Active Exploitation of SonicWall VPNs: Huntress Threat Advisory

SonicWall VPN Vulnerability and Exploitation

• 💡 Huntress observed an uptick in incidents involving SonicWall devices, indicating active exploitation.
• 🎯 Attackers are leveraging a vulnerability, particularly when users upgraded from Gen 6 to Gen 7 SonicWall devices while retaining old configurations, leaving credentials exposed.
• 🔑 The exploitation allows attackers to gain initial access, steal credentials, perform lateral movement, and exfiltrate data.
• ⚠️ The ultimate goal of these campaigns is often the deployment of Akira ransomware.

Exploitation Tactics and Scope

• ⚡ Attackers employ techniques such as disabling defenses, clearing logs, credential theft, and using Bring Your Own Vulnerable Driver (BYOVD) attacks.
• 📈 The exploitation appeared opportunistic but significantly ramped up after public awareness of the vulnerability, suggesting attackers capitalized on a limited window of opportunity.
• 🌍 While SonicWall devices are prevalent in North America, the threat is considered global, with incidents reported across various customer bases.

Recommendations and Mitigation

• ⚠️ Organizations using SonicWall VPNs are strongly advised to disable SSL VPN access or restrict it via IP allow-listing.
• 🔑 Rotating credentials and hunting for indicators of compromise are crucial steps for defense.
• 🛡️ Higher-level recommendations include attack surface reduction, ensuring systems are up-to-date, and implementing Multi-Factor Authentication (MFA).
• 🔒 VPN appliances, in general, remain attractive targets for attackers due to the direct access they provide to internal networks.