Credential Stuffing Campaign Hits SonicWall | Huntress SOC Tracking

What it is

A credential stuffing / brute-force campaign against SonicWall SSL VPN and firewall logins, tracked by the Huntress SOC beginning July 25, 2026 at ~18:02:21 UTC. The summary gives the shape; what the page carries is the concrete IoCs, the day-by-day victim counts, the link to prior campaigns, and an ordered remediation sequence.

Preconditions / Affected

Organizations exposing SonicWall VPN or firewall management/remote access to the WAN. The attack validates existing credentials, so accounts with reused or previously-leaked passwords and no MFA are the ones that fall. Notably, in one instance the same four compromised accounts had already been targeted in a separate May 22, 2026 incident — reused credentials are the recurring thread.

Indicators of compromise

Five DigitalOcean, LLC IPs drove the campaign:

• 157.245.88.153
• 162.243.31.111
• 167.71.150.1
• 209.97.151.148
• 64.227.15.20

Daily compromise counts: July 25 — 26 accounts / 6 orgs; July 26 — 34 accounts / 16 orgs; July 27 — 32 accounts / 8 orgs. This is part of a pattern of SonicWall SSLVPN spikes, including October 2025 (rapid multi-account auth across compromised devices) and February 2026 (compromised SSLVPN creds used for initial access).

What to do

The page gives an explicit, ordered remediation — the sequencing matters:

1. Immediately restrict WAN management and remote access where possible.
2. Disable or limit HTTP, HTTPS, SSH, SSL VPN and inbound management until credentials are reset.
3. Reset all secrets and keys on affected devices now: local admin accounts, VPN pre-shared keys, LDAP/RADIUS/TACACS+ bind credentials, wireless PSKs, SNMP credentials.
4. Revoke and roll external API keys, dynamic DNS, SMTP/FTP credentials, and any automation secrets touching the firewall or management systems.
5. Increase logging; review recent logins and configuration changes; retain forensic logs while investigating.
6. After resets, reintroduce services one at a time and watch for unauthorised access reappearing.
7. Enforce MFA for all admin and remote accounts; apply least privilege to management roles.

The key operational point beyond the summary: cut access first, reset the full credential set (not just admin passwords), then reintroduce services individually to catch persistence.

Caveats

Huntress observed no post-compromise hands-on-keyboard activity — this is automated credential validation, not (yet) intrusion. Counts are "at time of publication" and expected to grow; the blog is being updated as the campaign continues. The absence of follow-on activity does not mean validated credentials won't be used later or sold.