Decision question

What is confirmed about this campaign, how does it gain access and create impact, who and what are in scope, what remains unknown, and which defensive actions follow from the retained evidence?[1][2][3][4]

Interpreted questions

Review access prerequisites, reachability, exploitation, affected technology, actors, victims, timeline, tradecraft, impact, attribution boundaries, mitigation, and related IntelliOS coverage.[1][2][3][4]

Initial observations

Huntress observed a broad, opportunistic campaign from July 25–27, 2026 in which five source IPs attempted and achieved unauthorized logins to SonicWall VPN and firewall services. The reporting covers 30 organizations and 92 affected accounts across the three-day window. Huntress had not observed hands-on-keyboard post-compromise activity when it published, and the source of the valid credentials remained unknown.[1][2][3][4]

Evidence hierarchy and boundary

Reconciliation of Huntress campaign telemetry with SonicWall incident/remediation guidance and separate Rapid7 Akira research The campaign is not a vulnerability exploit and no CVE is assigned. A valid login does not by itself prove lateral movement or ransomware. The 2025 MySonicWall backup theft, 2025 Akira SSLVPN activity, and 2026 SMA1000 zero-day campaign are separate evidence lanes unless incident-specific evidence connects them.[1][2][3][4]

Huntress observed a broad, opportunistic campaign from July 25–27, 2026 in which five source IPs attempted and achieved unauthorized logins to SonicWall VPN and firewall services. The reporting covers 30 organizations and 92 affected accounts across the three-day window. Huntress had not observed hands-on-keyboard post-compromise activity when it published, and the source of the valid credentials remained unknown.[1][2][3][4]

A successful firewall or VPN login can create an authenticated perimeter foothold, expose internal routes and services, and enable later credential theft, lateral movement, data access, or ransomware. Those later outcomes were not observed in Huntress's published July 25–27 dataset.[1][2][3][4]

Block and hunt the five campaign IPs with historical context; identify every successful and failed SonicWall login from July 25–27, 2026; disable or reset affected accounts; invalidate sessions; rebind TOTP where exposure is possible; review local, LDAP, RADIUS, TACACS, VPN, portal, API, and configuration paths; and determine whether any authenticated session reached internal systems.[1][2][3][4]

Huntress observed a broad, opportunistic campaign from July 25–27, 2026 in which five source IPs attempted and achieved unauthorized logins to SonicWall VPN and firewall services. The reporting covers 30 organizations and 92 affected accounts across the three-day window. Huntress had not observed hands-on-keyboard post-compromise activity when it published, and the source of the valid credentials remained unknown.

The retained record scopes this as credential stuffing / valid-account abuse against sonicwall vpn and firewall services activity during July 25–27, 2026. A successful firewall or VPN login can create an authenticated perimeter foothold, expose internal routes and services, and enable later credential theft, lateral movement, data access, or ransomware. Those later outcomes were not observed in Huntress's published July 25–27 dataset.[1][2][3][4]

Block and hunt the five campaign IPs with historical context; identify every successful and failed SonicWall login from July 25–27, 2026; disable or reset affected accounts; invalidate sessions; rebind TOTP where exposure is possible; review local, LDAP, RADIUS, TACACS, VPN, portal, API, and configuration paths; and determine whether any authenticated session reached internal systems.[1][2][3][4]

Confirmed reporting is separated from attribution, victim, and prevalence claims that the retained sources do not establish. Confidence: High for the Huntress-observed July 25–27, 2026 activity, five IPs, affected account/organization counts, and successful login outcome. Actor identity, credential source, connection to the MySonicWall cloud-backup incident, Akira attribution, and post-compromise impact are not established..[1][2][3][4]

1. July 25, 2026

   Campaign begins in Huntress telemetry

   Huntress observed 26 affected accounts across six organizations.

2. July 26, 2026

   Activity expands

   Huntress observed 34 affected accounts across 16 organizations.

3. July 27, 2026

   Third observed day

   Huntress observed 32 affected accounts across eight organizations, completing the published July 25–27 window.

“No publicly named victim” is a disclosure statement, not an assessment that the campaign caused no harm.