- Jul 27, 2015
Security vendor SonicWall is warning customers to patch its enterprise secure VPN hardware to thwart an “imminent ransomware campaign using stolen credentials” that’s exploiting security holes in current models and those running legacy firmware.
Targeted are the company’s Secure Mobile Access (SMA) 100 series and Secure Remote Access (SRA) secure VPN appliances with both unpatched and end-of-life (EoL) 8.x firmware. In a Thursday security notice, the company reported that researchers at Mandiant identified “threat actors actively targeting” three SMA 100 models and nine older SRA-series secure VPN products no longer supported by SonicWall.“Organizations that fail to take appropriate actions to mitigate these vulnerabilities on their SRA and SMA 100 series products are at imminent risk of a targeted ransomware attack,” according to the security bulletin.
According reporting by The Record, the bugs and attacks are ongoing, tracing back to research published in June by Crowdstrike. Researchers there asserted that Thursday’s SonicWall security notice is part of an ongoing exploitation of a vulnerability (CVE-2019-7481), which they disclosed last month.
SonicWall issued an urgent security alert warning customers that some of its current and legacy secure VPN appliances were under active attack.