Hackers Attacking SonicWall Firewalls from 4,000+ unique IP Addresses to Exploit Vulnerabilities

A coordinated reconnaissance campaign (22–25 Feb 2026) leveraged 4,305 distinct IPs and a commercial rotating proxy service to perform 84,142 scanning sessions against SonicWall SonicOS SSL VPN REST API endpoints, systematically building lists of targets; roughly 430,000 SonicWall devices are internet-accessible, with over 25,000 carrying unpatched critical vulnerabilities and ~20,000 on unsupported firmware. The activity mirrors prior large-scale scans and is linked to ransomware families (Akira, Fog) that have historically exploited SonicWall access; the report urges immediate remediation steps including patching CVE-2024-53704, enforcing MFA, restricting management access, resetting local passwords, monitoring for HTTP/1.0 + modern UA scanning patterns, and decommissioning EOL appliances.