From 4 October 2025, security firm Huntress saw attackers log in to more than 100 SonicWall SSL VPN accounts across 16 of its customers' environments. They did not guess passwords. "Threat actors are authenticating into multiple accounts rapidly across compromised devices," Huntress wrote, adding that "the speed and scale of these attacks imply that the attackers appear to control valid credentials rather than brute-forcing." Most connections came from a single IP address. In some cases the attackers disconnected quickly; in others they scanned the network and tried to access large numbers of local Windows accounts. The activity was still under way on 10 October. It coincided with SonicWall's confirmation on 8 October that attackers had accessed the firewall configuration backup files of all customers using its MySonicWall cloud backup service, but Huntress said it had found no evidence connecting the two. How the attackers obtained the VPN credentials is not known.
Key takeaways
- Huntress observed more than 100 SonicWall SSL VPN accounts compromised across 16 environments from 4 October 2025.
- Rapid logins across many accounts suggested the attackers held valid credentials rather than brute-forcing them.
- Some sessions led to network scanning and attempts to access local Windows accounts.
- SonicWall separately confirmed that attackers accessed all MySonicWall cloud backup configuration files; Huntress found no evidence linking the two.
- The identity lesson: VPN logins without MFA turn leaked passwords straight into network access, and device secrets need rotating after any configuration exposure.
At a glance
| Organisations | SonicWall SSL VPN customers (16 environments observed by Huntress) |
|---|---|
| When | From 4 October 2025; ongoing on 10 October 2025 |
| Attacker | Unattributed |
| Entry point | Valid SSL VPN account credentials, source unknown |
| Identities abused | More than 100 SSL VPN user accounts; attempted access to local Windows accounts |
| Impact | VPN access to corporate networks, with scanning and lateral movement attempts in some cases |
| Category | Human identity (not listed as an NHI or AI agent breach). Incident class: human-identity breach (valid VPN user credentials) |
What happened
Huntress published its warning on 10 October: "As of October 10, Huntress has observed widespread compromise of SonicWall SSLVPN devices across multiple customer environments," Security Affairs quoted. Jamie Levy, Huntress's director of adversary tactics, told Cybersecurity Dive: "The speed at which they are directly logging into multiple accounts without any brute forcing attempts prior shows that they have either valid credentials or that they have figured out another way to log in." BleepingComputer reported that most requests came from 202.155.8[.]73 and that, after logging in, the attackers in some cases "tried to access a large number of local Windows accounts."
The timing drew attention to SonicWall's own incident. In September, SonicWall told customers that firewall configuration backups stored in MySonicWall had been accessed, and on 8 October it confirmed that attackers had accessed the preference files of all firewalls using its cloud backup service. Those files contain encrypted credentials and configuration. Huntress, however, said it had not found evidence connecting its observations to the backup breach, and Cybersecurity Dive noted that the relationship, if any, remained unclear. Cybersecurity Dive also recalled that in August SonicWall had linked a separate wave of attacks to customers keeping old local passwords after firewall migrations.
Huntress and SonicWall recommended resetting local user passwords, updating LDAP, RADIUS and TACACS+ credentials and VPN secrets, revoking external API keys and automation secrets touching the firewall, restricting WAN management, and enforcing MFA on all admin and remote accounts.
Timeline
| Date | Event |
|---|---|
| September 2025 | SonicWall warns customers about accessed MySonicWall cloud backup files. |
| 4 October 2025 | Huntress sees the start of mass SSL VPN logins with valid credentials. |
| 8 October 2025 | SonicWall confirms attackers accessed all cloud backup preference files. |
| 10 October 2025 | Huntress publishes its warning; activity is ongoing. |
| 13 October 2025 | BleepingComputer reports more than 100 compromised accounts. |
How it happened: the identity attack path
- Credentials obtained. The attackers held valid VPN credentials, by a route not known.
- Rapid logins. They authenticated into many accounts across devices in quick succession.
- Network access. The VPN placed them inside victim networks.
- Reconnaissance. In some cases they scanned networks.
- Lateral movement attempts. They tried to access many local Windows accounts.
Impact
- Accounts: more than 100 SSL VPN accounts across 16 environments observed by Huntress.
- Activity: network scanning and attempts on local Windows accounts in some environments.
- Data theft: not reported in these sources.
What this means for NHI governance
This is a human-identity breach, flagged as such on our breach hub: the accounts used were VPN user accounts. We include it because the response is largely about machine secrets. A firewall holds VPN pre-shared keys, LDAP, RADIUS and TACACS+ bind credentials, API keys and automation secrets. When configuration files are exposed, as in SonicWall's cloud backup incident, every one of those secrets needs rotating, not only user passwords.
For the user accounts themselves, the lesson is simple: remote access without MFA turns any leaked password into network access. See our Remote Access Identity Guide and MFA Guide.
Recommendations
- Enforce MFA on all VPN and admin accounts. See the MFA Guide.
- Reset VPN user passwords and device secrets. Include LDAP, RADIUS and TACACS+ credentials and VPN pre-shared keys. See the Leaked Credential Response Playbook.
- Revoke automation secrets that touch the firewall. External API keys and management credentials should be rotated too. See our Secrets Management Guide.
- Restrict management and remote access exposure. Limit WAN management and SSL VPN until secrets are rotated. See the Remote Access Identity Guide.
- Watch for rapid multi-account logins. Many accounts authenticating quickly from one source is a clear signal. See the ITDR Guide.
Frequently asked questions
How were SonicWall VPN accounts breached in October 2025?
Attackers logged in with valid credentials to more than 100 SonicWall SSL VPN accounts across 16 environments, according to Huntress. How they obtained the credentials is not known.
Is this linked to the MySonicWall cloud backup breach?
Huntress said it found no evidence connecting the VPN compromises to the cloud backup incident, although the timing overlapped.
Why is this listed as a human identity breach?
The accounts used were VPN user accounts. The recommended response also covers machine secrets on the firewall.
Related NHI Mgmt Group resources
Scania Insurance Portal Breach 2025 · Salt Typhoon Telecom Intrusions 2025 · Remote Access Identity Guide · MFA Guide · Secrets Management Guide
How NHI Mgmt Group can help
Network devices hold both user access and machine secrets. We help teams secure remote access and rotate device secrets after an exposure. See our NHI and AI agent security training.
References
- Security Affairs: Attackers exploit valid logins in SonicWall SSL VPN compromise (11 October 2025)
- BleepingComputer: SonicWall VPN accounts breached using stolen creds in widespread attacks (13 October 2025)
- Cybersecurity Dive: SonicWall SSLVPN devices compromised using valid credentials (14 October 2025)