# Coordinated Reconnaissance Campaign Maps SonicWall SSL VPN Attack Surface via Commercial Proxy Infrastructure (84,142 Sessions / 4,305 IPs / 20 ASNs)

> GreyNoise observed a coordinated four-burst reconnaissance campaign between February 22-25, 2026, generating 84,142 scanning sessions from 4,305 unique IPs across 20 ASNs against SonicWall SonicOS infrastructure. 91.8% of sessions probed the /api/sonicos/is-sslvpn-enabled endpoint to fingerprint SSL VPN status ahead of likely follow-on credential attacks and Akira/Fog ransomware exploitation chains against KEV-listed SonicWall CVEs.

- **Published:** 2026-02-25T00:00:00Z
- **Last reviewed:** 2026-02-25T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-1468
- **ID:** TL-2026-1468
- **Severity:** HIGH
- **Category:** RECONNAISSANCE
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 20 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2024-53704, CVE-2024-40766, CVE-2021-20028, CVE-2019-7481, CVE-2022-22274, CVE-2023-0656, CVE-2024-38475, CVE-2023-44221

## Description

Between February 22 and 25, 2026, GreyNoise detected a large-scale, structured reconnaissance campaign against SonicWall SonicOS firewall infrastructure. The campaign comprised 84,142 scanning sessions from 4,305 unique source IPs distributed across 20 distinct autonomous systems, arriving in four discrete bursts separated by an approximately 31-hour operational pause on February 23 -- a pattern consistent with a centrally coordinated tasking cadence rather than opportunistic independent scanning.

The overwhelming majority of traffic (91.8%, 77,253 sessions) targeted the undocumented management API endpoint /api/sonicos/is-sslvpn-enabled, a lightweight pre-authentication check used to determine whether a given device has SSL VPN services active. This is a reconnaissance-only probe: it does not exploit a vulnerability, but functions as an attack-surface fingerprinting step that lets an operator triage tens of thousands of candidate targets down to a list of devices with SSL VPN actually exposed, before committing scarce credential-attack or exploit resources. A secondary 7.9% of sessions (6,629) tested the NetExtender VPN login endpoint directly, indicating a subset of infrastructure was already pivoting from fingerprinting to active credential testing.

Four distinct infrastructure clusters were identified. The largest (32% of traffic) routed through the ByteZero commercial residential/datacenter proxy service (bytezero[.]io), egressing via 4,102 exit IPs within 154.208.64.0/21, transiting AS3257 (GTT Communications) with Canadian hosting, and deliberately throttled to an average of 6.6 sessions per IP across two surgical 7-and-9-hour windows to evade rate-limiting defenses -- textbook proxy-obfuscated mass reconnaissance tradecraft. A second cluster (28%) consisted of just 6 IPs inside AS211736 (Ukrainian-registered ASN, Amsterdam-hosted) sharing identical HASSH SSH fingerprints, indicating a common provisioning template, and cross-targeting both SonicWall and Cisco ASA devices in the same sessions -- evidence of a multi-vendor VPN-hunting toolkit. A third cluster (22%) was a single high-volume host, 130.12.180.29, registered to AS202412 (Omegatech, Seychelles), which alone generated 18,763 sessions against 20+ destination ports while rotating 26 distinct browser user-agent strings to defeat naive UA-based detection. A fourth, lower-volume but persistent cluster (8%, 156 IPs across four ranges) ran a continuous NetExtender login-endpoint baseline that did not pause during the February 23 lull affecting the other clusters, suggesting an independently operated, always-on credential-testing capability layered on top of the coordinated fingerprinting sweep.

A technical fingerprint anomaly further corroborates automated tooling: 69.5% of all sessions (58,510) presented a "Chrome 119 on Linux" User-Agent string while speaking HTTP/1.0, a protocol/UA mismatch impossible for any genuine modern browser and characteristic of a purpose-built scanning framework.

Actual exploitation attempts against known SonicWall CVEs were negligible in volume (single digits to low tens of sessions per CVE) relative to the fingerprinting traffic, confirming the campaign's primary purpose was attack-surface mapping rather than direct compromise. However, the CVEs referenced in the campaign are severe and under confirmed active exploitation by ransomware operators: CVE-2024-53704 (SSL VPN session-hijacking authentication bypass, CISA KEV, PoCs public, MFA-bypassing), CVE-2024-40766 (SonicOS improper access control, CISA KEV, exploited by Akira and Fog ransomware affiliates since September 2024, with encryption-to-compromise dwell times as short as 55 minutes), CVE-2021-20028 (SMA100 unauthenticated SQL injection, CISA KEV, end-of-life appliances, ransomware-leveraged), and CVE-2024-38475 (Apache mod_rewrite improper output escaping affecting SMA 100 series, CISA KEV, chainable with CVE-2023-44221 for full system compromise via credential/SSH-key exfiltration).

