CYREBRO

resource

Critical Ransomware Risk to Unpatched SonicWall SRA & SMA 8.X

July 18, 2021 SonicWall has released an URGENT security notice considering a risk to unpatched end-of-life SRA & SMA remote access devices. A HelloKitty Ransomware campaign targets SRA and SMA devices running 8.x firmware. Organizations that fail to take appropriate actions to mitigate these vulnerabilities on their SRA and SMA 100 series products are at imminent risk of a targeted ransomware attack. SonicWall SMA and SRA are solutions which provide organizations with a clientless method of access to applications and network resources specifically for remote and mobile employees.

Vulnerability Targeted by HelloKitty Campaign

Vulnerability in SonicWall SMA100 allow unauthenticated user to gain read-only access to unauthorized resources. This vulnerability impacted SMA100 version 9.0.0.3 and earlier. – exploited by HelloKitty Campaign.

Mitigation (Temporary)

CYREBRO recommends reviewing the official security notice by SonicWall which contains detailed mitigation solutions and procedures. Organizations using the following end-of-life SMA and/or SRA devices running firmware 8.x should either update their firmware or disconnect their appliances per guidance below. While not part of this campaign targeting SRA/SMA firmware 8.x, customers with the following products should also ensure that they’re on the latest version of firmware to mitigate vulnerabilities discovered in early 2021. The affected end-of-life devices with 8.x firmware are past temporary mitigations. Continued use of this firmware or end-of-life devices is an active security risk. References: SonicWall Security Notice