Huntress Flags Widespread Credential Stuffing Campaign Hitting SonicWall Devices
Huntress reports active credential stuffing campaign targeting SonicWall VPN and firewall devices.
Huntress has disclosed a widespread credential stuffing campaign actively targeting SonicWall VPN and firewall appliances, with at least 30 organizations' accounts already compromised at the time of reporting. The campaign is described as unusual and rapidly growing, indicating a significant threat to organizations using these appliances. The advisory highlights the need for immediate security attention to protect against further account takeovers.
AI summary of the linked source. Not reviewed by an editor. How this works
Run SonicWall?
Get an email when a new story names SonicWall, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonAttackers are systematically attempting previously breached username/password combinations against SonicWall VPN and firewall appliances, successfully compromising accounts at over 30 organizations. The root issue lies in weak or reused credentials on internet-facing network appliances — high-value targets that grant direct access to internal networks. Because VPN and firewall devices sit at the perimeter, a single compromised account can provide attackers with broad network access, bypassing most internal controls. This campaign highlights that even without exploiting a software vulnerability, poor credential hygiene on critical infrastructure can lead to full organizational compromise.
What helps against this
How we list vendors
- Phishing-resistant MFA
A stolen password, or a user who taps Approve on a push prompt, is no longer enough to log in.
- Identity threat detection and response (ITDR)
Attackers who log in with real, stolen credentials get noticed.
- Security awareness training and phishing simulation
People recognise and report attacks instead of falling for them.