SonicWall VPN reconnaissance is priming credential attacks

At a glance

What this is: GreyNoise tracked a coordinated SonicWall VPN reconnaissance campaign that concentrated on status checks and credential-testing endpoints rather than active CVE exploitation.

Why it matters: This matters because VPN mapping often precedes credential attacks and ransomware, so IAM and security teams need to treat exposed remote-access infrastructure as an identity risk as much as a perimeter risk.

By the numbers:

• The campaign came from 4,305 unique IP addresses across 20 autonomous systems.
• A commercial proxy service delivered 32% of campaign volume through 4,102 rotating exit IPs in two surgical bursts totaling 16 hours.

Context

Remote-access VPNs are not just access channels, they are identity chokepoints: once attackers know which devices expose SSL VPN, they can prioritise high-value targets for password reuse, credential stuffing, or later exploitation. That makes VPN reconnaissance a governance problem for both network security and VPN Security Guide identity control.

GreyNoise is describing a broad mapping operation rather than a single exploit attempt. The pattern is operationally mature because it uses status checks, rotating infrastructure, and low-volume credential testing to build target lists before defenders can react.

Key questions

Q: What breaks when SSL VPN status endpoints are exposed to the internet?

A: Exposed status endpoints let attackers quickly separate live VPN targets from dead ones, which turns a broad scan into a curated target list for credential attacks. That shortens the time between discovery and abuse, and it also gives adversaries a way to spend proxy resources only on devices that matter. The failure is exposure without access scoping.

Q: Why do distributed VPN scans increase the risk of credential compromise?

A: Distributed scans spread activity across many IPs, so simple rate limits and reputation blocks miss the pattern. Once the attacker can map which devices expose SSL VPN, they can focus login attempts on the most promising targets and blend into ordinary internet noise. The risk increases because the attacker controls the pace of discovery and testing.

Q: How should security teams detect pre-exploitation VPN reconnaissance?

A: Look for repeated status-check requests, low-volume bursts from rotating sources, and user-agent or protocol mismatches that do not fit normal client behaviour. The goal is to identify target mapping before login testing begins. Teams should also correlate those signals with remote-access logs, because the first stage of compromise often looks like simple enumeration.

Q: Should organisations prioritise MFA or firmware patching first for exposed VPNs?

A: They should do both, but if the device is internet-facing and vulnerable, patching is the first containment step because MFA does not remove the exploit path. Where login abuse is the main risk, MFA sharply reduces the value of stolen credentials. The right sequence is exposure reduction, then authentication hardening, then continuous monitoring.

Technical breakdown

VPN status checks as target selection

The dominant behaviour here is reconnaissance through a status-check endpoint, not code execution. Attackers first determine whether SSL VPN is enabled, because that tells them whether a device is worth investing proxy capacity and login attempts against. This is a classic pre-compromise optimisation step: reduce cost by filtering out dead ends before launching credential attacks. In practice, the endpoint becomes a signal of exposure, and the presence of active SSL VPN turns a firewall into an identity target as much as a network boundary. See the VPN Security Guide.

Practical implication: Restrict exposure of VPN status and admin endpoints to trusted management networks only.

Why rotating proxies change the defender's problem

Commercial proxy services break the assumptions behind static blocklists. When each exit IP sends only a handful of sessions, reputation-based controls see low-signal traffic that resembles ordinary internet noise. The real mechanism is distribution: the same campaign can spread across thousands of source IPs while preserving a single operational objective. That means defenders need to look for behavioural clusters, shared fingerprints, and endpoint concentration rather than relying on source address alone. For VPN infrastructure, address hygiene is no longer enough if the traffic pattern itself is adaptive. Read the Ultimate Guide to NHIs: Static vs Dynamic Secrets.

Practical implication: Use behavioural detections for low-and-slow VPN reconnaissance instead of relying on IP reputation alone.

Credential testing against legitimate VPN clients

The NetExtender cluster shows how attackers blend credential testing into normal-looking client traffic. By using a legitimate VPN client identifier, the campaign reduces obvious anomalies while still probing for valid usernames and passwords. This matters because authentication telemetry can look benign unless teams correlate source reputation, session cadence, and failed-login patterns. The security lesson is that trusted client branding does not equal trusted identity. Once a legitimate client path is abused, the remote-access layer becomes a credential validation service for the attacker. See the API Key Management Guide.

Practical implication: Correlate VPN login telemetry with impossible source patterns and repeated failures to catch disguised credential testing.

Threat narrative

Attacker objective: The attacker aims to identify exposed SonicWall VPN targets and convert that mapping into authenticated access for ransomware or intrusion operations.

1. Entry begins with broad SonicWall SonicOS reconnaissance, where attackers query which devices have SSL VPN enabled and which management paths respond.
2. Credential access follows through low-volume login testing against NetExtender and other VPN endpoints, using distributed infrastructure to probe for reusable or weak credentials.
3. Escalation occurs when a valid VPN credential or exploitable device provides authenticated remote access into the internal environment.
4. Impact is the likely ransomware or intrusion follow-on, where compromised SonicWall VPN access can enable rapid encryption or broader network compromise.

