Archive — US — techcrunch
SonicWall urges customers to disable SSLVPN amid reports of ransomware attacks
SonicWall advises customers to disable SSLVPN after a surge in ransomware attacks targeting its Generation 7 firewalls. Investigations are underway to identify vulnerabilities responsible for the incidents, with indications of a zero-day exploit. Security researchers have observed the Akira ransomware gang exploiting these vulnerabilities to gain access to networks, marking an essential threat to enterprise security.
Key points
- SonicWall has urged its customers to disable SSLVPN due to increased ransomware incidents.
- Security researchers linked the attacks to vulnerabilities in SonicWall's Generation 7 firewalls.
- There is suspicion of a zero-day vulnerability being exploited before a patch was available.
- Arctic Wolf identified attacks on SonicWall customers dating back to mid-July.
- Hackers are targeting enterprise firewall and VPN products as entry points into networks.
- Huntress Labs suggests that the Akira ransomware gang may be behind the attacks.
Why it matters
- In 2023, there has been a notable increase in ransomware attacks on enterprise security products.
- Zero-day vulnerabilities have become a common tactic for cybercriminals exploiting major security flaws.
- Remote work and reliance on VPNs have heightened the importance of secure enterprise networks.
The rise in ransomware attacks on SonicWall customers underscores the critical need for enterprise-level cybersecurity measures, particularly regarding the management and patching of vulnerabilities in firewall and VPN systems.