SonicWall VPN Vulnerabilities and AI-Powered Hacking Campaigns Pose New Risks to Enterprise Infrastructure
TL;DR
Security researchers are currently playing a high-stakes game of whack-a-mole with SonicWall Gen 7 firewalls. A coordinated wave of cyberattacks has been hitting these devices hard, and while the rumor mill initially churned out whispers of a fresh zero-day exploit, the reality is a bit more grounded—and perhaps more frustrating. This isn't a case of a hidden, undiscovered flaw; it’s a classic failure of hygiene. The chaos is tied directly to CVE-2024-40766, an access control headache within SonicOS management and SSL VPN services.
The strategy here is brutal in its simplicity. Attackers are running high-volume reconnaissance and brute-forcing local user accounts. The real kicker? They’re feasting on configuration oversights left behind during hardware migrations. When companies swap out their aging Gen 6 gear for shiny new Gen 7 firewalls, they often carry over old habits—specifically, failing to reset local administrator or SSL VPN passwords. That simple oversight is effectively leaving the front door unlocked for anyone with a script and a bit of patience.
The Scale of the Reconnaissance
If you want to understand the sheer volume of this threat, look at the data from GreyNoise. Between February 22 and February 25, 2026, they tracked a massive, coordinated sweep of the internet. We’re talking about 84,000 scanning sessions from over 4,300 unique IP addresses in just four days. Their goal was simple: find every active SSL VPN endpoint on the map. Once they have a list of targets, the credential-stuffing phase begins.
According to GreyNoise analysis, roughly 92% of these probes were hunting for a specific API endpoint that confirms whether SSL VPN functionality is even active on a device. To stay under the radar and bypass rate-limiting, these threat actors are routing nearly a third of their traffic through commercial proxy networks. It’s a clever way to mask their origin and make it a nightmare for defenders to block malicious ranges without accidentally nuking legitimate traffic.
Technical Tactics and the Ransomware Playbook
The exploitation of SonicWall VPN infrastructure has moved well beyond simple unauthorized access. Once an attacker gets a foothold using compromised local credentials, they aren't just sitting there. They’re getting heavy. We’re seeing them deploy "Bring Your Own Vulnerable Driver" (BYOVD) tactics, specifically using drivers like rwdrv.sys and hlpdrv.sys. By loading these into the system, they gain privileged access that lets them dance right past standard endpoint security software.
Ultimately, this is about the money. The Akira group has been identified as a primary player here, and their process is clinical:
- Credential Harvesting: They dig deep to find more keys to the kingdom, aiming to move laterally until they own the entire network.
- System Sabotage: They wipe out Volume Shadow Copies to kill any chance of easy recovery and scrub Windows event logs to leave the IT team guessing.
- Ransomware Execution: Once the stage is set, they encrypt everything and drop a ransom note. It’s a tried-and-true extortion cycle that is becoming increasingly automated.
Migration Risks and the Path Forward
SonicWall has been clear: this isn't a new zero-day. It’s a hardening problem. The investigation into the incidents—which currently number fewer than 40—points squarely at environments that imported legacy settings during hardware upgrades. If you migrated to Gen 7 SonicWall firewalls and didn't scrub your old credentials, you are effectively sitting on a powder keg.
| Risk Factor | Impact |
|---|---|
| Migrated Credentials | Weak or legacy passwords from Gen 6 hardware allow easy brute-force access. |
| Exposed Endpoints | Over 430,000 firewalls are publicly reachable, with 25,000 containing critical flaws. |
| BYOVD Tactics | Malicious drivers allow attackers to bypass security monitoring tools. |
The fix is as unglamorous as the problem: update your firmware and audit your configurations. SonicOS 7.3 brings much-needed muscle to brute-force protection and forces better MFA enforcement. If you’ve recently moved to Gen 7 hardware, stop what you’re doing and reset every local user account password associated with SSL VPN access. Do not assume your old passwords are safe.
The Bigger Picture
The GritRep analysis on Akira’s tactics highlights a harsh reality: perimeter devices are the most dangerous points of failure. SSL VPNs are the bridge between the outside world and your internal crown jewels. When groups like Akira or Fog target these, they aren't just looking for a quick win; they’re looking for a path to massive financial disruption.
The use of commercial proxies for reconnaissance shows that these attackers are operating with a level of sophistication usually reserved for nation-states. They are automating the hunt, turning the identification of vulnerable endpoints into a rapid, mechanical process. As long as there are hundreds of thousands of firewalls exposed to the public internet, the window of opportunity for these attackers remains wide open.
This is a reminder that security isn't a "set it and forget it" project. Patch management cycles need to be rigorous, and security configurations must be treated as a live, breathing part of your infrastructure—especially during hardware migrations. As attackers get better at using BYOVD and other advanced evasion tricks, relying solely on a firewall at the edge is no longer enough. You need to be watching for lateral movement inside your walls and enforcing strict, non-negotiable authentication policies for every single user, every single time.
