[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fKrO6L_SarOl6-huhz3zpZXP5Kf_m_5l2w1rZZ9lc4MQ":3},{"article":4,"iocs":47,"watch_terms":48,"solutions":49,"lesson":140},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":27,"category":28,"article_tags":31},"bf65a7d5-0d75-453b-a244-fda99f32c360","Huntress Flags Widespread Credential Stuffing Campaign Hitting SonicWall Devices","huntress-flags-widespread-credential-stuffing-campaign-hitting-sonicwall-devices-5ab665","Managed detection and response provider Huntress has issued a threat advisory warning of an active and rapidly growing credential stuffing campaign targeting SonicWall VPN and firewall appliances, with the company reporting that logins to 30 organisations’ accounts had already been compromised at the time of publication. According to Huntress’s Security Operations Centre (SOC), the unusual […] The post Huntress Flags Widespread Credential Stuffing Campaign Hitting SonicWall Devices appeared first on IT Security Guru.","Huntress has disclosed a widespread credential stuffing campaign actively targeting SonicWall VPN and firewall appliances, with at least 30 organizations' accounts already compromised at the time of reporting. The campaign is described as unusual and rapidly growing, indicating a significant threat to organizations using these appliances. The advisory highlights the need for immediate security attention to protect against further account takeovers.","Huntress reports active credential stuffing campaign targeting SonicWall VPN and firewall devices.","https:\u002F\u002Fwww.itsecurityguru.org\u002F2026\u002F07\u002F29\u002Fhuntress-flags-widespread-credential-stuffing-campaign-hitting-sonicwall-devices\u002F?utm_source=rss&utm_medium=rss&utm_campaign=huntress-flags-widespread-credential-stuffing-campaign-hitting-sonicwall-devices",null,"2026-07-29T13:51:40+00:00","2026-07-29T14:00:22.386737+00:00",7,[17,20,23,25],{"name":18,"type":19},"SonicWall","vendor",{"name":21,"type":22},"SonicWall VPN","product",{"name":24,"type":22},"SonicWall Firewall",{"name":26,"type":19},"Huntress","e7b231c8-5f79-4465-8d38-1ef13aea5a14",{"id":27,"icon":12,"name":29,"slug":30},"Threat Intelligence","threat-intelligence",[32,37,42],{"category":33},{"id":34,"icon":12,"name":35,"slug":36},"2c8f44d4-b56e-47cf-9677-04f22c9ee78d","Identity & Access","identity-access",{"category":38},{"id":39,"icon":12,"name":40,"slug":41},"2e06f76c-d5b9-4f54-9eef-4d3447b10730","Breaches","breaches",{"category":43},{"id":44,"icon":12,"name":45,"slug":46},"89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5","Malware","malware",[],[18,26,21],{"controls":50,"vendors":131},[51,80,106],{"slug":52,"name":53,"problem":54,"products":55},"phishing-resistant-mfa","Phishing-resistant MFA","A stolen password, or a user who taps Approve on a push prompt, is no longer enough to log in.",[56,64,72],{"vendor_slug":57,"vendor_name":58,"vendor_logo":59,"product_slug":60,"product_name":61,"url":62,"description":63},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","entra-id","Microsoft Entra ID","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fidentity-access\u002Fmicrosoft-entra-id","Cloud identity and access management with single sign-on, conditional access, passkeys and identity governance.",{"vendor_slug":65,"vendor_name":66,"vendor_logo":67,"product_slug":68,"product_name":69,"url":70,"description":71},"okta","Okta","\u002Fvendor-logos\u002Fokta.png","workforce-identity","Okta Workforce Identity","https:\u002F\u002Fwww.okta.com\u002Fproducts\u002Fworkforce-identity\u002F","Single sign-on, adaptive MFA including phishing-resistant methods, and lifecycle management for employees.",{"vendor_slug":73,"vendor_name":74,"vendor_logo":75,"product_slug":76,"product_name":77,"url":78,"description":79},"yubico","Yubico","\u002Fvendor-logos\u002Fyubico.png","yubikey","YubiKey","https:\u002F\u002Fwww.yubico.com\u002Fproducts\u002F","Hardware security keys for FIDO2, passkeys and smart card login, in USB and NFC versions.",{"slug":81,"name":82,"problem":83,"products":84},"identity-threat-detection","Identity threat detection and response (ITDR)","Attackers who log in with real, stolen credentials