Security Affairs • 5h
SonicWall SMA 1000 Series Mass Exploitation and UK Public Sector Breach
This campaign involves the mass exploitation of a critical vulnerability in SonicWall SMA 1000 series devices to gain initial perimeter access. Attackers utilize weaponized payloads to compromise the VPN gateway, subsequently pivoting to internal Active Directory (AD) environments for credential harvesting and NTDS.dit theft. This lifecycle resulted in the operational disruption of the Borough Council of King's Lynn and West Norfolk and indicates a systemic risk to UK public sector infrastructure. The attack progression focuses on achieving total domain dominance to facilitate large-scale data exfiltration or ransomware deployment, mirroring patterns seen in recent critical infrastructure hits including the NHS Synnovis incident.
Links:Security Affairs, Hunt, Infosecurity-magazine, Digital, England, Facebook, Sonicwall, Zensec •