Hackers Launch Massive SonicWall Firewall Attack Using 4,000+ IP Addresses

Hackers are actively mapping SonicWall firewalls worldwide, launching more than 84,000 SonicOS scanning sessions from over 4,000 unique IP addresses in just four days to identify SSL VPN targets for future credential and vulnerability attacks.

Three operationally distinct infrastructure clusters coordinated large-scale VPN enumeration, with 92% of all sessions hitting a single SonicOS REST API endpoint used to check whether SSL VPN is enabled.

A commercial proxy network contributed 32% of total traffic by rotating 4,102 exit IPs through two tightly timed 7–9 hour bursts, keeping per‑IP session counts low to evade rate limiting.

Crucially, CVE exploitation activity was negligible, indicating this is systematic attack surface mapping rather than an exploitation wave.

Between February 22 and 25, 2026, GreyNoise recorded 84,142 scanning sessions against SonicWall SonicOS devices, originating from 4,305 unique IPs across 20 autonomous systems.

CVE ID	CVSS Score	CISA KEV	Ransomware Use	Campaign / Sessions
CVE-2024-53704	9.8	Yes	Yes	5
CVE-2024-40766	9.8	Yes	Yes (Akira, Fog)	No tag
CVE-2022-22274	9.8	No	No	9*
CVE-2023-0656	7.5	No	No	9*
CVE-2021-20028	9.8	Yes	Yes	8
CVE-2024-38475	9.1	Yes	Unknown	6
CVE-2019-7481	7.5	Yes	Yes	6

GreyNoise assesses this as pre‑exploitation reconnaissance designed to build a high‑value list of SonicWall firewalls with exposed SSL VPN services for future credential stuffing and vulnerability abuse.

Why SonicWall VPNs Are a Prime Target

Security researchers have shown that Akira can move from SonicWall VPN login to full environment encryption in under 4 hours, with some dwell times under 1 hour.

The overwhelming concentration on the VPN status API endpoint reveals the campaign’s objective: building a comprehensive list of SonicWall devices with active SSL VPN.

Since March 2023, Akira alone is estimated to have compromised at least hundreds of organizations and earned hundreds of millions of dollars using SonicWall VPN access as a key entry point, with Fog ransomware also observed abusing the same channel.

SonicWall SSL VPN has become one of the most documented initial access vectors for ransomware operators, especially the Akira ransomware group.

GreyNoise notes that five of seven SonicWall CVEs relevant to this attack surface appear in CISA’s Known Exploited Vulnerabilities catalog, and four have documented ransomware use.

One of the most critical is CVE‑2024‑53704 (CVSS 9.8), an authentication bypass in SonicOS and NSv appliances tracked in SonicWall advisory SNWLID‑2025‑0003 and actively exploited in the wild.

With more than 430,000 SonicWall firewalls exposed to the internet and tens of thousands of SSL VPN appliances vulnerable or running unsupported firmware, the reconnaissance now underway dramatically lowers attacker effort to select exploitable targets.

GreyNoise attributes the February 2026 activity to four main infrastructure clusters, all focused on SonicWall VPN discovery and, to a lesser extent, credential testing.

A Netherlands‑based “VPN hunter” cluster, hosted under a Ukrainian‑registered AS, accounts for roughly a quarter of sessions and scans both SonicWall and Cisco ASA endpoints using identical HASSH fingerprints, indicating a shared, purpose‑built scanning framework.

A second cluster relies on the ByteZero commercial proxy network, which advertises tens of millions of IPs and has been operating in a “headless” state since late 2025, allowing unchecked abuse.

A single “mega‑scanner” node generates more than 18,000 sessions alone, rotating through 20+ ports and 26 browser user agents to defeat naive fingerprinting.

A persistent NetExtender cluster quietly runs at 54–72 sessions per hour, continuously testing VPN credentials via the legitimate client login endpoint, and continues even during the 95% traffic lull on February 23, suggesting deliberate operator scheduling rather than infrastructure failure.

Across the campaign, a single suspicious HTTP fingerprint a Chrome‑on‑Linux user agent combined with HTTP/1.0 accounts for nearly 70% of sessions and serves as a reliable indicator of automated SonicWall VPN enumeration.

From Reconnaissance to Exploitation

The pattern GreyNoise now documents mirrors a December 2025 dual‑vendor campaign that targeted both Palo Alto GlobalProtect and SonicWall APIs with millions of sessions from thousands of IPs sharing the same client fingerprints.

That earlier surge preceded waves of credential‑based intrusions, reinforcing the view that today’s SonicWall reconnaissance is the mapping phase before a larger exploitation push.

At the same time, global reporting shows commercial and residential proxies have become core infrastructure for credential attacks, with disrupted platforms like IPIDEA previously serving hundreds of threat groups and daily VPN brute‑force activity measured in the millions of IPs.

For defenders, the message is clear: treat SonicWall VPN infrastructure as critical, internet‑facing attack surface that is already under coordinated, proxy‑backed scrutiny.

Organizations should immediately restrict management access, enforce MFA on all SSL VPN users, and urgently patch CVE‑2024‑53704 and other SonicOS flaws before this reconnaissance phase evolves into mass exploitation and fast‑moving ransomware incidents.

Follow us on Google News, LinkedIn, and X to Get Instant Updates and Set GBH as a Preferred Source in Google.