Massive SonicWall Reconnaissance Campaign Signals Imminent Ransomware Strikes

Between February 22–25, 2026, GreyNoise observed a highly coordinated reconnaissance campaign targeting SonicWall SonicOS devices: roughly 84,000 scanning sessions from over 4,300 unique IPs repeatedly queried SSL VPN-related endpoints to determine if VPN access was enabled. Attackers used commercial proxy services and rapid IP rotation to avoid detection; the activity is assessed as preparatory mapping for credential-stuffing/brute-force attacks and is linked in the report to ransomware groups (Akira, Fog). The report lists specific request paths to search for in logs, recommends immediate checks of active VPN sessions, firmware patching (citing CVE-2024-53704), enforcing MFA, and isolating legacy SRA appliances.