Loading story…
CISA warned that threat actors are actively exploiting CVE-2019-7481 in SonicWall Secure Mobile Access (SMA) 100 series and Secure Remote Access (SRA) appliances that remain on end-of-life firmware, with intrusions leading to targeted ransomware attacks. SonicWall issued an urgent notice telling customers to upgrade to supported firmware immediately or disconnect affected appliances, underscoring that patched but unsupported devices remain exposed if they have not been properly updated.
Reporting linked the campaign to multiple eCrime actors, including HelloKitty, and CrowdStrike identified the SonicWall flaw as a key access vector being leveraged in the wild. The activity fits a broader pattern of ransomware groups abusing SonicWall edge devices for initial access, with prior exploitation by actors associated with Babuk, UNC2447, and UNC2682 across VPN and email security products.
See which actors are running it and whether you're in range.
9 events from the most recent confirmed update back to the earliest known activity.
In March, Mandiant discovered three zero-day vulnerabilities affecting SonicWall on-premises and hosted Email Security products. Mandiant attributed exploitation of those flaws to UNC2682, which used BEHINDER web shells for backdoor access and lateral movement.
Mandiant tracked UNC2447 exploiting CVE-2021-20016 in SonicWall SMA 100 Series VPN appliances to deploy FiveHands ransomware. The group targeted multiple North American and European organizations before SonicWall released patches in late February 2021.
SonicWall said the long-known vulnerability later identified as CVE-2019-7481 had been patched in newer firmware versions released in early 2021. The issue remained exploitable on devices still running end-of-life firmware.
The CVE-2021-20016 zero-day was used in January to target SonicWall's internal systems. The article cites this as part of broader exploitation of SonicWall vulnerabilities by ransomware-linked actors.
HelloKitty is described as a human-operated ransomware operation that has been active since November 2020. The group was later linked to exploitation of vulnerable SonicWall devices.
SonicWall patched CVE-2020-5135 in October 2020. Later reporting said ransomware groups continued to heavily abuse the flaw against vulnerable SonicWall VPNs.
A DFIR investigation found that attackers used an end-of-life SonicWall SRA 4600 appliance as the initial entry point in a LockBit 2.0 ransomware attack that ultimately encrypted a VMware ESXi hypervisor. The analysis described exploitation of credential exposure and command injection weaknesses on the appliance, followed by privilege escalation and movement into Active Directory and the ESXi environment.
CISA warned that threat actors were targeting a previously patched vulnerability in SonicWall SMA 100 series and SRA products still running end-of-life firmware as part of targeted ransomware attacks. SonicWall issued an urgent security notice advising customers to upgrade to the latest firmware or immediately disconnect end-of-life appliances.
BleepingComputer reported that a cybersecurity industry source said HelloKitty had been exploiting the SonicWall vulnerability for the past few weeks. CrowdStrike said the ongoing attacks involved multiple threat actors, including HelloKitty, and identified the flaw as CVE-2019-7481.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Correlate live exploitation activity against the software you actually run, and see where you're exposed.
3 references tracked. Mallory keeps watching after this page renders.
