Coordinated Proxy Based Scanning Targets SonicWall Firewalls

Du'aine Davis

Observed in the wild

• Between 22–25 February, GreyNoise observed a coordinated reconnaissance campaign generating 84,142 scanning sessions from 4,305 unique IPs, targeting internet‑exposed SonicWall SonicOS firewalls, specifically organisations running SSL VPN services. The activity was global, highly structured, and assessed as pre‑exploitation attack surface mapping, not immediate exploitation.
• Attackers used three infrastructure clusters, including a commercial proxy service supplying 32% of traffic via 4,102 rotating exit IPs, to evade rate‑limiting and detection. 92% of requests hit a single SonicOS API endpoint that checks whether SSL VPN is enabled, a prerequisite for later credential‑based attacks. No significant CVE exploitation was observed, confirming reconnaissance intent.
• Organisations are advised to treat this as an early‑warning signal. Defenders should review firewall and VPN logs for repeated hits to SSL VPN status endpoints, especially from proxy or hosting ASNs. Using Microsoft Defender, organisations should hunt for abnormal VPN enumeration behaviour, correlate with Defender for Network/Cloud Apps alerts, enforce conditional access, MFA, restrict VPN exposure, and ensure SonicOS firmware is fully patched.

Active Reconnaissance Campaign Targets SonicWall Firewalls Through Commercial Proxy Infrastructure