary IP addresses registered to DigitalOcean: 157.245.88[.]153, 162.243.31[.]111, 167.71.150[.]1, 209.97.151[.]148, and 64.227.15[.]20.
Huntress describes the activity as automated credential validation and reports no observed hands-on-keyboard activity after the logins.
Huntress recommends reviewing authentication logs and configuration changes, disabling or limiting remote access, and resetting affected device credentials and secrets.
The advisory recommends enforcing MFA for administrative and remote accounts and monitoring services as they are restored.
Huntress says its SOC is monitoring and responding with affected partners, and will continue tracking the campaign.

Article Details

Event Type: Credential-stuffing campaign resulting in unauthorized access to SonicWall VPN and firewall accounts.
Impact: Huntress reported 30 organizations compromised, with successful unauthorized logins to user accounts. It observed no post-compromise hands-on-keyboard activity.

Indicators of compromise

Type	Indicator	Context
IPV4	`157[.]245[.]88[.]153`	Malicious IP associated with SonicWall brute-force activity; registered to DigitalOcean, LLC.
IPV4	`162[.]243[.]31[.]111`	Identified by Huntress as one of five primary malicious IPs driving the credential-stuffing attack; registered to DigitalOcean, LLC.
IPV4	`167[.]71[.]150[.]1`	Malicious IP associated with SonicWall brute-force activity; registered to DigitalOcean, LLC.
IPV4	`209[.]97[.]151[.]148`	Malicious IP associated with SonicWall brute-force activity; registered to DigitalOcean, LLC.
IPV4	`64[.]227[.]15[.]20`	Malicious IP associated with SonicWall brute-force activity; registered to DigitalOcean, LLC.

People

Ethan WilliamsNamed as an author of the Huntress advisory.Jevon AngNamed as an author of the Huntress advisory.

Vendors

DigitalOcean, LLCidentified five primary malicious IP addresses driving this attack, all of which are registered to DigitalOcean, LLC:HuntressHuntress Threat Advisory: Widespread SonicWall Credential Stuffing Campaign SonicWallHomeBlogHuntress Threat Advisory: Widespread SonicWall Credential Stuffing Campaign

Products

SonicWall firewallSonicWall VPNbroad, and opportunistic credential stuffing campaign resulting in successful unauthorized logins to SonicWall VPN and firewall accounts. So far, 30 organizations have been impacted.