Campaign DetailSource-backed corpus

2026 SonicWall Credential-Stuffing Campaign

Huntress observed a broad, opportunistic campaign from July 25–27, 2026 in which five source IPs attempted and achieved unauthorized logins to SonicWall VPN and firewall services. The reporting covers 30 organizations and 92 affected accounts across the three-day window. Huntress had not observed hands-on-keyboard post-compromise activity when it published, and the source of the valid credentials remained unknown.

Last updated Aug 12, 2026, 4:00 PM EDT

Actor Mapping

Mapped Threat Actors

Unattributed threat actor(s)

Targeting

Target Sectors / Countries

Cross-industrySMBsManaged Service Providers

Tradecraft

ATT&CK / Techniques

T1110.004T1078T1133

Tools / Observables

Malware, Tools, CVEs

157.245.88[.]153162.243.31[.]111167.71.150[.]1209.97.151[.]14864.227.15[.]20successful SonicWall VPN/firewall logins during July 25–272026

Campaign Chronology

Observed Activity Timeline

July 25, 2026
Campaign begins in Huntress telemetry
Huntress observed 26 affected accounts across six organizations.
July 26, 2026
Activity expands
Huntress observed 34 affected accounts across 16 organizations.
July 27, 2026
Third observed day
Huntress observed 32 affected accounts across eight organizations, completing the published July 25–27 window.

Victimology

Public Victims / Disclosure Status

SubjectPublic statusWhat the record establishes

Huntress-observed organizations

30 anonymized organizations

No organization was publicly named; product use or an IP hit must not be converted into a victim claim.

“No publicly named victim” is a disclosure statement, not an assessment that the campaign caused no harm.

Cross-Source Assessment

What Reporting Agrees On—and Where It Does Not

Campaign mechanics

Agreement

Huntress directly observed broad credential stuffing and successful SonicWall VPN/firewall logins.

Boundary / disagreement

No retained source establishes exploitation of a SonicWall CVE or a specific credential origin.

Relationship to Akira and cloud backup

Agreement

The evidence supports treating all three as important SonicWall access-risk lanes.

Boundary / disagreement

Neither the July campaign nor the MySonicWall backup incident is attributed to Akira, and no public evidence connects the July credentials to stolen backups.

Source Reconciliation

How IntelliOS Is Treating This Campaign

Campaign rows are retained as source-backed context. Actor mappings do not automatically merge actor records; SOCRadar, MITRE, Mandiant, CrowdStrike, Microsoft, and other future sources can disagree on boundaries, aliases, or campaign ownership.

The campaign is not a vulnerability exploit and no CVE is assigned. A valid login does not by itself prove lateral movement or ransomware. The 2025 MySonicWall backup theft, 2025 Akira SSLVPN activity, and 2026 SMA1000 zero-day campaign are separate evidence lanes unless incident-specific evidence connects them.

Evidence Controls

Methodology / Claim Status

Reporting period: July 25–27, 2026
Methodology: Reconciliation of Huntress campaign telemetry with SonicWall incident/remediation guidance and separate Rapid7 Akira research
Sample scope: 30 Huntress-observed organizations and 92 affected accounts across July 25–27, 2026; no complete global population
Claim status: Credential stuffing and successful logins are source-backed; credential origin, actor attribution, cloud-backup causation, and post-compromise impact remain unknown

IntelliOS

Related Intel Products

PANDA Flash Threat Intel BriefSonicWall Credential Attacks: Successful Firewall Logins and Cloud-Backup RiskThe 32-card evidence, IOC, authentication, cloud-backup, Akira-boundary, and response brief.CARDS Threat ActorAkiraSeparate ransomware actor context with supported SonicWall SSLVPN history and explicit July-campaign non-attribution.PANDA Flash Threat Intel BriefINC Ransom Exploits SonicWall SMA1000 Zero DaysSeparate SMA1000 product and vulnerability-exploitation campaign.

Citations

Source Trust / Citations

[1] SonicWall Credential Stuffing CampaignHuntress
[2] MySonicWall Cloud Backup File IncidentSonicWall
[3] Essential Credential ResetSonicWall
[4] Akira Utilizing SonicWall Devices for Initial AccessRapid7