[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fZkkBRzEGqrPvutGuXyxdiXybuDukmrpkpKZtro2mesg":3},{"lesson":4},{"id":5,"slug":6,"article_id":7,"title":8,"body":9,"prevention":10,"framework_refs":11,"framework_notes":24,"status":25,"created_at":26,"published_at":27,"article":28,"tags":32,"podcasts":51,"controls":52},"d5dcc82d-906a-4bb6-97d2-527bd80c9e05","credential-stuffing-campaign-compromises-sonicwall-vpn-accounts-at-scale","bf65a7d5-0d75-453b-a244-fda99f32c360","Credential Stuffing Campaign Compromises SonicWall VPN Accounts at Scale","Attackers are systematically attempting previously breached username\u002Fpassword combinations against SonicWall VPN and firewall appliances, successfully compromising accounts at over 30 organizations. The root issue lies in weak or reused credentials on internet-facing network appliances — high-value targets that grant direct access to internal networks. Because VPN and firewall devices sit at the perimeter, a single compromised account can provide attackers with broad network access, bypassing most internal controls. This campaign highlights that even without exploiting a software vulnerability, poor credential hygiene on critical infrastructure can lead to full organizational compromise.","**Immediate actions:**\n- Audit and reset all SonicWall VPN\u002Ffirewall account passwords, enforcing strong, unique credentials immediately.\n- Enable multi-factor authentication (MFA) on all SonicWall management and VPN user accounts without exception.\n- Review authentication logs for unusual login attempts or successful logins from unexpected geographies or IPs.\n\n**Long-term improvements:**\n- Integrate internet-facing appliance accounts with a centralized identity provider to enforce consistent password and MFA policies.\n- Implement account lockout and rate-limiting policies on all perimeter devices to throttle credential stuffing attempts.\n- Maintain a complete, up-to-date inventory of all internet-exposed appliances and their associated accounts.\n\n**Detection measures:**\n- Configure SIEM alerting for repeated failed authentication attempts against VPN and firewall appliances.\n- Subscribe to threat intelligence feeds that flag known credential stuffing IPs and block them at the perimeter.\n- Establish a baseline of normal VPN login behavior and alert on anomalous access patterns such as off-hours logins or new device fingerprints.",[12,13,14,15,16,17,18,19,20,21,22,23],"CIS Control 5 – Account Management","CIS Control 6 – Access Control Management","CIS Control 8 – Audit Log Management","CIS Control 13 – Network Monitoring and Defense","NIST SP 800-53 AC-2 (Account Management)","NIST SP 800-53 AC-7 (Unsuccessful Logon Attempts)","NIST SP 800-53 IA-5 (Authenticator Management)","NIST SP 800-63B – Digital Identity Guidelines (MFA)","NIST CSF PR.AC-1 (Identities and credentials managed)","NIST CSF DE.CM-7 (Monitoring for unauthorized activity)","ISO\u002FIEC 27001 A.9.4 – System and Application Access Control","GDPR Article 32 – Security of Processing (appropriate technical measures)",{},"published","2026-07-29T14:20:23.680014+00:00","2026-07-29T14:20:23.57+00:00",{"id":7,"url":29,"slug":30,"title":31},"https:\u002F\u002Fwww.itsecurityguru.org\u002F2026\u002F07\u002F29\u002Fhuntress-flags-widespread-credential-stuffing-campaign-hitting-sonicwall-devices\u002F?utm_source=rss&utm_medium=rss&utm_campaign=huntress-flags-widespread-credential-stuffing-campaign-hitting-sonicwall-devices","huntress-flags-widespread-credential-stuffing-campaign-hitting-sonicwall-devices-5ab665","Huntress Flags Widespread Credential Stuffing Campaign Hitting SonicWall Devices",[33,39,45],{"id":34,"name":35,"slug":36,"description":37,"color":38},"05757c8d-6b93-4194-b35d-7359e7d33b0e","Vulnerability Management","vulnerability-management","Missing scans, no risk prioritization","#fb923c",{"id":40,"name":41,"slug":42,"description":43,"color":44},"1732a005-556e-411c-a9db-5edec3058571","Logging & Monitoring","logging-monitoring","Missing logs, no alerting, blind spots","#a855f7",{"id":46,"name":47,"slug":48,"description":49,"color":50},"1ec88fde-2d0f-4ed8-932a-33f5ccc0fdc7","Access Control","access-control","Excessive privileges, missing MFA, weak auth","#f97316",[],[53,57,61],{"slug":54,"name":55,"problem":56},"phishing-resistant-mfa","Phishing-resistant MFA","A stolen password, or a user who taps Approve on a push prompt, is no longer enough to log in.",{"slug":58,"name":59,"problem":60},"identity-threat-detection","Identity threat detection and response (ITDR)","Attackers who log in with real, stolen credentials get noticed.",{"slug":62,"name":63,"problem":64},"security-awareness-training","Security awareness training and phishing simulation","People recognise and report attacks instead of falling for them."]