blog.compass-security.com
Open sourcebleepingcomputer.com
Open sourcecrowdstrike.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Threat actors have launched a widespread campaign targeting SonicWall SSL VPN devices, resulting in the compromise of over 100 accounts across at least 16 customer environments. Security firm Huntress reported that attackers are rapidly authenticating into multiple accounts on compromised devices, indicating possession of valid credentials rather than relying on brute-force methods. The campaign began in earnest around October 4, 2025, with authentication attempts traced to a specific IP address, 202.155.8[.]73. In some cases, attackers disconnected after brief access, but in others, they conducted network scanning and attempted to access local Windows accounts, suggesting a range of post-compromise activities. The incident follows SonicWall’s disclosure of a security breach involving unauthorized exposure of firewall configuration backup files stored in MySonicWall accounts, which could provide attackers with sensitive information such as user and group settings, DNS configurations, and certificates. Although there is no direct evidence linking the configuration file breach to the VPN compromises, the risk of credential exposure remains high, prompting advisories for organizations to reset credentials on live firewall devices. Concurrently, security teams observed a surge in Akira ransomware incidents exploiting SonicWall SSL VPN devices, initially suspected to be due to a zero-day but later attributed to the known vulnerability CVE-2024-40766. This vulnerability, an improper access control flaw in SonicOS, affects multiple generations of SonicWall devices and was first disclosed and patched in August 2024. Despite the availability of a patch, unpatched devices remain vulnerable and have been actively targeted by Akira ransomware affiliates. In one documented case, Darktrace detected suspicious activity including network scanning, lateral movement, privilege escalation, and data exfiltration on a customer’s network, with approximately 2 GiB of data exfiltrated before the attack was contained. The attackers’ tactics included leveraging both the CVE-2024-40766 vulnerability and misconfigurations to gain access. The campaign underscores the importance of timely patching and credential hygiene, as attackers are exploiting both technical vulnerabilities and exposed credentials to infiltrate networks. Organizations using SonicWall’s cloud backup service are particularly at risk if they have not reset credentials following the configuration file exposure. Security advisories recommend immediate credential resets and patching of all affected SonicWall devices to mitigate ongoing threats. The incidents highlight the persistent threat posed by ransomware groups like Akira, who continue to exploit both new and previously disclosed vulnerabilities in widely deployed network infrastructure. The rapid detection and response by managed security services, such as those provided by Darktrace, have proven effective in limiting the impact of these attacks. However, the scale and speed of the current campaign demonstrate the attackers’ ability to coordinate and execute widespread compromises across multiple organizations. The situation remains dynamic, with ongoing investigations into the full extent of the compromise and the potential links between credential exposure and active exploitation. Organizations are urged to review their SonicWall device configurations, monitor for suspicious authentication activity, and ensure all security patches are applied without delay.
Jun 29, 2026
Internet-facing **SonicWall SMA 1000** appliances are under active exploitation through a zero-click, pre-authentication chain that combines `CVE-2026-15409` and `CVE-2026-15410` to deliver unauthenticated **root compromise**. Resecurity reported exploitation began by at least June 22, before SonicWall released July fixes, and identified **INC Ransomware** as the primary actor observed using the full chain. The attack abuses a `wsproxy` bypass to reach localhost-only services and then uses a path traversal flaw in the hotfix-removal process to execute a staged script with root privileges. Affected products include **SMA 6210, SMA 7210, SMA 8200v, and vCMS** in the SMA 1000 line, while SonicWall firewall SSL VPN and SMA 100 Series products are not affected. Post-compromise activity included persistent backdoors, an HTTP forwarding proxy, a memory-resident web shell, packet capture targeting unencrypted LDAP traffic, startup and routing changes for persistence, credential-theft opportunities, and use of the appliance as a pivot into internal networks. SonicWall advised organizations to upgrade to fixed firmware, preserve logs, hunt for indicators of compromise, and treat exposed devices as potentially breached, with rebuilds or factory resets and credential rotation recommended where intrusion is suspected.
Aug 4, 2026
Google Threat Intelligence Group reported an ongoing campaign targeting fully patched, end-of-life SonicWall SMA 100 appliances, where suspected financially motivated actor **UNC6148** deployed the **OVERSTEP** backdoor to maintain persistent access, steal credentials, and evade detection by selectively removing log entries and modifying the boot process. The activity appears to date back to at least October 2024 and affected SMA 210, SMA 410, and SMA 500v devices, with the actor reportedly regaining access using previously stolen administrator credentials and OTP seeds; investigators also assessed with moderate confidence that an unknown zero-day remote code execution path may have been used to install the malware and obtain shell access. Subsequent reporting said SonicWall released updated firmware for SMA 100 appliances that adds advanced file integrity checks to detect and remove known rootkits, after exploitation tied the campaign to **`CVE-2024-38475`** in Apache HTTP Server and **`CVE-2025-40599`** in SonicWall SMA 100. The intrusions enabled reverse shells and theft of sensitive data including `persist.database`, certificates, credentials, and OTP seeds, and were linked to follow-on extortion and possible ransomware activity, including overlap with incidents associated with Abyss-branded ransomware and a victim later named on the **World Leaks** site; defenders were urged to apply SonicWall guidance, rotate all credentials, reset MFA tokens, and consider migration as SMA 100 support ended.
Jul 24, 2026