Credential Stuffing Campaign Hits SonicWall | Huntress SOC Tracking

Huntress SOC detected a widespread automated credential-stuffing/brute-force campaign targeting SonicWall VPNs and firewalls between July 25–27, 2026; five DigitalOcean-hosted IPs were identified as primary infrastructure and roughly 30 organizations experienced account compromises. The report includes IoCs, a timeline of daily compromises, and mitigation recommendations (reset credentials, restrict remote management, enforce MFA, and increase logging).