Quick Takeaways
- Huntress warns of a widespread campaign against SonicWall SSL VPN accounts, with over 100 accounts compromised across 16 environments mainly on October 4-10, using valid credentials rather than brute-force attacks.
- The attackers, appearing to log in from the same IP, often disconnected after initial access or conducted reconnaissance, including network scanning and local Windows account access.
- This activity follows SonicWall’s September data breach involving cloud backup files, but Huntress currently sees no direct link between the two incidents.
- Recommendations include disabling remote management, resetting credentials, monitoring logs, enabling multi-factor authentication, and revoking external access to mitigate further risk.
The Core Issue
Recently, a cyberattack targeting SonicWall SSL VPN accounts has come into focus, following the compromise of SonicWall firewall configuration files linked to a broader data breach in September. This campaign, reported by cybersecurity firm Huntress, involves malicious actors exploiting valid credentials—rather than using brute-force attacks—to rapidly access numerous VPN accounts. The activity primarily took place around October 4, with over 100 accounts across 16 different environments affected by October 10, often from the same IP address, and mostly involving minimal activity—disconnection after login—though some cases showed further malicious actions like network scanning and attempts to access various Windows accounts.
Although SonicWall clarified that their recent data breach, which exposed encrypted credentials stored via their cloud backup service, is unlikely linked to this new campaign, Huntress acknowledges the potential for a connection that remains unconfirmed. The cybersecurity firm emphasizes that this incident illustrates the importance of tightening security measures: restricting remote management, rotating credentials, disabling remote access temporarily, and implementing multi-factor authentication. These steps are vital to prevent further unauthorized access and to monitor for suspicious activity, especially as threat actors continue exploiting vulnerabilities across network devices and cloud services.
Risks Involved
Following a recent breach of SonicWall firewall configuration files, Huntress warns of a concerted campaign exploiting compromised SonicWall SSL VPN accounts across multiple organizations. The attackers, likely leveraging valid credentials rather than brute-force methods, rapidly accessed over 100 VPN accounts in at least 16 environments primarily on October 4 and subsequent days. While most activities involved reconnaissance with minimal disruption, some instances showed evidence of post-exploitation, including network scanning and local account access. This surge occurred shortly after SonicWall disclosed a September data breach affecting users who stored configuration files via its cloud backup service, though Huntress suggests no direct link between the two incidents. Organizations are advised to tighten remote access controls, reset credentials, limit or disable remote management, scrutinize logs for suspicious activity, and implement multi-factor authentication to mitigate ongoing threats and prevent further compromise.
Possible Actions
Ensuring prompt action when SonicWall SSL VPN accounts are targeted by attackers is crucial to prevent data breaches, minimize potential damage, and maintain overall network security. Immediate remediation not only reduces the attack surface but also helps in preserving user trust and operational integrity.
Mitigation Steps
-
Account Lockout
Temporarily disable compromised accounts to prevent further unauthorized access. -
Password Reset
Enforce immediate password changes for affected accounts with strong, unique passwords. -
Update Firmware
Apply the latest SonicWall firmware updates to patch known vulnerabilities. -
Enable MFA
Implement multi-factor authentication for an added layer of security on VPN access. -
Review Logs
Examine access logs for suspicious activity to identify potential breaches or unauthorized attempts. -
User Monitoring
Keep a close watch on account activity for unusual behavior indicating an ongoing attack. -
Network Segmentation
Limit access rights through segmentation to contain potential breaches. - Security Policies
Update and enforce strict security policies relating to VPN usage and credential management.
Acting swiftly with these steps can significantly curb attacker access, mitigate risks, and reinforce network defenses.
Explore More Security Insights
Stay informed on the latest Threat Intelligence and Cyberattacks.
Access world-class cyber research and guidance from IEEE.
Disclaimer: The information provided may not always be accurate or up to date. Please do your own research, as the cybersecurity landscape evolves rapidly. Intended for secondary references purposes only.
Cyberattacks-V1
