Threat actors have successfully breached SonicWall Gen6 SSL-VPN appliances by exploiting incomplete security patches, allowing them to bypass multi-factor authentication and deploy ransomware tools.
Security researchers discovered that hackers exploited vulnerabilities in SonicWall Gen6 SSL-VPN devices to gain unauthorized access despite MFA protections being in place. The attacks leveraged credential brute-forcing techniques combined with unpatched security gaps to circumvent the multi-factor authentication layer.
Once inside the systems, attackers deployed tools commonly used in ransomware campaigns, indicating a coordinated effort to establish footholds for potential large-scale attacks. The vulnerability stems from incomplete patching of known issues affecting the VPN appliances, leaving critical security gaps unaddressed.
SonicWall has recommended that administrators apply the latest security updates to affected Gen6 SSL-VPN models. The company emphasized the importance of deploying patches promptly and comprehensively across all affected infrastructure.
Organizations using SonicWall VPN appliances have been advised to review access logs for suspicious activity, monitor for unauthorized tool deployments, and verify that all patches have been properly applied. Security teams should also consider implementing additional monitoring on VPN infrastructure to detect brute-force attempts earlier.
This incident underscores the critical nature of maintaining up-to-date security patches, particularly for internet-facing devices like VPN appliances. Even with MFA in place, incomplete patching can create exploitable pathways for determined threat actors. Organizations relying on SonicWall equipment should prioritize immediate assessment of their current patch status and remediation timelines.
SAP released security updates for 16 vulnerabilities in July 2026, including three critical flaws affecting NetWeaver, Commerce Cloud, and AppRouter. The patches address risks across multiple enterprise software components.
Two newly discovered phishing kits, Jalisco and OmegaLord, are actively targeting Microsoft 365 accounts with techniques designed to circumvent multi-factor authentication protections.
The U.S. Treasury Department's Office of Foreign Assets Control (OFAC) sanctioned two individuals and one entity for enabling ransomware attacks against American organizations. The action targets infrastructure providers facilitating cyber threats.
As scam calls and messages proliferate, ordinary people are turning the tables on fraudsters through scambaiting—deliberately engaging scammers to waste their time and resources.