Description: The SonicWall Cyber Threat Report highlights the escalating costs and frequencies of cyberattacks on organizations, underlining a worrying trend that affects businesses globally. In the last year, organizations with a relatively modest size of 100-5,000 users have not been spared, with more than half experiencing one or several cyber incidents. These unwelcome events have been financially damaging, with the average cost soaring to $5.34 million. Such a figure represents not just a direct financial burden but also unleashes a series of indirect consequences, including but not limited to, tarnished reputations, operational disruptions, and potential regulatory penalties. These findings, drawn from an exhaustive collection of real-world data and threat intelligence, underscore the critical need for heightened cybersecurity vigilance. A proactive and comprehensive approach to cybersecurity, backed by real-time threat intelligence and robust defense mechanisms, is imperative for organizations seeking to navigate the digital landscape securely and mitigate the risks posed by an ever-evolving threat landscape.

Description: Over the past year, organizations ranging from 100 to 5,000 users have faced an increasing wave of cyberattacks. The 2024 SonicWall Cyber Threat Report highlights a concerning trend where 57% of these organizations endured at least one cyberattack, with an average financial toll of $5.34 million. This significant economic impact underscores the evolving and sophisticated nature of cyber threats. The report draws its conclusions from a robust dataset, courtesy of the SonicWall Capture Labs. This network, comprising over 1.1 million security sensors spread across 215 countries and territories, offers a unique vantage point into the tactics and vectors preferred by cyber adversaries. By analyzing cross-vector threat information and leveraging global malware and IP reputation data, SonicWall provides invaluable insights into cyber incidents. This comprehensive intelligence is not only a testament to the severity of the cybersecurity landscape but also serves as a critical resource for organizations aiming to navigate and mitigate the risks of cyberattacks.

Description: Over the past year, organizations ranging from small to medium businesses with 100-5,000 users have faced a significant cyber threat landscape, with 57% experiencing at least one cyberattack. These incidents have resulted in substantial financial losses, averaging $5.34 million per attack. This figure underscores the grave financial implications cyber threats pose, compelling businesses to reassess their cybersecurity measures. SonicWall, renowned for its real-time cyber threat intelligence, has been at the forefront of these observations. Their 2024 Cyber Threat Report compiles extensive data from 1.1 million security sensors across 215 countries, offering invaluable insights into the nature and frequency of these threats. By analyzing cross-vector threat-related information and leveraging shared intelligence within the cybersecurity community, SonicWall plays a pivotal role in enabling organizations worldwide to bolster their defenses against an evolving cyber threat landscape.

Description: A previously unseen malware called OVERSTEP has been deployed by a threat actor targeting SonicWall Secure Mobile Access (SMA) appliances. The malware, identified as a user-mode rootkit, allows hackers to maintain persistent access, steal sensitive credentials, and hide malicious components. The threat actor, tracked as UNC6148, has been operating since at least October 2023 and has targeted organizations as recently as May. The attacks may have utilized a zero-day remote code execution vulnerability and have resulted in data theft and extortion, with potential deployment of Abyss ransomware.

Description: SonicWall has experienced a cyber attack due to a remote code execution vulnerability affecting its Secure Mobile Access (SMA) appliances. These flaws impacted various SMA models and were exploited despite being patched four years ago. The flaw allowed remote threat actors to inject arbitrary commands and execute arbitrary code. This has been under active exploitation since at least January 2025 as confirmed by cybersecurity company Arctic Wolf and federal agencies. As a response to the attack, SonicWall has updated the security advisory and revised the CVSS score based on the newfound impacts.