Hackers Launch Massive SonicWall Firewall Attack Using 4,000+ IP Addresses - GBHackers News | News Content: Hackers are actively mapping SonicWall firewalls worldwide, launching more than 84,000 SonicOS scanning sessions from over 4,000 unique IP addresses in just four days to identify SSL VPN targets for future credential and vulnerability attacks. Three operationally distinct infrastructure clusters coordinated large-scale VPN enumeration, with 92% of all sessions hitting a single SonicOS REST API endpoint used to check whether SSL VPN is enabled. A commercial proxy network contributed 32% of total traffic by rotating 4,102 exit IPs through two tightly

CVE-2024-38475 | Apache HTTP Server up to 2.4.59 mod_rewrite access control (Nessus ID 209779 / WID-SEC-2024-1504) | A vulnerability classified as critical has been found in Apache HTTP Server up to 2.4.59. Affected by this issue is some unknown functionality of the component mod_rewrite. This manipulation causes improper access controls. This vulnerability appears as CVE-2024-38475. The attack may

Ongoing SonicWall Secure Mobile Access (SMA) Exploitation Campaign using the OVERSTEP Backdoor - Google Cloud | News Content: July 16, 2025 Mandiant Google Threat Intelligence Group Mandiant Services Stop attacks, reduce risk, and advance your security. Contact Mandiant Written by: Josh Goddard, Zander Work, Dimiter Andonov UPDATE (Sep 16): Clarified hunting guidance specifics surrounding ld.so.preload files. UPDATE (July 30): Added additional network IOC identified by Sonicwall as being associated with OVERSTEP. Introduction Google Threat Intelligence Group (GTIG) has identified an ongoing campaign by a suspected financially-motivated threat actor we track as UNC6148, targeting fully patched end-of-life SonicWall Secure Mobile

Hackers Exploit End-of-Life SonicWall Devices Using Overstep Malware and Possible Zero-Day |  Cybersecurity experts from Google’s Threat Intelligence Group (GTIG) have uncovered a series of attacks targeting outdated SonicWall Secure Mobile Access (SMA) devices, which are widely used to manage secure remote

USN-6885-5: Apache HTTP Server vulnerabilities | USN-6885-1 fixed vulnerabilities in Apache. This update provides the corresponding updates for Ubuntu 14.04 LTS. Original advisory details: Orange Tsai discovered that the Apache HTTP Server mod_rewrite module incorrectly handled certain substitutions. A remote attacker could possibly use this issue to execute scripts in directories not directly reachable by any URL, or cause a denial of service. Some environments may require using the new UnsafeAllow3F flag to handle unsafe substitutions. (CVE-2024-38474, CVE-2024-38475)

UNC6148 deploys Overstep malware on SonicWall devices, possibly for ransomware operations | UNC6148 targets SonicWall devices with Overstep malware, using a backdoor and rootkit for data theft, extortion, or ransomware. Google’s Threat Intelligence Group warns that a threat actor tracked as UNC6148 has been targeting SonicWall SMA appliances with new malware dubbed Overstep. Active since at least October 2024, the group uses a backdoor and user-mode rootkit […] UNC6148 targets SonicWall devices with Overstep malware

SonicWall customers hit by fresh, ongoing attacks targeting fully patched SMA 100 devices | Google Threat Intelligence Group said a financially motivated threat group is abusing the outdated remote access VPN devices, underscoring a continued pattern of threats confronting SonicWall customers. The post SonicWall customers hit by fresh, ongoing attacks targeting fully patched SMA 100 devices appeared first on CyberScoop.A financially motivated threat group is attacking