SonicWall Releases Urgent Security Notice About Actively Targeted EOL Devices

• SonicWall warns about ransomware actors targeting EOL SRA and SMA devices.
• The company advises all administrators to update to the latest available firmware version.
• Devices that are no longer supported and didn’t receive a fixing patch should be replaced by new ones.

SonicWall, the California-based network security and network appliance company, has released an urgent security notice to inform its customers about a newly arisen danger of using unpatched EOL (end of life) SRA (Secure Remote Access) and SMA (Secure Mobile Access) devices. According to the notice, SonicWall has been made aware of threat actors actively targeting these devices, so hackers are already at it. Unfortunately, ransomware actors using stolen credentials are also mentioned in the report, so patching these devices should be considered an emergency.

The affected products, legacy SRA and SMA devices, are those that run firmware 8.x, so updating to 9.x or 10.x should resolve the problem. If that’s impossible, disconnect the appliance immediately until a patching plan has been developed. Additionally, resetting all passwords and enabling MFA (multi-factor authentication) where possible should be a standard practice to follow.

The actively targeted products are the following:

• SRA 4600/1600 (EOL 2019)
• SRA 4200/1200 (EOL 2016)
• SSL-VPN 200/2000/400 (EOL 2013/2014)
• SMA 400/200/100 (Limited Retirement Status)

Obviously, since some of these devices have reached EOL over five years ago, there’s no available update to firmware 9.x for them, so the only solution would be to replace them with newer devices. SonicWall isn’t abandoning that special category of users, though, and will provide a complimentary virtual SMA 500v until October 31, 2021, which should give clients enough time for a smooth transition.

John Mancini, Data Scientist at Vectra, tells us:

Back in January, SonicWall had a security lapse as highly sophisticated actors managed to infiltrate its internal systems using zero-days against its products. Although the company released patches to prevent this from happening again, a series of subsequent hacking incidents that followed in the next months spread fear that ransomware actors had found a way to bypass the fixes. This latest notice could be a continuation of the same problem that started months ago.

Related

LockBit Ransomware Group Returns, Launching 4.0 in February

Rhode Island Hit by Ransomware Attack Impacting Deloitte via RIBridges

Lynx Ransomware Targets Romanian Energy Supplier Electrica

Romanian Electricity Distributor (Electrica) Is Under a Ransomware Attack

Heart Surgery Device Maker, Artivion, Discloses a Ransomware Attack

BT Group Affected by Ransomware Breach by Black Basta Gang

Most Popular

Attack on Titan: The Last Attack- all the Confirmed International Theatrical Release Dates

Den of Thieves 2: Pantera- All we know About the sequel to the Surprise hit Heist film

Does Sonic 3 have a Post-Credits Scene?

What we know so far About Virgin River Season 7

Colleen Hoover’s Verity Movie Adaptation adds two more Hollywood Stars to its cast

Stranger Things Season 5 Release date: One good news and one bad news for fans