Loading summary
Announcer
You're listening to the Cyberwire network.
Dave Bittner
Powered by N2K, the DMV has established itself as a top tier player in the global cyber industry. DMV Rising is the premier event for cyber leaders and innovators to engage in meaningful discussions and celebrate the innovation happening in and around the Washington, D.C. area. Join us on Thursday, September 18th to connect with the leading minds shaping our field and experience firsthand why the Washington, D.C. region is the beating heart of cyber innovation. Visit DMVrising.com to secure your spot. Risk and compliance shouldn't slow your business down. Hyperproof helps you automate controls, integrate real time risk workflows and build a centralized system of trust so your teams can focus on growth, not spreadsheets. From faster audits to stronger stakeholder confidence, Hyperproof gives you the business advantage of Smarter compliance. Visit www.hyperproof.IO to see how leading teams are transforming their GRC programs. Hello everyone and welcome to the Cyberwires Research Saturday. I'm Dave Bittner and this is our weekly conversation with researchers and analysts tracking down the threats and vulnerabilities, solving some of the hard problems, and protecting ourselves in our rapidly evolving cyberspace. Thanks for joining us.
Jamie Levy
So we started to notice that there was an uptick in incidents that involved Sonic Wallet devices. It actually started probably like a week or so before Arctic Wolf came out with their research.
Dave Bittner
That's Jamie Levy, Director of Adversary Tactics at Huntress. The research we're discussing today is titled active exploitation of SonicWall VPNs.
Jamie Levy
So as we started to notice that we had more and more incidents, we started to dig into it and then we saw their research come out and then we realized that, yes, it was probably a part of what was going on there.
Dave Bittner
Yeah, it's funny how that can happen sometimes, right? Somebody is independently on the same path and you might not know it at the time, Correct? Yeah. So what tipped you off that this was not a routine vulnerability report, but there was something more active and urgent?
Jamie Levy
Well, we started to notice that there were a lot of incidents involving SonicWall devices. And so it looked as if maybe there was some kind of vulnerability involved, just because we started to get so many more of these incidents involving that. And then other people were saying that they had it and we were talking to other researchers and other companies and they were talking about how they had a lot of incidents involving this. And so we knew something was up with that. And it was also we figured out that it was pretty much the same group. A lot of times these were ending up with Akira Ransomware and so since it was the same types of exploitation, we figured out that this group knew about this exploit and was leveraging it pretty heavily.
Dave Bittner
I see. Well, for our listeners who may not be deeply technical, can you explain to us what exactly this SonicWall VPN vulnerability is all about?
Jamie Levy
Yeah. So this particular vulnerability, the thing that was actually the biggest problem with it was that people had upgraded from a generation six SonicWall device to a generation seven, and they kept the same configs. And unfortunately, when they did this, it left their credentials still exposed. And so the attackers realized that they could leverage this and gain access, even though they thought that they were fully patched.
Dave Bittner
Oh, that's interesting. So once the attackers had access, what were they able to do inside the compromised network?
Jamie Levy
So at that point, they would often gain access to other machines on the inside. So that could be credential stuffing or reused passwords. Basically, they would gain access to various machines and then steal credentials on that side, do lateral movement, do exfiltration of data, and then ultimately they would deploy ransomware at the end. But, yeah, pretty much they just came in, grabbed everything as quickly as they could, and then deployed ransomware as quickly as they could after that.
Dave Bittner
In terms of their targeting, does it strike you that it's opportunistic, or were they really focusing on certain industries or organizations?
Jamie Levy
It seemed to be all over the place. I mean, we saw all different industries being hit, so I think it was opportunistic. But I feel like it really ramped up even more after people were aware that this was happening. I mean, we saw glyphs of it. Like, once we knew what was going on, we went back and looked at previous incidents, and we could see that there were incidents even as far back as May that seemed to fit the same pattern, but it wasn't nearly as often. But as soon as Arctic Wolf's research went out, all of a sudden it was just like everything was on fire. Everybody was getting hit by this. And I don't know if it's just probably the attackers realize, like, there's maybe a moment, you know, where they're going to lose this type of access, and so they just really started to ramp up.
Dave Bittner
Right. The clock is ticking, so get while the getting's good. Interesting. We'll be right back. Race the rudders, race the sails, Race the sails. Captain, an unidentified ship is approaching. Roger. Wait, is that an enterprise sales solution?
Commercial Voice
Reach sales professionals, not professional sailors. With LinkedIn ads, you can target the right people by industry, job title, and more. We'll even give you a $100 credit on your next campaign. Get started today at LinkedIn.com results terms and conditions apply.
Announcer
Ford BlueCruise Hands Free highway driving takes the work out of being behind the wheel, allowing you to rel and reconnect while also staying in control. Enjoy the drive in blue cruise enabled vehicles like the F150 Explorer and Mustang Mach E available feature on equipped vehicles Terms apply Does not replace safe driving. See ford.combluecruise for more details.
Dave Bittner
In terms of scale and scope here. I mean how, how widespread do you believe this is?
Jamie Levy
That's a good question. So I feel like people still don't have like a good handle on this because we're still seeing incidents involving Sonic Wall devices and we, we did have one customer who came and they were hit but with a sonic wall vulnerability. But they said that their device did not fit this criteria. It wasn't a Gen 6 to Gen 7 up roll. It basically was a device that I think it was a fortinet device that had. That they had installed Gen 7 SonicWA on and it still got popped. And so there are some questions about whether or not this vulnerability actually is. Is what, what, what this underlying cause is.
Dave Bittner
Yeah. Is there any geographic concentration or are they going after folks in a certain part of the world or does it seem all around is a global issue?
