Hackers Launch Massive SonicWall Firewall Attack Using 4,000+ IP Addresses

Recent activities indicate that SonicWall firewalls are being actively scanned worldwide, with over 84,000 SonicOS scanning sessions initiated from more than 4,000 unique IP addresses over four days. These activities aim to identify SSL VPN targets for potential future attacks involving credentials and vulnerabilities.

The campaign involves three distinct infrastructure clusters performing large-scale VPN enumerations. Notably, 92% of the scanning sessions targeted a specific SonicOS REST API endpoint to verify if SSL VPN is enabled. A commercial proxy network accounted for 32% of the traffic, utilizing 4,102 rotating exit IPs in short bursts to bypass rate limitations.

While the campaign primarily focuses on reconnaissance, with CVE exploitation activity being minimal, it signifies a systematic mapping of attack surfaces rather than an active exploitation phase. Between Feb 22 and 25, 2026, GreyNoise recorded 84,142 scanning sessions targeting SonicWall SonicOS devices from 4,305 unique IPs across 20 autonomous systems.

CVE ID CVSS Score CISA KEV Ransomware Use Campaign / Sessions

CVE-2024-53704 9.8 Yes Yes 5

CVE-2024-40766 9.8 Yes Yes (Akira, Fog) No tag

CVE-2022-22274 9.8 No No 9*

CVE-2023-0656 7.5 No No 9*

CVE-2021-20028 9.8 Yes Yes 8

CVE-2024-38475 9.1 Yes Unknown 6

CVE-2019-7481 7.5 Yes Yes 6

GreyNoise evaluates this activity as reconnaissance, designed to identify SonicWall firewalls with exposed SSL VPN services for potential future credential stuffing and vulnerability exploitation.

Research indicates that threats like Akira can transition from SonicWall VPN login to full environment encryption rapidly, sometimes in less than an hour. This highlights the focus of the campaign on building a list of SonicWall devices with active SSL VPNs.

Since March 2023, ransomware groups such as Akira have reportedly compromised numerous organizations using SonicWall VPN access. The SonicWall SSL VPN is a documented initial access vector for ransomware operators.

GreyNoise reports that several SonicWall CVEs relevant to this attack surface are listed in CISA’s Known Exploited Vulnerabilities catalog, with some having documented ransomware use.

With a significant number of SonicWall firewalls exposed to the internet, the ongoing reconnaissance efforts reduce the attackers' effort in identifying exploitable targets.

Organizations are advised to treat SonicWall VPN infrastructure as a critical attack surface. Immediate steps should include restricting management access, enforcing multi-factor authentication for all SSL VPN users, and urgently patching known vulnerabilities such as CVE-2024-53704.

Based on reporting by GBHackers.