Active Exploitation of SonicWall VPNs

T1Covered by 1 source · first reported by Huntress at 13 Aug 2025, 22:00 UTC

A likely zero-day vulnerability in SonicWall VPNs is being actively exploited to bypass MFA and deploy ransomware. Huntress advises disabling the VPN service immediately or severely restricting access via IP allow-listing. We're seeing threat actors pivot directly to domain controllers within hours…

security

Sources

• T1Active Exploitation of SonicWall VPNsHuntress13 Aug 2025, 22:00