Jamie Levy
I believe it's a global issue, but if you just kind of scan to see like where most of these Sonic wall devices are, I mean overwhelmingly they're in the United States area. Right. North American area. Just, just by default. But, but yeah, I mean like as far as our customer base, like we've seen them from all over getting popped.
Dave Bittner
I see. Now did you all coordinate with Sonicwall in, in terms of getting the vulnerability confirmed?
Jamie Levy
Yes, we did. We were in contact with them and it basically we were trying to figure out what were the logs that we should pull. Was there anything else? We were also trying to help them figure out what the problem was because initially they weren't really sure. They did seem to think that it was CVE2024766. They weren't really sure at the moment and that was back when we spoke with them on Monday of last week, August 4th. So one of the things that they had told us to do is if we had any more of these, these incidents come up to take a core dump and then we could hand that off to them to, to get an idea of what was actually happening. So it seemed that the logs were a little bit lacking but the core dumps were they. They basically had like the. The moment of truth in them that could actually help figure out what the problem was.
Dave Bittner
I see. And so where do we stand today? Have there been patches issued?
Jamie Levy
I think it's really just that they've given advice of making sure that you don't have the old configs. If you had updated from Gen 6 to Gen 7 and to rotate cruds, and if you're really unsure, just to try to keep the device offline. But yeah, like as far as I know, they haven't issued another patch for this.
Dave Bittner
I see.
Jamie Levy
Yeah.
Dave Bittner
Yeah. From a higher level, I mean, is it accurate to say that VPN appliances make attractive targets for attackers?
Jamie Levy
Oh, yeah. I mean, it seems very much so. I mean, Sonic wall devices are not the only ones that we see getting hit by attackers. So just about every VPN device is basically ripe for the picking. Makes sense. Cause once they gain access there, then they can gain access to things that are internal. Much easier.
Dave Bittner
Yeah. What are your recommendations then, for organizations to better protect themselves against this sort of thing?
Jamie Levy
I mean, attack surface reduction as much as you can, making sure that you're up to date, using mfa, turning off or turning on like the brute force protection, all of that, as much as you can, just to try to reduce that attack surface.
Dave Bittner
And I suppose it's fair to say that we can expect VPNs to still have a target on their backs in the near future.
Jamie Levy
Yeah, definitely.
Dave Bittner
Our thanks to Jamie Levy from Huntress for joining us. The research is titled Active Exploitation of Sonic Wall VPNs. We'll have a link in the show notes and that's Research Saturday, brought to you by N2K CyberWire. We'd love to hear from you. We're conducting our annual audience survey to learn more about our listeners. We're collecting your insights through the end of this month. There's a link in the show notes. Please do check it out. This episode was produced by Liz Stokes. We're mixed by Elliot Peltzman and Trey Hester. Our executive producer is Jennifer Ibin. Peter Kilpe is our publisher and I'm Dave Bittner. Thanks for listening. We'll see you back here next time.
Commercial Voice
New season, new chaos in college football.
Dave Bittner
Big stage, big opportunity.
Commercial Voice
This Labor Day weekend, wildness lives on ABC, ESPN and the all new ESPN app.
Dave Bittner
What a way to start.
Commercial Voice
Featuring top 10 teams like Clemson, Notre Dame, Dame, Alabama and LSU. And Bill Belichick's debut at North Carolina.
Dave Bittner
It's so special.
Commercial Voice
These teams collide don't miss a lineup filled with electric matchups. Welcome back to College Football Kickoff Week, presented by Modelo Labor Day Weekend on ESPN and abc. Also available to stream on the all new ESPN Applied.
Date: August 30, 2025
Host: Dave Bittner
Guest: Jamie Levy (Director of Adversary Tactics, Huntress)
Episode Focus: Active exploitation of SonicWall VPN vulnerabilities, threat actor tactics, and recommendations for organizational defense.
On this Research Saturday, Dave Bittner speaks with Jamie Levy from Huntress about a wave of security incidents involving SonicWall VPN appliances. The conversation centers on the discovery, exploitation, and impact of a significant SonicWall VPN vulnerability—particularly in the context of recent ransomware campaigns. Key technical concepts, detection challenges, and actionable defenses for listeners are discussed in a way that's accessible to both technical and non-technical audiences.
| Timestamp | Speaker | Quote | |---------------|------------------|----------------------------------------------------------------------------------------------------------------------------------------------------------------------------| | 02:02 | Jamie Levy | "We started to notice that there was an uptick in incidents that involved Sonic Wallet devices." | | 03:02 | Jamie Levy | "Other people were saying that they had it, and we were talking to other researchers and other companies ... we knew something was up with that." | | 04:08 | Jamie Levy | "It left their credentials still exposed. And so the attackers realized that they could leverage this and gain access, even though they thought they were fully patched." | | 04:50 | Jamie Levy | "Pretty much they just came in, grabbed everything as quickly as they could, and then deployed ransomware as quickly as they could after that." | | 05:39 | Jamie Levy | "We saw all different industries being hit, so I think it was opportunistic." | | 09:02 | Jamie Levy | "Overwhelmingly they're in the United States area ... we've seen them from all over getting popped." | | 11:05 | Jamie Levy | "Just about every VPN device is basically ripe for the picking. Makes sense. Cause once they gain access there, then they can gain access to things that are internal." | | 11:33 | Jamie Levy | "Attack surface reduction as much as you can, making sure that you're up to date, using MFA ... just to try to reduce that attack surface." | | 11:59 | Jamie Levy | "Yeah, definitely." (on whether VPNs will continue to be targeted) |
The episode maintains an informative, approachable tone, translating technical details into accessible explanations. Jamie Levy’s commentary is candid and pragmatic, emphasizing clear lessons and takeaways for technical teams and cybersecurity leaders alike.