Reported Cyber Incidents Involving Gen 7 SonicWall Firewalls

There has been a notable increase in both internally and externally reported cyber incidents involving Gen 7 SonicWall firewalls where SSLVPN is enabled. This includes threat activity highlighted by several third-party cybersecurity research teams.

DefenseStorm is aware that, over the past 72 hours, there has been a notable increase in both internally and externally reported cyber incidents involving Gen 7 SonicWall firewalls where SSLVPN is enabled. This includes threat activity highlighted by several third-party cybersecurity research teams. Please see the content below taken directly from SonicWall:

“We are actively investigating these incidents to determine whether they are connected to a previously disclosed vulnerability or if a new vulnerability may be responsible.”

Ongoing Investigation

We are:

Working closely with external threat research partners.
- Continuously updating our partners and customers as the investigation progresses.
  - Committed to releasing updated firmware and instructions promptly if a new vulnerability is confirmed

Recommended Mitigation Steps

Until further notice, we strongly advise all partners and customers using Gen 7 SonicWall firewalls to take the following actions:

Disable SSLVPN Services Where Practical
- NOTE: All other steps below should still be followed even if disabling SSLVPN is not viable.
  - Limit SSLVPN connectivity to trusted source IPs.

Enable Security Services

- Activate services such as Botnet Protection and Geo-IP Filtering.
  - These help detect and block known threat actors targeting SSLVPN endpoints.

Enforce Multi-Factor Authentication (MFA)

- Enable MFA for all remote access to reduce the risk of credential abuse.
  NOTE: Some reports suggest MFA enforcement alone may not protect against the activity under investigation

Remove Unused Accounts

- Delete any inactive or unused local user accounts on the firewall.
  - Pay special attention to those with SSLVPN access.

Practice Good Password Hygiene

- Encourage regular password updates across all user accounts.

Please remain vigilant and apply the above mitigations immediately to reduce exposure while we continue our investigation. We will update this KB as additional information becomes available.

Change Log

2025-08-04 Initial publish

DefenseStorm Response

DefenseStorm is recommending that everyone who uses SonicWall review any advisories received or published by SonicWall and evaluate if they apply to your organization.

DefenseStorm always recommends applying any changes in accordance with your existing internal policies and change controls.

Please bookmark: https://www.sonicwall.com/support/notices/gen-7-sonicwall-firewalls-sslvpn-recent-threat-activity/250804095336430 to stay up to date with the latest developments related to this incident.

Cisco Customer Guidance for ISE and ISE-PIC vulnerabilities Cisco Secure Firewall Management Center Software RADIUS Remote Code Execution Vulnerability

James Bruhl

Director of Cyber Threat Intelligence

James Bruhl is the Director of Cyber Threat Intelligence for DefenseStorm. He joined the company with 15 years of experience as a law enforcement officer, bringing extensive experience in crime prevention, evidence collection, investigative techniques, and crisis management. Driven by a passion for technological advancements and the ever-evolving landscape of digital threats, he transitioned to the field of digital forensics, incident response, and cybersecurity. In his role, he honed his skills in analyzing digital evidence, identifying cyber threats, and implementing robust security measures specializing in forensic examinations on various devices to uncover critical information and support investigations. James began at DefenseStorm as a security engineer in 2020 and developed DefenseStorm’s EDR Service. He was then appointed as Director of Cyber Threat Intelligence in 2022 and is responsible for nearly all facets of the EDR service. During his cyber career, James has been instrumental in proactively detecting and responding to cyber incidents and plays a vital role in incident response teams, coordination efforts to mitigate the impact of breaches, vulnerability identification, and strategy implementation to prevent future attacks. He continues to share his expertise by conducting training sessions, participating in conferences, and writing articles on topics related to digital forensics, incident response, and cybersecurity. James holds a bachelor’s in criminal justice from the University of North Georgia and a GCFE certification.