Hackers Actively Scan SonicWall Firewall Interfaces as 597,000 Sessions Observed

A sharp surge in internet scanning activity targeting SonicWall firewall management interfaces has raised concerns among cybersecurity researchers, with GreyNoise reporting nearly 597,000 sessions in a single day.

The spike, observed on May 12, 2026, marks the highest volume recorded in the past 90 days and is approximately 46 times higher than the typical daily baseline.

According to GreyNoise telemetry, the activity occurred between May 9 and May 18, focusing on SonicWall SonicOS management APIs.

This pattern closely resembles scanning waves previously seen earlier this year, which preceded the disclosure of a critical vulnerability tracked as CVE-2026-0400. While researchers caution that this correlation is not definitive, the timing and behavior suggest the possibility of pre-disclosure reconnaissance.

Hackers Scan SonicWall Firewall Interfaces

Analysis of the traffic reveals a highly consistent and automated scanning approach:

• Nearly 99% of requests use a single user-agent string: Chrome 119 on Linux x86_64, identical to tooling observed in earlier campaigns.
• Around 56% of sessions originate from networks in the Netherlands, while 44% come from Ukraine.
• A single autonomous system, AS211736, accounts for roughly half of the observed activity.
• The majority of targeted traffic is directed at HTTP services over ports 80 and 8080.
• Most of the source IPs involved are classified as “suspicious” by GreyNoise.

This level of uniformity indicates the likely use of centralized scanning infrastructure, possibly operated by a coordinated threat actor or group preparing for exploitation.

GreyNoise highlighted a similar sequence of scanning spikes earlier in 2026, occurring on January 18, January 30, and February 14. These events preceded the public disclosure of CVE-2026-0400 on February 24 by 37, 25, and 10 days, respectively.

Although this pattern suggests that spikes in scanning may act as early warning signals, researchers emphasize that it should not be interpreted as a guaranteed indicator of an impending vulnerability disclosure. The current spike could represent a single event, part of a broader sequence, or unrelated background activity.

Security teams using SonicWall devices are advised to take proactive steps to reduce exposure:

• Restrict access to SonicOS management interfaces and SSL VPN portals to trusted IP ranges only.
• Enforce multi-factor authentication (MFA) for all remote access accounts.
• Review configurations for unauthorized administrative accounts created after May 1, 2026.
• Deploy dynamic IP blocklists to filter suspicious traffic at the network edge.

Over the coming weeks, organizations should closely monitor SonicWall’s PSIRT advisories and be prepared to apply patches within 24 hours of any new vulnerability disclosure. Enhanced logging and outbound traffic monitoring are also recommended to detect potential compromise.

The current spike underscores how large-scale scanning activity can serve as an early signal of emerging threats, reinforcing the need for continuous monitoring and rapid response readiness.

Follow us on Google News, LinkedIn, and X to Get Instant Updates and Set GBH as a Preferred Source in Google.