The Gen 7 SonicWall Firewall Crisis: Zero-Day

Executive Summary

A critical security crisis is unfolding for organizations using Gen 7 SonicWall firewalls with SSL VPN enabled. Since mid-July 2025, attackers have exploited a suspected zero-day vulnerability (or a dangerously misunderstood known flaw) to bypass multi-factor authentication (MFA), compromise networks in under two hours, and deploy Akira ransomware. With over 28 confirmed breaches and counting, this threat combines unprecedented speed, evasion sophistication, and ruthless financial motivation.

🔥The Heat of the Controversy: Zero-Day vs. SonicWall’s Stance

SonicWall insists the attacks stem from CVE-2024-40766—a patched improper access control flaw documented in advisory SNWLID-2024-0015. The vendor attributes compromises to customers who migrated from Gen 6 to Gen 7 firewalls without resetting local user passwords.

However, third-party researchers disagree:

• Huntress, Arctic Wolf, and Mandiant observed attacks bypassing MFA on fully patched devices even after credential rotation — a hallmark of zero-day exploitation.
  
• 40% of incidents traced to password migration failures during Gen 6 → Gen 7 upgrades.
  
• Firmware versions 7.2.0-7015 and earlier are confirmed vulnerable in TZ/NSa-series firewalls.

Why the disconnect? Researchers note attackers achieved impossible MFA bypasses and compromised credentials after resets—indicative of a deeper, unpatched flaw.

⏰ Attack Timeline: Speed, Scale, and Evolution

1. July 15, 2025: Arctic Wolf detects an uptick in Akira ransomware targeting SonicWall SSL VPNs.
2. July 23–25: Sophos logs 10 incidents; Huntress observes 20+ attacks deploying backdoors (Cloudflare tunnels/OpenSSH).
3. August 4: SonicWall confirms a “notable increase” in incidents, urging SSLVPN disablement.
4. August 6: Confirmed breaches rise to 28+; SonicWall releases firmware 7.3.0 with brute-force protections.

⚠️ Inside the Kill Chain: How Attackers Hijack Networks

1. Initial Access: Breach SSLVPN (bypassing MFA via zero-day or credential reuse).
2. Privilege Escalation: Abuse over-permissioned SonicWall service accounts (e.g., sonicwall, LDAPAdmin) to gain domain admin rights.
3. Lateral Movement & Persistence:
   • Deploy tools like Advanced IP Scanner, NetExec, or PowerShell Remoting.
   • Harvest credentials from Veeam backups or NTDS.dit files.
   • Install persistent backdoors (AnyDesk, ScreenConnect, OpenSSH).
4. Evasion: Disable Microsoft Defender via Set-MpPreference and delete shadow copies with vssadmin.
5. Ransomware Deployment: Execute Akira payloads (w.exe -p=\\[target]\C$).

🛡️ Mitigation Strategies: Vendor vs. Researcher Recommendations

SonicWall’s Official Guidance

1. Upgrade firmware to SonicOS 7.3.0+ for anti-brute-force enhancements.
2. Reset all local user passwords—especially those migrated from Gen 6 devices.
3. Enable Botnet/Geo-IP filtering and enforce MFA.

Researcher-Urged Actions

• Disable SSLVPN immediately—only allow VPN access via IP allow-listing.
• Segment networks to isolate firewalls from domain controllers.
• Audit service accounts: Strip domain admin rights from SonicWall-related accounts.
• Block VPN logins from high-risk ASNs and other IOCs

Indicators of Compromise (IOCs)

Mitigation Comparison

📉 SonicWall’s Recurring Security Crisis: A Pattern of Risk

This incident fits a dangerous trend:

• 14 SonicWall flaws listed in CISA’s Known Exploited Vulnerabilities catalog since 2021.
• SMA 100 series devices exploited in July 2025 for Abyss ransomware via rootkits.
• Akira’s history of targeting SonicWall (e.g., 2023’s Gen 5/6 RCE attacks) shows persistent weaponization.

Why target firewalls? Compromising edge devices grants attackers “keys to the kingdom”—deep network access with minimal scrutiny.

💎 Conclusion: Assume Compromise and Act Aggressively

While SonicWall investigates, organizations must treat this as a critical ongoing threat. The 2-hour window from VPN breach to ransomware demands:

1. Disable SSLVPN where possible; restrict it via IP allow-listing if essential.
2. Upgrade to SonicOS 7.3.0 and reset all local passwords.
3. Hunt for IOCs like attacker IPs, scripts etc.
4. Audit service accounts—no SonicWall-related account should have domain admin rights.

🔍 Resources

1. Canadian Cyber Centre Alert AL25-010
2. SonicWall Advisory: SSLVPN Threat Activity
3. Huntress Technical Deep Dive
4. Arctic Wolf: Akira Targeting SonicWall
5. The Hacker News: SonicWall Zero-Day Investigation
6. Help Net Security: SonicWall Ransomware Attacks
7. Dark Reading: Akira’s SonicWall Zero-Day
8. Cyberscoop: Mass Exploitation of SonicWall
9. BankInfoSecurity: SonicWall Probes Zero-Day