SonicWall VPN mapping: what practitioners need to act on

TL;DR: 84,142 scanning sessions against SonicWall SonicOS were observed in four days, according to GreyNoise, with 92% probing a single API endpoint to check whether SSL VPN was enabled before credential attacks, while commercial proxies and rotating scanner fleets obscured the campaign. The pattern shows reconnaissance is now a structured prelude to VPN compromise, not noisy background traffic.

Editorial analysis by NHI Mgmt Group, based on content published by GreyNoise: “Active Reconnaissance Campaign Targets SonicWall Firewalls Through Commercial Proxy Infrastructure”.

By the numbers:

• The campaign came from 4,305 unique IP addresses across 20 autonomous systems.
• A commercial proxy service delivered 32% of campaign volume through 4,102 rotating exit IPs in two surgical bursts totaling 16 hours.

Key questions

Q: What breaks when SSL VPN status endpoints are exposed to the internet?

A: Exposed status endpoints let attackers quickly separate live VPN targets from dead ones, which turns a broad scan into a curated target list for credential attacks.

Q: Why do distributed VPN scans increase the risk of credential compromise?

A: Distributed scans spread activity across many IPs, so simple rate limits and reputation blocks miss the pattern.

Q: How should security teams detect pre-exploitation VPN reconnaissance?

A: Look for repeated status-check requests, low-volume bursts from rotating sources, and user-agent or protocol mismatches that do not fit normal client behaviour.

Practitioner guidance

• Restrict VPN management exposure Move administrative and status-check endpoints off the public internet and allow only trusted management sources to reach them.
• Harden SSL VPN authentication Enforce MFA for all remote-access users and remove shared or reused credentials from VPN access paths.
• Detect reconnaissance by behaviour, not just IP Alert on repeated status-check probes, HTTP/1.0 browser mismatches, and bursts from rotating source addresses.

Bottom line: The campaign shows that VPN reconnaissance is being used to pre-select likely victims before exploitation, which makes exposure management an identity problem as well as a network one.

Explore further

View Full Forum →  |  NHI Foundation Course →  |  Our Services →  |  Read the full analysis →