Huntress Reports SonicWall SSLVPN Compromises Across 16 Customers
Summary
Huntress observed more than 100 SonicWall SSLVPN accounts compromised across 16 customer environments, with activity beginning October 4. Some intrusions included network scanning and attempts to access local Windows accounts.
Key points
- Huntress reported more than 100 affected SSLVPN accounts across 16 customer environments.
- Most activity began October 4, with clustered authentications over the following two days.
- Huntress said the speed and scale suggested attackers had valid credentials rather than relying on brute force.
- Observed authentications originated from 202.155.8[.]73.
- Some actors disconnected shortly after access; others scanned networks and attempted to access local Windows accounts.
- Huntress said it had no evidence linking this activity to SonicWall's separate advisory about access to cloud firewall configuration backups.
- Recommended measures include restricting remote access, resetting device secrets and credentials, reviewing logs, and enforcing MFA.
Article Details
- Victim Organization
- Multiple Huntress customer organizations; individual organizations not disclosed
- Incident Type
- Widespread compromise of SonicWall SSLVPN devices involving rapid authentication across accounts, with some cases showing subsequent network scanning and attempted access to local Windows accounts
- Incident Date
- 2025-10-04
- Disclosure Date
- 2025-10-10
- Affected Records
- Over 100 SonicWall SSLVPN accounts across 16 customer accounts were impacted.
- Operational Impact
- Some observed actors disconnected after a short period; other cases included network scanning and attempted access to numerous local Windows accounts. Broader disruption was not reported.
- Ransom Or Extortion
- None reported
- Claim Status
- confirmed
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| IPV4 | 202[.]155[.]8[.]73 | Source IP address from which authentications on the compromised SonicWall devices originated, according to Huntress observations. |
Vendors
Products
MySonicWallSonicWall this week released a security advisory update warning that an attack on its MySonicWall platform gave an unauthorized party access to firewall configuration backup files for all customers who have usedSonicWall SSL VPNHomeBlogHuntress Threat Advisory: Widespread SonicWall SSLVPN Compromise