SonicWall warns of imminent ransomware attack
SonicWall, a network and cybersecurity appliance provider, has issued an urgent notice about “an imminent ransomware campaign using stolen credentials”.
Threat actors are actively targeting Secure Mobile Access (SMA) 100 series and Secure Remote Access (SRA) products running unpatched and end-of-life (EOL) 8.x firmware, the company said.
“The exploitation targets a known vulnerability that has been patched in newer versions of firmware.”
The company’s product security incident response team (PSIRT) is strongly suggesting organisations still using 8.x firmware review the information provided and “take immediate action”. The SMA 1000 series products are not affected by the notice, which is specifically for the SMA 100 and the older SRA series (reference lists for current SMA products and end-of-life products).
“Customers with SRA and/or SMA 100 series with 9.x and 10.x firmware should continue to follow best practices such as update to the latest available SMA firmware or update to the latest SRA firmware, and enable multifactor authentication (MFA).
“The affected end-of-life devices with 8.x firmware are past temporary mitigations. Continued use of this firmware or end-of-life devices is an active security risk.
“Organisations that fail to take appropriate actions to mitigate these vulnerabilities on their SRA and SMA 100 series products are at imminent risk of a targeted ransomware attack.”
Those using the following end-of-life SMA and/or SRA devices running firmware 8.x should either update their firmware or disconnect their appliances per guidance provided here, the company said.
“Organisations using a legacy SRA appliance that is past end-of life status and cannot update to 9.x firmware, continued use may result in ransomware exploitation.
“To provide a transition path for customers with end-of-life devices that cannot upgrade to 9.x or 10.x firmware, we’re providing a complimentary virtual SMA 500v until October 31, 2021. This should provide sufficient time to transition to a product that is actively maintained,” SonicWall said.
CISA and Microsoft warn of “active attacks” on SharePoint
Alerts have been published active attacks exploiting a remote code execution vulnerability in...
Palo Alto partners with Okta on identity management
Palo Alto Networks and Okta have announced new integrations aimed at making it easier for joint...
Trustwave launches anti-phishing service for Microsoft 365
Trustwave's new managed service is designed to provide organisations using Microsoft 365...
