FireEye Mandiant has observed what they describe as an aggressive new threat group exploiting a recently patched zero-day flaw in SonicWall’s virtual private network (VPN) technology to drop ransomware called Fivehands on enterprise networks. The group, which Mandiant is tracking as UNC2447, has been attempting to extort victims both with the ransomware itself and by stealing data from them and threatening to leak it on hacker forums. Victims include telecommunications, healthcare, construction and engineering, food and beverage, and education.”]