Credential Access Campaign Targeting SonicWall SMA Devices Linked to CVE-2021-20035

Arctic Wolf reports an active campaign (Jan–Apr 2025) targeting SonicWall SMA 100 series appliances that leverages CVE-2021-20035 — recently reclassified by SonicWall as allowing remote code execution and added to CISA’s KEV — alongside credential-compromise techniques (including default/insecure local admin passwords and credential stuffing) to access VPN accounts; the advisory urges patching, enabling MFA, resetting local passwords, limiting VPN accounts, disabling unused accounts, and configuring syslog monitoring.