important · Edge — SonicWall
Compromised SMA1000 appliances are becoming paths into Active Directory secrets and DCSync.
Affects
SonicWall SMA1000 remote-access appliances deployed at enterprise network edges.
The unauthenticated WorkPlace proxy reaches a localhost Erlang service, after which attackers recover directory material and deploy secretsdump.
Detail and 2 sources
The downstream chain included SAM and LSA collection and DCSync from domain controllers.
SonicWall identifies fixed SMA1000 builds.