Security vanguards at SonicWall have unmasked a nascent campaign disseminating the VioletRAT malware. This offensive orchestrates a multi-tiered delivery sequence and a sophisticated Python-based code injection paradigm. The adversaries employ several stages of clandestine...
Adversaries are increasingly inaugurating their offensives not with conventional malware, but by subverting legitimate remote access credentials. A recent incursion, meticulously analyzed by Huntress, highlights a disconcerting trend: after infiltrating a network via SonicWall...
Virtual machines are often perceived as impenetrable bastions for risk assessment, operating under the assumption that the host remains insulated even when the guest environment is compromised. However, in December 2025, the Huntress team...
In the third quarter of 2025, Beazley Security Labs recorded a sharp surge in the activity of major ransomware groups and the emergence of new delivery mechanisms for infostealers. The primary cybercriminal campaigns centered...
The 2025 At-Bay InsurSec Rankings report recorded a sharp surge in cyberattacks linked to email and remote access—two channels responsible for nearly 90% of all incidents among the company’s clients. Analysts highlight that generative...
Huntress has published a detailed account of an incident in which attackers, having exploited a vulnerable SonicWall VPN, gained access to the management console and nearly stripped the organization of its defensive capabilities by...
In August 2024, SonicWall issued security advisory SNWLID-2024-0015, disclosing an improper access control vulnerability in SSLVPN across Gen5, Gen6, and Gen7 devices. The flaw enabled attackers to bypass restrictions and gain access under specific...
Akira ransomware attacks are growing ever more sophisticated: threat actors have begun exploiting a legitimate Intel CPU tuning driver to disable Windows’ built-in protections. The driver in question—rwdrv.sys, part of the ThrottleStop utility—is registered...
Since mid-July, a surge in ransomware attacks leveraging the Akira strain has been observed, specifically targeting SonicWall devices. According to cybersecurity firm Arctic Wolf, threat actors have been actively exploiting SSL VPN connections on...
Attacks targeting outdated SonicWall SMA 100 devices have once again exposed the fragility of network perimeters often overlooked by conventional security systems. According to the Google Threat Intelligence Group (GTIG), a targeted campaign employing...
Unknown threat actors have begun disseminating a counterfeit version of the SonicWall application, designed to steal credentials used to access VPNs. The campaign was uncovered by experts at SonicWall and Microsoft, who detected attempts...
Cybersecurity firm Bishop Fox has discovered that over 178,000 of SonicWall next-generation firewalls (NGFW), with online accessible management interfaces, are vulnerable to Denial of Service (DoS) attacks and Remote Code Execution (RCE). The devices...
