Disable Your SonicWall VPN: Threat Actors May Be Exploiting This Vulnerability – Source: www.techrepublic.com

Cybersecurity platform company SonicWall is investigating a wave of cyberattacks targeting its Gen 7 firewalls with SSLVPN enabled, amid rising activity linked to suspected threat actors. As of Aug. 6, the company said it is working with external threat research teams and will release firmware updates if a new vulnerability is confirmed.

Security research teams from Arctic Wolf, Google Mandiant, and Huntress have documented the suspicious activity, which was first detected on or around July 15.

SonicWall recommends disabling SSLVPN

SonicWall recommends customers using the Gen 7 SonicWall firewalls with SSLVPN to take the following steps:

• Disable SSLVPN where possible.
• Limit SSLVPN connectivity to trusted source IPs.
• Enable security features such as Botnet Protection and Geo-IP Filtering.
• Implement multi-factor authentication.
• Regularly update passwords across user accounts in accordance with good security hygiene.

Some of the intrusions bypassed MFA, according to Huntress, which noted that threat actors used over-privileged LDAP or service accounts to gain administrative control. From there, they could move laterally through the network, disable security tools, and deploy ransomware.

Huntress began tracking attacks on July 25 and continues to monitor the activity.

Rise in Akira ransomware tied to VPN exploitation

Arctic Wolf Labs reported a notable increase in Akira ransomware activity in July 2025, with SonicWall SSLVPN among the targeted infrastructure. While no direct link to a single vulnerability was confirmed, Akira is known to exploit VPNs in targeted campaigns.

Akira, first detected in March 2023, has since claimed responsibility for attacks on Stanford University, Nissan, and other high-profile targets. Arctic Wolf Labs recommends blocking VPN activity from specific hosting-related autonomous system numbers (ASNs) to reduce exposure.

Attack detected in July left SonicWall appliances vulnerable

In a separate incident disclosed by Google Threat Intelligence Group and Mandiant, a different threat actor —  tracked as UNC6148  — targeted SonicWall Secure Mobile Access (SMA) 100 series appliances. The attacker loaded a persistent backdoor rootkit onto the appliance using a technique called OVERSTEP, enabling them to gain privileged control over it.

SonicWall stated that it is still determining whether the SSLVPN vulnerability is “connected to a previously disclosed vulnerability or if a new vulnerability may be responsible.”

For more cybersecurity news, see our coverage of researcher Mikko Hypponen’s Black Hat conference keynote tracing the history of malware.