Hackers Scan SonicWall Firewalls from 4,000+ IPs for SSL VPN Exploits

Hackers launched a massive scan against SonicWall firewalls using over 4,000 unique IP addresses. The campaign hit 84,142 sessions from February 22-25, 2026. Attackers mapped devices with active SSL VPN before planned exploits.

SonicWall SSL VPN remains a top ransomware entry point. The REST API endpoint checking VPN status took 92% of scans. This builds target lists fast. Over 430,000 SonicWall devices face the public internet.

GreyNoise tracked three infrastructure clusters. They used commercial rotating proxies for cover. This mirrors a December 2025 scan wave against SonicWall and Palo Alto gear. Activity escalates now.

More than 25,000 SSL VPNs run unpatched critical flaws. Another 20,000 use unsupported firmware. Akira ransomware hit 250+ orgs via SonicWall since 2023, pulling $244 million. Fog groups encrypt networks in hours.

Campaign Details

Proxies averaged 6.6 requests per IP. This dodges rate limits and blocklists. The service sat unmanaged since December 2025. Amsterdam IPs scanned Cisco ASA too.

Five of seven key CVEs sit in CISA’s Known Exploited list. Four link to ransomware directly.

Key Risks

• Akira exploits for initial access.
• Fog full encryption in <4 hours.
• 25,000+ unpatched SSL VPNs exposed.
• 20,000 on end-of-life firmware.

Patch CVE-2024-53704 now (CVSS 9.8). Enable MFA on VPN. Lock management to trusted IPs. Reset old passwords. Watch for HTTP/1.0 + Chrome UA scans. Scrap EOL SRA gear.

FAQ