Loading story…
The UK National Cyber Security Centre urged vendors to make forensic observability a standard feature in firewalls, VPN gateways, and other network devices, arguing that defenders need supported access to telemetry, logs, configuration state, memory, stored data, and software transparency to investigate compromises without relying on reverse engineering or zero-day exploits. The call builds on NCSC guidance published in 2025 for digital forensics and protective monitoring, which recommends full storage acquisition through standard interfaces, clear handling of redacted volatile data, strong authentication on collection interfaces, and hardware and firmware protections such as secure boot and TPM-backed safeguards. NCSC said it is also working with international partners on a reference architecture, while CISA’s Secure by Design initiative reinforces pressure on manufacturers to build these capabilities in from the outset.
The push comes as vendors and defenders report growing pressure on edge devices from credential-based attacks. Huntress warned that a broad credential stuffing campaign hit SonicWall VPN and firewall appliances, compromising accounts at about 30 organizations after attackers tested stolen or guessed credentials against internet-facing portals from DigitalOcean-hosted infrastructure. Sophos, citing attacks on internet-facing Sophos Firewall devices and lessons from the FortiBleed campaign, said it had seen brute-force and credential-stuffing activity against user accounts but no vulnerability-driven widespread compromise; in response, it changed MFA onboarding, added expiration controls, developed dynamic brute-force lockout and MFA for SSH, and committed to improved fleet forensic capture and expanded attack telemetry aligned with NCSC guidance.
Map this exposure pattern across your cloud, code, and identities.
7 events from the most recent confirmed update back to the earliest known activity.
Sophos published a Secure by Design update describing firewall hardening work over the past year, including architectural changes, expanded Linux Sensor deployment, improved hotfix visibility, scheduled firmware updates, and AI-assisted vulnerability hunting. It also said non-volatile forensic capture remains a gap and committed to fleet forensic capture and expanded attack telemetry.
Huntress publicly warned of an active and rapidly growing credential stuffing campaign affecting SonicWall VPN and firewall appliances, with 30 organizations already seeing compromised accounts. It linked the activity to five DigitalOcean-hosted IP addresses and urged credential resets, access restrictions, log review, and MFA enforcement.
The NCSC said it is working with international partners on a reference architecture for forensic observability for network devices, aiming to make supported investigative access a standard capability.
Huntress telemetry showed the number of affected accounts and organizations increasing across 2026-07-25 to 2026-07-27, indicating a broad and opportunistic campaign targeting internet-facing SonicWall remote access portals.
Huntress first detected the credential stuffing activity on 2026-07-25 after observing an anomalous spike in successful SonicWall logins from a suspicious autonomous system.
Sophos said attacks on internet-facing Sophos Firewall devices involved credential brute-forcing and stuffing against user-level accounts, with no vulnerability involved and no signs of widespread compromise. In response, it redesigned MFA onboarding and developed additional protections including dynamic brute-force lockout and MFA for SSH.
The UK NCSC published guidance on digital forensics and protective monitoring for devices and appliances, covering volatile and non-volatile data collection, redaction, decryption, and protections against unauthorized extraction.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See where this exposure pattern shows up across your cloud, code, supply chain, and non-human identities.
7 references tracked. Mallory keeps watching after this page renders.
scworld.com
Open sourceitsecurityguru.org
Open sourcencsc.gov.uk
Open sourcesophos.com
Open sourcencsc.gov.uk
Open sourcethreatbear.co
Open sourcecisa.gov
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Huntress reported an active credential-stuffing and brute-force campaign targeting **SonicWall** VPN and firewall login portals, compromising 30 organizations and 92 user accounts in roughly 41 hours. The activity began on July 25 and used authorized logins against remote access interfaces rather than exploiting a software vulnerability, with attacks described as broad and opportunistic instead of focused on a particular sector. Huntress said the observed victims were all its customers using SonicWall devices, indicating the total number of affected organizations could be higher. Investigators traced the automated credential-validation activity to a small set of malicious IP addresses registered to **DigitalOcean** and said the pattern aligns with recurring SonicWall SSLVPN targeting seen in 2025 and 2026, including abuse of reused compromised credentials. Huntress said it had not yet observed post-compromise hands-on-keyboard activity, raising concern that the intrusions may be intended to pre-position access for later operations. At the time of reporting, SonicWall said it was investigating and had not issued a security advisory, while Huntress urged defenders to restrict remote management, reset credentials and secrets, review authentication logs, and enforce **MFA**.
Aug 2, 2026
Ransomware affiliates mounted a coordinated wave of attacks against internet-facing VPN and firewall appliances from **Palo Alto Networks, Fortinet, Check Point, and Citrix**, turning edge remote-access systems into a primary entry point for corporate intrusions. Reported campaigns included **FortiBleed** credential exposure on FortiGate devices, exploitation of Palo Alto GlobalProtect authentication bypass `CVE-2026-0257`, abuse of Check Point VPN authentication bypass `CVE-2026-50751`, and rapid exploitation of Citrix NetScaler memory-disclosure flaw `CVE-2026-8451`. Security reporting linked **Qilin** affiliates to at least the Palo Alto and Check Point activity, with exploitation beginning within days—and in some cases less than 24 hours—after disclosure or proof-of-concept release. After gaining access, attackers were reported using lateral movement and credential-theft techniques including **Impacket, NTLM relay, Mimikatz, PsExec, RDP, WMI**, Chrome credential theft via GPO, and **WSL-based EDR evasion**, followed by data theft and double-extortion ransomware deployment. Victims were concentrated in the United States, United Kingdom, Australia, and Western Europe across healthcare, education, manufacturing, local government, media, professional services, and critical infrastructure. The surge prompted Sen. **Ron Wyden** to call for a federal purge of legacy, public-facing VPNs, urging **OMB, CISA, and NIST** to push agencies toward zero-trust remote access and away from perimeter-based systems repeatedly exposed by incidents involving Fortinet, Check Point, Ivanti, and Cisco platforms.
Jul 27, 2026
A large-scale credential-harvesting campaign has compromised more than **30,000 Fortinet FortiGate firewalls and VPN gateways** across **194 countries**, according to SOCRadar, which said the attackers amassed a database of **30,791 verified working credentials**. Researchers said the operation targeted internet-facing Fortinet management and VPN interfaces using **credential stuffing, password spraying, brute-force attempts, and reused passwords from prior leaks**, and found **no evidence of a Fortinet zero-day or a breach of Fortinet itself**. The attackers allegedly used compromised devices as listening posts to capture additional credentials and feed them into an automated attack chain, broadening access across sectors including **telecommunications, government, healthcare, finance, education, energy, and other critical infrastructure**. Telecom was reported as the most affected sector, while government entities accounted for **591 entries across 111 domains**; **India and the United States** represented nearly one-third of identified compromises. SOCRadar said the campaign remained active and assessed it as **critical**, with tooling and victim selection described as consistent with **Russian-speaking threat actors** and possible motives spanning both **financial gain and cyberespionage**.
Aug 31, 2026