Cybersecurity Alert: SonicWall VPN Vulnerability Exploited by Ransomware Groups

Since July, there has been a notable increase in ransomware activity targeting organizations using SonicWall firewalls, particularly the SonicWall SSL VPN functionality. A critical unknown vulnerability is giving attackers and ransomware groups initial access to internal networks, allowing them to move laterally, compromise domain controllers, and deploy ransomware to encrypt devices. 

It is strongly advisable to temporarily disable SonicWall’s SSL VPN service until SonicWall releases more information regarding this critical vulnerability. 

For further details and vendor guidance, visit SonicWall’s advisory here.

If your organization uses SonicWall devices, act immediately to mitigate risk. For assistance assessing exposure or implementing security controls related to the SonicWall VPN vulnerability, contact Withum’s Cybersecurity Consulting Services Team. 

Authors: Ky Rees | [email protected] and Edward Keck, Jr., Partner and Market Leader, Cybersecurity Consulting Services | [email protected]