---
title: SonicWall Investigates Suspected Zero-Day as Hackers Bypass MFA on Firewalls
description: SonicWall is investigating a suspected zero-day vulnerability after hackers bypassed MFA on firewalls, deploying ransomware and a new backdoor. Immediate mitigation steps are recommended.
canonical_url: https://codekeeper.co/ticker/sonicwall-investigates-suspected-zero-day-as-hackers-bypass-mfa-on-firewalls
---

[Vulnerabilities](https://codekeeper.co/ticker/tag/vulnerabilities)

# SonicWall Investigates Suspected Zero-Day as Hackers Bypass MFA on Firewalls

SonicWall is investigating a suspected zero-day vulnerability after hackers bypassed MFA on firewalls, deploying ransomware and a new backdoor. Immediate mitigation steps are recommended.

![Content Team](https://codekeeper.co/hubfs/_sized/Codekeeper_21_beeldmerkL-800.png)

By Content Team Aug 5, 2025

Share [![Share on facebook](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Facebook.svg)](http://www.facebook.com/share.php?u=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fsonicwall-investigates-suspected-zero-day-as-hackers-bypass-mfa-on-firewalls%3Futm_medium%3Dsocial%26utm_source%3Dfacebook) [![Share on linkedin](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Linkedin.svg)](http://www.linkedin.com/shareArticle?mini=true&url=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fsonicwall-investigates-suspected-zero-day-as-hackers-bypass-mfa-on-firewalls%3Futm_medium%3Dsocial%26utm_source%3Dlinkedin) [![Share on twitter](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20X.svg)](https://twitter.com/intent/tweet?original_referer=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fsonicwall-investigates-suspected-zero-day-as-hackers-bypass-mfa-on-firewalls%3Futm_medium%3Dsocial%26utm_source%3Dtwitter&url=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fsonicwall-investigates-suspected-zero-day-as-hackers-bypass-mfa-on-firewalls%3Futm_medium%3Dsocial%26utm_source%3Dtwitter&source=tweetbutton&text=) [![Share on email](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Mail.svg)](mailto:?subject=Check%20out%20https%3A%2F%2Fcodekeeper.co%2Fticker%2Fsonicwall-investigates-suspected-zero-day-as-hackers-bypass-mfa-on-firewalls%3Futm_medium%3Dsocial%26utm_source%3Demail%20&body=Check%20out%20https%3A%2F%2Fcodekeeper.co%2Fticker%2Fsonicwall-investigates-suspected-zero-day-as-hackers-bypass-mfa-on-firewalls%3Futm_medium%3Dsocial%26utm_source%3Demail) ![Copy link](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Copy.svg)

ON THIS PAGE

### Want more insights like this?

Subscribe to our newsletter to get the latest software protection strategies delivered to your inbox.

By submitting your email, you consent to Codekeeper contacting you and agree to our [privacy policy](https://codekeeper.co/privacy-policy) .

SonicWall is investigating a potential zero-day vulnerability after a surge in ransomware attacks targeting its firewalls since mid-July. Google's threat intelligence team first spotted the campaign, where hackers deployed a new backdoor called Overstep on fully patched devices. The attacks affect Gen 7 SonicWall firewalls with SSLVPN enabled, particularly TZ and NSa-series models running firmware 7.2.0-7015 or earlier. What's alarming: attackers bypassed multi-factor authentication and reached domain controllers within hours. SonicWall recommends immediately disabling SSLVPN services, limiting connectivity to trusted IPs, and updating all passwords while the investigation continues. **Source:** [Security Week](https://www.securityweek.com/sonicwall-hunts-for-zero-day-amid-surge-in-firewall-exploitation/)

Share this article [![Share on facebook](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Facebook.svg)](http://www.facebook.com/share.php?u=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fsonicwall-investigates-suspected-zero-day-as-hackers-bypass-mfa-on-firewalls%3Futm_medium%3Dsocial%26utm_source%3Dfacebook) [![Share on linkedin](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Linkedin.svg)](http://www.linkedin.com/shareArticle?mini=true&url=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fsonicwall-investigates-suspected-zero-day-as-hackers-bypass-mfa-on-firewalls%3Futm_medium%3Dsocial%26utm_source%3Dlinkedin) [![Share on twitter](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20X.svg)](https://twitter.com/intent/tweet?original_referer=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fsonicwall-investigates-suspected-zero-day-as-hackers-bypass-mfa-on-firewalls%3Futm_medium%3Dsocial%26utm_source%3Dtwitter&url=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fsonicwall-investigates-suspected-zero-day-as-hackers-bypass-mfa-on-firewalls%3Futm_medium%3Dsocial%26utm_source%3Dtwitter&source=tweetbutton&text=) [![Share on email](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Mail.svg)](mailto:?subject=Check%20out%20https%3A%2F%2Fcodekeeper.co%2Fticker%2Fsonicwall-investigates-suspected-zero-day-as-hackers-bypass-mfa-on-firewalls%3Futm_medium%3Dsocial%26utm_source%3Demail%20&body=Check%20out%20https%3A%2F%2Fcodekeeper.co%2Fticker%2Fsonicwall-investigates-suspected-zero-day-as-hackers-bypass-mfa-on-firewalls%3Futm_medium%3Dsocial%26utm_source%3Demail) ![Copy link](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Copy.svg)

![blog_book_a_demo_cta_3x](https://codekeeper.co/hubfs/_sized/Codekeeper%202025/blog_book_a_demo_cta_3x-768x512.webp)

Have questions about protecting your software?

Our escrow experts are standing by to help.

[Book a free demo](https://codekeeper.co/book-a-demo)

YOU MAY ALSO LIKE

[Nearly 33,000 NHS Patients Caught Up in 2024 Ransomware Attack Aug 12, 2026](https://codekeeper.co/ticker/bedfordshire-hospitals-data-breach-2024)

[Cyberattacks Hackers Targeted French Supermarket Fridges, Spoiling Millions in Food Oct 14, 2026](https://codekeeper.co/ticker/cyberattack-on-french-supermarkets-refrigeration)

[Patch Now: Palo Alto GlobalProtect Auth Bypass Flaw Actively Exploited Aug 12, 2026](https://codekeeper.co/ticker/palo-alto-globalprotect-vpn-security-flaw)

[Chinese-Funded Interpol Operation Nets 5,800 Arrests and $293M Intercepted Aug 12, 2026](https://codekeeper.co/ticker/global-cybercrime-sweep-interpol-2026)