Given that 430,000+ SonicWall firewalls are publicly exposed and 25,000+ SSL VPN-enabled devices remain vulnerable to these critical flaws (with roughly 20,000 running unsupported firmware), this reconnaissance sweep represents a high-confidence precursor indicator: historical precedent (a 9-million-session Palo Alto/SonicWall reconnaissance campaign in December 2025) was followed by confirmed ransomware intrusion waves. Akira ransomware affiliates are attributed to roughly 75% of documented SonicWall VPN intrusions (250+ organizations, ~$244M in proceeds), with Fog ransomware responsible for the remaining ~25%, and both groups have demonstrated encryption within 4 hours of initial SSL VPN access.

## MITRE ATT&CK

- T1595.001 Scanning IP Blocks
- T1595.002 Vulnerability Scanning
- T1590.005 IP Addresses
- T1596 Search Open Technical Databases
- T1583.008 Malvertising
- T1588.002 Tool
- T1587.001 Malware
- T1190 Exploit Public-Facing Application
- T1078.004 Cloud Accounts
- T1133 External Remote Services
- T1110.001 Password Guessing
- T1110.004 Credential Stuffing
- T1111 Multi-Factor Authentication Interception
- T1090.003 Multi-hop Proxy
- T1686 Disable or Modify System Firewall
- T1601 Modify System Image
- T1046 Network Service Discovery
- T1016 System Network Configuration Discovery
- T1518 Software Discovery
- T1021 Remote Services
- T1090.002 External Proxy
- T1102 Web Service
- T1486 Data Encrypted for Impact
- T1490 Inhibit System Recovery

## Sources

- [Active Reconnaissance Campaign Targets SonicWall Firewalls Through Commercial Proxy Infrastructure](https://www.greynoise.io/blog/active-reconnaissance-campaign-targets-sonicwall-firewalls-through-commercial-proxy-infrastructure)
- [SonicWall CVE-2024-53704: SSL VPN Session Hijacking](https://bishopfox.com/blog/sonicwall-cve-2024-53704-ssl-vpn-session-hijacking)
- [SonicOS SSL VPN Authentication Bypass Vulnerability (CVE-2024-53704)](https://digital.nhs.uk/cyber-alerts/2025/cc-4619)
- [Product Notice: SSLVPN and SSH Vulnerability in SonicOS](https://www.sonicwall.com/support/notices/product-notice-sslvpn-and-ssh-vulnerability-in-sonicos/kA1VN0000000RBZ0A2)
- [SonicWall firewall exploit lets hackers hijack VPN sessions, patch now](https://www.bleepingcomputer.com/news/security/sonicwall-firewall-exploit-lets-hackers-hijack-vpn-sessions-patch-now/)
- [CVE-2024-40766 Detail](https://nvd.nist.gov/vuln/detail/cve-2024-40766)
- [Critical Improper Access Control Vuln Affecting SonicWall Devices](https://www.rapid7.com/blog/post/2024/09/09/etr-cve-2024-40766-critical-improper-access-control-vulnerability-affecting-sonicwall-devices/)
- [CVE-2024-40766: The Patch Fixed the Bug. Nobody Fixed the Configuration.](https://isc.sans.edu/diary/CVE202440766+The+Patch+Fixed+the+Bug+Nobody+Fixed+the+Configuration/33094)
- [Gen 7 and newer SonicWall Firewalls – SSLVPN Recent Threat Activity](https://www.sonicwall.com/support/notices/gen-7-and-newer-sonicwall-firewalls-sslvpn-recent-threat-activity/kA1VN0000000RDG0A2)
- [CVE-2021-20028 Security Advisory](https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2021-0017)
- [CVE-2021-20028 Detail](https://nvd.nist.gov/vuln/detail/cve-2021-20028)
- [Known Exploited Vulnerabilities Catalog (SonicWall)](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?f%5B0%5D=vendor_project%3A839)
- [Chaining CVE-2024-38475 and CVE-2023-44221 for Full System Compromise](https://www.centripetal.ai/threat-research/cve-2024-38475-and-cve-2023-44221)
- [CVE-2024-38475 Detail](https://nvd.nist.gov/vuln/detail/cve-2024-38475)
- [SecurityScorecard Advisory: Apache HTTP Server Improper Escaping of Output Vulnerability (CVE-2024-38475) Added to CISA KEV](https://securityscorecard.com/blog/securityscorecard-advisory-apache-http-server-improper-escaping-of-output-vulnerability-cve-2024-38475-added-to-cisa-kev/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-1468