Between February 22 and February 25, 2026, GreyNoise observed a significant wave of reconnaissance activity targeting SonicWall firewalls.
A total of 84,142 scanning sessions were conducted, originating from over 4,000 unique IP addresses across 20 autonomous systems.
The activity, which primarily focused on SSL VPN enumeration, underscores the growing risk of credential-based attacks, a tactic commonly used by ransomware groups.
SonicWall’s SSL VPN infrastructure has long been a key entry point for cybercriminals, including notorious ransomware groups like Akira and Fog.
These groups have successfully compromised SonicWall VPN credentials to deploy ransomware, resulting in encryption within under 4 hours.
The reconnaissance activity observed by GreyNoise is a precursor to potential exploitation, particularly considering the number of SonicWall vulnerabilities cataloged by CISA.
Notably, five of the seven vulnerabilities have been exploited by ransomware groups, making this a pressing security concern.
GreyNoise’s findings indicate that the scanning campaign is systematically mapping the attack surface of exposed SonicWall devices, specifically focusing on identifying SSL VPN-enabled devices.
This campaign was timed to occur in surgical bursts, using both commercial proxy services and direct scanning clusters.
The primary purpose of this attack was to determine which devices were vulnerable to credential stuffing before the more resource-intensive exploitation phase began.
Campaign Details
The scanning campaign unfolded in four distinct bursts, with a noticeable 31-hour low-activity period on February 23.
The initial wave of scanning saw a peak of 3,272 sessions per hour, focusing on two primary paths: the VPN status-check API and the NetExtender VPN client login endpoint. These endpoints are essential for identifying active VPN services, a crucial step before credential attacks.
The majority of the traffic came from two distinct infrastructure clusters. One was based in the Netherlands and involved coordinated scanning across both SonicWall and Cisco ASA devices. The second was a proxy service, ByteZero, which facilitated over 32% of the campaign’s traffic.
According to Greynoise, ByteZero’s proxy infrastructure allowed for the use of rotating exit IPs, helping evade detection and rate-limiting measures. This highlights how threat actors are evolving, using commercial proxy services to scale attacks with minimal risk of detection.
This large-scale reconnaissance campaign underscores the need for proactive security measures, particularly for organizations that use SonicWall SSL VPN devices.
With over 430,000 SonicWall firewalls exposed online and many vulnerable to known flaws, the window of opportunity for attackers is closing fast.
Follow us on Google News , LinkedIn and X to Get More Instant Updates. Set Cyberpress as a Preferred Source in Google.
