GreyNoise saw a spike in scans for SonicWall devices that originated from the infrastructure of a known proxy provider.
GreyNoise says there were little to no exploitation attempts and that the threat actor was likely looking to map out a possible attack surface.
Active Reconnaissance Campaign Targets SonicWall Firewalls Through Commercial Proxy Infrastructure
84,000+ scanning sessions targeting SonicWall SonicOS infrastructure in four days. GreyNoise details a coordinated reconnaissance campaign using rotating proxy infrastructure.
(www.greynoise.io)
