Hello and welcome to the Thursday, May 1st, 2025 edition of the Sands Internet Storms

Stormcast. My name is Johannes Ulrich and today I'm recording from Jacksonville, Florida.

Well, in Diaries today, we have Guy talking about possible exploits for a sonic wall vulnerability.

The vulnerability is older. We haven't seen a ton of

exploitation for this vulnerability in the past, but all of a sudden we see a huge rise in scans

for related endpoints. Now, these endpoints are then also related to a login. So it's

possible that this could also just be a brute force attack.

If you're looking at the frequency of these scans, so we had here on the 25th 1.5 million scans

for this particular config domains URL, but similar numbers were then also

seen for other URLs, in particular the log-on URL. And that's kind of what suggests that this may

actually be a bruteude force attack.

If anybody has any more details and is more familiar with the API here for the Sonic Wall,

would be interesting to get some insight on this.

I did try to find some public documentation, but couldn't really find a good sort of

detailed documentation of the different endpoints and how they could, for example, be used

for brute force attack. But as usual, make sure your edge devices are properly patched and

configured, in particular with strong passwords.

An ESET security published an interesting blog post about some malware. They actually did

discover quite a while ago, but now they're writing it up, that does use IPV6 in order to

gain a machine in the middle position. This malware was mostly

targeting China. It was distributed as a Chinese input method plugin for Windows systems.

So that's basically how they initially infected the system. Once a system was infected, that system then sent out a router advertisements.

...