--- title: Huntress Flags Widespread Credential Stuffing Campaign... description: Huntress has issued a threat advisory about an active credential stuffing campaign targeting SonicWall VPN and firewall appliances. First detected on 25 July... canonical: https://daily.dev/posts/huntress-flags-widespread-credential-stuffing-campaign-hitting-sonicwall-devices-cjvyihirm twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Huntress Flags Widespread Credential Stuffing Campaign Hitting SonicWall Devices | daily.dev og:description: Huntress has issued a threat advisory about an active credential stuffing campaign targeting SonicWall VPN and firewall appliances. First detected on 25 July... og:url: https://daily.dev/posts/huntress-flags-widespread-credential-stuffing-campaign-hitting-sonicwall-devices-cjvyihirm og:image: https://api.daily.dev/og/posts/CJVYIhiRM.png og:image:alt: Huntress Flags Widespread Credential Stuffing Campaign Hitting SonicWall Devices og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Huntress Flags Widespread Credential Stuffing Campaign Hitting SonicWall Devices **[IT Security Guru](https://daily.dev/sources/itsecurityguru)** · 3 min read · 0 upvotes · 0 comments ## Summary Huntress has issued a threat advisory about an active credential stuffing campaign targeting SonicWall VPN and firewall appliances. First detected on 25 July 2026, the campaign has compromised accounts across 30 organisations, with attack volume growing daily. The threat actors are using five DigitalOcean-hosted IP addresses to systematically test stolen credentials against internet-facing SonicWall portals at scale. No hands-on-keyboard activity has been observed yet, suggesting attackers are still in the credential-validation phase. This follows similar SonicWall-targeting incidents in October 2025 and February 2026. Recommended mitigations include restricting WAN management, resetting all credentials, enforcing MFA, and increasing logging to detect unauthorized access. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Similar posts on daily.dev - [Credential Stuffing Campaign Hits SonicWall](https://daily.dev/posts/credential-stuffing-campaign-hits-sonicwall-kgepxxrjp) · Huntress Blog · 0 upvotes · 0 comments - [SonicWall CVE-2024-40766 Proves Patching Is Not Remediation](https://daily.dev/posts/sonicwall-cve-2024-40766-proves-patching-is-not-remediation-nw4rlw8je) · Latest Hacking News · 0 upvotes · 0 comments - [Hackers bypass SonicWall VPN MFA due to incomplete patching](https://daily.dev/posts/hackers-bypass-sonicwall-vpn-mfa-due-to-incomplete-patching-6ef76rsqe) · BleepingComputer · 0 upvotes · 0 comments - [Threat Brief: Mitigating Large-Scale Credential Attacks](https://daily.dev/posts/threat-brief-mitigating-large-scale-credential-attacks-m9e9r9hka) · Unit 42 · 0 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security) [View this post on daily.dev](https://daily.dev/posts/huntress-flags-widespread-credential-stuffing-campaign-hitting-sonicwall-devices-cjvyihirm) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Huntress Flags Widespread Credential Stuffing Campaign Hitting SonicWall Devices","url":"https://daily.dev/posts/huntress-flags-widespread-credential-stuffing-campaign-hitting-sonicwall-devices-cjvyihirm","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/huntress-flags-widespread-credential-stuffing-campaign-hitting-sonicwall-devices-cjvyihirm"},"datePublished":"2026-07-29T14:00:38.775Z","dateModified":"2026-07-29T14:01:00.885Z","description":"Huntress has issued a threat advisory about an active credential stuffing campaign targeting SonicWall VPN and firewall appliances. First detected on 25 July...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/aeea35537dcdf2971110f2ac9f1d5998?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/aeea35537dcdf2971110f2ac9f1d5998?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"IT Security Guru","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"IT Security Guru","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/ae9fe7d07c814192b35f86ad698fb374","url":"https://daily.dev/sources/itsecurityguru"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/huntress-flags-widespread-credential-stuffing-campaign-hitting-sonicwall-devices-cjvyihirm","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security","timeRequired":"PT3M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"IT Security Guru","item":"https://daily.dev/sources/itsecurityguru"},{"@type":"ListItem","position":3,"name":"Huntress Flags Widespread Credential Stuffing Campaign Hitting SonicWall Devices"}]} ```