Breaches seen in the wild

• CitrixBleed 2 2025: CitrixBleed 2 leaked NetScaler session tokens from memory, letting attackers hijack VPN sessions and skip MFA at 100+ organisations.
• SonicWall SSL VPN account compromises 2025: Attackers used valid credentials to log in to more than 100 SonicWall SSL VPN accounts across 16 environments in October 2025.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

VPN reconnaissance is now an identity governance problem, not just a perimeter problem. The campaign shows that remote-access devices are being inventory-mapped as identity entry points before exploitation begins. Once attackers know which SSL VPN services exist, the next step is credential abuse, not random scanning. That collapses the old assumption that the firewall edge is separate from identity control, and makes exposed VPN status a governance issue for IAM and network security teams.

Low-volume, distributed scanning is the new normal for pre-exploitation pressure. The proxy-driven bursts in this campaign are designed to stay below simple rate limits while preserving operational coverage. That means defenders need to govern source diversity, session cadence, and endpoint concentration as detection signals. Static blocking is insufficient when the attacker can swap IPs faster than an allowlist can age.

Credential testing on legitimate VPN paths reveals a standing-trust failure. The NetExtender activity shows that attackers prefer paths that already look legitimate to the appliance. That means the control gap is not just password strength, but the fact that reusable credentials are still accepted as if they prove durable trust. Practitioners should treat remote-access authentication as a continuous risk surface, not a one-time gate.

Attack surface mapping is becoming a precursor layer for ransomware operations. GreyNoise is not describing active exploitation here, but the observed behaviour is the targeting phase that precedes it. The strategic implication is that organisations with exposed SSL VPNs are already in the threat queue even before a CVE is weaponised. Security teams should assume enumeration creates a near-term exploitation window, not a harmless reconnaissance event.

What this signals

Exposure control is now the first identity control for VPN estates. When attackers can enumerate which appliances have SSL VPN enabled, the security question shifts from whether a device is reachable to whether it should be publicly visible at all. That makes access scoping, service exposure review, and remote-admin separation part of identity governance for infrastructure.

Credential reuse is the business logic behind many remote-access compromises. The GreyNoise pattern only becomes dangerous when a live VPN path accepts reused or weak credentials as valid trust. Organisations should read that as a sign to tighten authentication policy, reduce standing remote access, and treat remote-login telemetry as part of identity risk management.

Reconnaissance creates a near-term conversion window. Once an attacker has built a target list, exploitation attempts often follow quickly, especially when the underlying appliance is already known to be vulnerable or exposed. Security teams should assume mapping activity is a trigger for accelerated review, not an isolated event.

For practitioners

• Restrict VPN management exposure Move administrative and status-check endpoints off the public internet and allow only trusted management sources to reach them.
• Harden SSL VPN authentication Enforce MFA for all remote-access users and remove shared or reused credentials from VPN access paths.
• Detect reconnaissance by behaviour, not just IP Alert on repeated status-check probes, HTTP/1.0 browser mismatches, and bursts from rotating source addresses.
• Treat exposed VPN firmware as a priority patch tier Patch SonicOS to the vendor-fixed versions and decommission end-of-life appliances that no longer receive security updates.

Key takeaways

• The campaign shows that VPN reconnaissance is being used to pre-select likely victims before exploitation, which makes exposure management an identity problem as well as a network one.
• GreyNoise recorded 84,142 sessions from 4,305 IPs, with 92% of probes focused on a single SSL VPN status-check endpoint, showing deliberate target mapping rather than opportunistic scanning.
• Teams should restrict administrative exposure, enforce MFA, and patch vulnerable SonicOS builds before reconnaissance turns into credential abuse or ransomware access.

Related NHI Mgmt Group resources: VPN Security Guide · API Key Management Guide · Guide to NHI Rotation Challenges · SonicWall SSL VPN account compromises 2025

Key terms

• LDAP Reconnaissance: LDAP reconnaissance is the process of querying directory services to collect information about users, groups, computers, permissions, and relationships. Attackers use that data to map an Active Directory environment, identify valuable targets, and plan follow-on actions such as privilege escalation or lateral movement.
• Status-Check Endpoint: A status-check endpoint is a web or API path that reveals whether a service such as SSL VPN is enabled. Attackers use it to build target lists, because knowing that a service is live is often enough to decide whether credential testing or exploit attempts are worth the effort.
• Rotating Proxy Infrastructure: Rotating proxy infrastructure routes attacker traffic through many changing IP addresses to make scanning harder to block and attribute. The traffic source appears distributed, but the operational goal stays the same, which is why defenders must look for shared fingerprints and repetitive behaviour rather than source IP alone.
• Credential Testing: Credential testing is the automated checking of stolen or guessed usernames and passwords against live services to find working accounts. Attackers use it to validate reused credentials at scale, often as a precursor to account takeover, fraud, or further abuse. Strong rate controls and anomaly detection are common defences.

Deepen your knowledge

The NHI Foundation Level course, the industry's only accredited NHI security programme, covers NHI governance, machine identity security, secrets management, and workload identity. It helps practitioners connect identity control to the wider security programme they operate every day.