Huntress Reports Credential-Stuffing Campaign Compromised 30 SonicWall Customers

Summary

Huntress reported that credential stuffing compromised 92 accounts across 30 SonicWall customer organizations in 41 hours. The attackers are unidentified; no post-compromise activity has been observed, and SonicWall is investigating.

Key points

Huntress reported 92 unique user accounts compromised across 30 organizations in less than two days.
The attacks targeted SonicWall VPN and firewall accounts through credential validation against remote access portals.
Huntress described the campaign as broad and opportunistic; the attackers have not been identified.
No post-compromise activity had been observed, and the last compromise Huntress identified occurred Monday.
The findings reflect Huntress telemetry from its own customers, so the total number of affected organizations may be higher.
SonicWall said it was investigating and had not issued an advisory about the activity at the time of publication.

Article Details

Event Type: Credential-stuffing campaign targeting SonicWall VPN and firewall accounts
Impact: Huntress reported that the campaign compromised 30 organizations and 92 user accounts in 41 hours. The identified victims were Huntress customers, so the total number affected may be higher. No post-compromise activity had been observed; the last reported compromise occurred Monday, and the attacks had stopped at least temporarily.