Critical Cybersecurity Alert Bulletin

SEVERITY: CRITICAL

Alert ID: CF-SA-2025-001

Date Issued: October 3, 2025

Threat Type: Zero-Day Exploitation / Ransomware

Status: Active Exploitation

Executive Summary

Clients First is issuing this CRITICAL security alert regarding active exploitation of SonicWall VPN appliances. Multiple security firms have confirmed ongoing attacks that bypass multi-factor authentication (MFA) and result in rapid ransomware deployment. Organizations using SonicWall Secure Mobile Access (SMA) and firewall appliances with SSL VPN enabled are at immediate risk.

URGENT: Threat actors are moving from initial breach to domain controller compromise within hours. Immediate action is required to protect your network.

Affected Products

The following SonicWall products are confirmed to be affected:

• SonicWall Gen 7 Firewalls with SSL VPN enabled
• SonicWall Secure Mobile Access (SMA) appliances
• Devices with remote VPN access configured

CRITICAL - End of Life Products: Organizations still operating SonicWall Gen 4, Gen 5, or Gen 6 firewalls must plan for immediate replacement. These legacy devices are no longer supported, will not receive security patches, and represent a significant security risk to your network infrastructure. Contact Clients First Tech Services immediately to discuss upgrade options.

Note: A suspected zero-day vulnerability is being exploited, allowing attackers to bypass MFA protections. No official patch has been released by SonicWall at this time.

Threat Overview

Security researchers have identified a coordinated campaign targeting SonicWall VPN infrastructure beginning in late July 2025. The attack chain includes:

Initial Compromise

• Exploitation of SonicWall VPN appliances to gain initial access
• Bypass of multi-factor authentication mechanisms
• Abuse of over-privileged LDAP service accounts (commonly named "sonicwall" or "LDAPAdmin")

 Post-Exploitation Activities

• Persistence: Deployment of Cloudflared tunnels and OpenSSH backdoors in C:\ProgramData
• Lateral Movement: Use of WMI and PowerShell remoting to spread across the network
• Credential Theft: Extraction of credentials from Veeam Backup databases and Active Directory (NTDS.dit)
• Defense Evasion: Disabling Windows Defender, firewalls, and other security tools
• Ransomware Deployment: Deletion of Volume Shadow Copies followed by Akira ransomware execution

IMMEDIATE ACTIONS REQUIRED

1. DISABLE SSL VPN Access Immediately
   • This is the most effective mitigation until an official patch is released
   • If VPN is business-critical, proceed to step 2
2. Implement Strict IP Allow-Listing (If VPN Cannot Be Disabled)
   • Restrict VPN access to a minimal list of known, trusted IP addresses only
   • Document all allowed IP addresses and review regularly
3. Audit and Restrict Service Account Privileges
   • Review all service accounts used by SonicWall devices
   • Remove Domain Admin privileges from LDAP binding accounts
   • Apply principle of least privilege to all service accounts
4. Network Segmentation
   • Isolate VPN access from critical infrastructure, especially domain controllers
   • Implement additional firewall rules to limit lateral movement
5. Hunt for Compromise Indicators
   • Review the Indicators of Compromise section below
   • Check for suspicious account creation (lookfor accounts: backupSQL, lockadmin, azuresync)
   • Examine recent VPN authentication logs for anomalies
6. Monitor for Suspicious Activity
   • Unusual PowerShell executions
   • WMI lateral movement patterns
   • Installation of remote access tools (AnyDesk, ScreenConnect, OpenSSH)
   • Backup operations targeting NTDS.dit or unusual wbadmin usage

Indicators of Compromise (IOCs)

Malicious IP Addresses

Malicious Files and Tools

Suspicious Account Names

• backupSQL - Domain Admin account created by attackers
• lockadmin - Hidden local administrator account
• azuresync - Fake synchronization account
• commuser - Hidden user account

Attack Timeline

Based on observed incidents:

• Hour 0: Initial SonicWall VPN compromise
• Hours 1-2: Establishment of persistence mechanisms (SSH, Cloudflared tunnels)
• Hours 2-4: Network enumeration and lateral movement to domain controllers
• Hours 4-8: Credential harvesting and privilege escalation
• Hours 8-12: Disabling of security tools and backup deletion
• Hours 12+: Ransomware deployment

Speed is Critical: Organizations have experienced complete compromise within 12-24 hours of initial breach. Early detection and response are essential.

Additional Recommendations

• Backup Verification: Ensure offline backups exist and are not accessible from the network
• Incident Response Readiness: Review and test your incident response procedures
• Log Retention: Preserve VPN authentication logs and system logs for forensic analysis
• User Awareness: Brief IT staff on this threat and indicators of compromise
• Vendor Communication: Monitor SonicWall security advisories for official patches and guidance

Need Assistance?

The Clients First Tech Services team is ready to help you assess your risk and implement protective measures.

Tech Services Team

Email: seteam@clientsfirst-us.com

Contact us immediately if you suspect a compromise or need assistance securing your SonicWall infrastructure.