Credential Stuffing Campaign Compromises SonicWall VPN Accounts at Scale
Written by AI from the linked story. Not reviewed by an editor. How this works
Attackers are systematically attempting previously breached username/password combinations against SonicWall VPN and firewall appliances, successfully compromising accounts at over 30 organizations. The root issue lies in weak or reused credentials on internet-facing network appliances — high-value targets that grant direct access to internal networks. Because VPN and firewall devices sit at the perimeter, a single compromised account can provide attackers with broad network access, bypassing most internal controls. This campaign highlights that even without exploiting a software vulnerability, poor credential hygiene on critical infrastructure can lead to full organizational compromise.
Tactical Insight
Immediate actions
- Audit and reset all SonicWall VPN/firewall account passwords, enforcing strong, unique credentials immediately.
- Enable multi-factor authentication (MFA) on all SonicWall management and VPN user accounts without exception.
- Review authentication logs for unusual login attempts or successful logins from unexpected geographies or IPs.
Long-term improvements
- Integrate internet-facing appliance accounts with a centralized identity provider to enforce consistent password and MFA policies.
- Implement account lockout and rate-limiting policies on all perimeter devices to throttle credential stuffing attempts.
- Maintain a complete, up-to-date inventory of all internet-exposed appliances and their associated accounts.
Detection measures
- Configure SIEM alerting for repeated failed authentication attempts against VPN and firewall appliances.
- Subscribe to threat intelligence feeds that flag known credential stuffing IPs and block them at the perimeter.
- Establish a baseline of normal VPN login behavior and alert on anomalous access patterns such as off-hours logins or new device fingerprints.