Notices by RecklessPush38671 (recklesspush38671@infosec.exchange)

@GossiTheDog Hey! If you've got the exploit working could you test whether it just affects native WSUS servers or can it also be used to exploit SCCM servers that have the WSUS functionality enabled?

I'm seeing some pretty strong evidence the SCCM+WSUS combo setup is getting pwned in the wild too.

@GossiTheDog It still wouldn't explain the devices that were purchased as Gen 7s. There should be no way they could ever have been exploited by that CVE.

@GossiTheDog Yeah, I'm pretty sure at this point. I've seen a few of these Akira cases now where the appliance was never running Gen 6 code; they were bought off the shelf as Gen 7 devices.......but their configs were backed up to the Sonicwall cloud. Either the cloud configs are getting used in active attacks or there's something Sonicwall isn't telling us, IMO.

@GossiTheDog Just a side note, CVE-2024-40766 hasn't been the only thing driving the surge in Sonicwall compromises lately. A good chunk have come from attackers getting the device configs from Sonicwall's cloud backup. So even fully patched orgs have been getting hit. And yeah, Akira has been driving most of these as well.

https://www.sonicwall.com/support/knowledge-base/mysonicwall-cloud-backup-file-incident/250915160910330

@GossiTheDog I'm getting a gateway error for this link. Did they take the article down?

@da_667