get noticed.",[85,93,98],{"vendor_slug":86,"vendor_name":87,"vendor_logo":88,"product_slug":89,"product_name":90,"url":91,"description":92},"vectra-ai","Vectra AI","\u002Fvendor-logos\u002Fvectra-ai.png","vectra-ai-platform","Vectra AI Platform","https:\u002F\u002Fwww.vectra.ai\u002Fplatform","Detection of attacker behaviour across network, identity and cloud.",{"vendor_slug":65,"vendor_name":66,"vendor_logo":67,"product_slug":94,"product_name":95,"url":96,"description":97},"identity-threat-protection","Okta Identity Threat Protection","https:\u002F\u002Fwww.okta.com\u002Fproducts\u002Fidentity-threat-protection\u002F","Continuous risk assessment of sessions after login, with automatic actions such as ending sessions.",{"vendor_slug":99,"vendor_name":100,"vendor_logo":101,"product_slug":102,"product_name":103,"url":104,"description":105},"acalvio","Acalvio","\u002Fvendor-logos\u002Facalvio.png","shadowplex-identity-protection","ShadowPlex Identity Protection","https:\u002F\u002Fwww.acalvio.com\u002Fproducts\u002Fidentity-protection\u002F","Decoy accounts and credentials that expose identity attacks and credential misuse early.",{"slug":107,"name":108,"problem":109,"products":110},"security-awareness-training","Security awareness training and phishing simulation","People recognise and report attacks instead of falling for them.",[111,118,124],{"vendor_slug":112,"vendor_name":26,"vendor_logo":113,"product_slug":114,"product_name":115,"url":116,"description":117},"huntress","\u002Fvendor-logos\u002Fhuntress.png","managed-sat","Huntress Managed Security Awareness Training","https:\u002F\u002Fwww.huntress.com\u002Fplatform\u002Fsecurity-awareness-training","Security awareness training and phishing simulation, managed for you.",{"vendor_slug":119,"vendor_name":120,"vendor_logo":121,"product_slug":119,"product_name":120,"url":122,"description":123},"hoxhunt","Hoxhunt","\u002Fvendor-logos\u002Fhoxhunt.png","https:\u002F\u002Fhoxhunt.com\u002F","Adaptive phishing simulations and micro-training, with a focus on reporting.",{"vendor_slug":125,"vendor_name":126,"vendor_logo":127,"product_slug":125,"product_name":128,"url":129,"description":130},"sosafe","SoSafe","\u002Fvendor-logos\u002Fsosafe.png","SoSafe Awareness Platform","https:\u002F\u002Fsosafe-awareness.com\u002F","Behaviour-based awareness training and phishing simulation in many languages.",[132,135],{"slug":112,"name":26,"logo_path":113,"roles":133},[134],"reported_by",{"slug":136,"name":18,"logo_path":137,"roles":138},"sonicwall","\u002Fvendor-logos\u002Fsonicwall.png",[139],"affected",{"slug":141,"title":142,"body":143,"framework_refs":144,"framework_notes":157},"credential-stuffing-campaign-compromises-sonicwall-vpn-accounts-at-scale","Credential Stuffing Campaign Compromises SonicWall VPN Accounts at Scale","Attackers are systematically attempting previously breached username\u002Fpassword combinations against SonicWall VPN and firewall appliances, successfully compromising accounts at over 30 organizations. The root issue lies in weak or reused credentials on internet-facing network appliances — high-value targets that grant direct access to internal networks. Because VPN and firewall devices sit at the perimeter, a single compromised account can provide attackers with broad network access, bypassing most internal controls. This campaign highlights that even without exploiting a software vulnerability, poor credential hygiene on critical infrastructure can lead to full organizational compromise.",[145,146,147,148,149,150,151,152,153,154,155,156],"CIS Control 5 – Account Management","CIS Control 6 – Access Control Management","CIS Control 8 – Audit Log Management","CIS Control 13 – Network Monitoring and Defense","NIST SP 800-53 AC-2 (Account Management)","NIST SP 800-53 AC-7 (Unsuccessful Logon Attempts)","NIST SP 800-53 IA-5 (Authenticator Management)","NIST SP 800-63B – Digital Identity Guidelines (MFA)","NIST CSF PR.AC-1 (Identities and credentials managed)","NIST CSF DE.CM-7 (Monitoring for unauthorized activity)","ISO\u002FIEC 27001 A.9.4 – System and Application Access Control","GDPR Article 32 – Security of Processing (appropriate technical measures)",{}]