SonicWall: Attacks on US SLED Sector Up 242%

Executive Summary

A new threat intelligence report from SonicWall has revealed a staggering 242% year-over-year increase in cyberattacks aimed at U.S. state, local, and education (SLED) organizations during the first half of 2026. The 2026 SLED Protect Brief, based on data from SonicWall's global sensor network, indicates that while attackers in other sectors are becoming more selective, the SLED sector is facing an overwhelming and indiscriminate barrage of attacks. The report attributes this surge to several chronic issues within the public sector, including underfunded IT departments, reliance on aging legacy systems, and inconsistent patching cadences. The continued exploitation of old vulnerabilities like Log4Shell (CVE-2021-44228) remains a significant problem.

Threat Overview

The SonicWall report paints a grim picture for the SLED sector. While overall attack trends in many industries show a move towards more precise, targeted intrusions, the SLED sector is an outlier, experiencing a massive growth in raw attack volume. The sector absorbed over 300 million intrusion prevention system (IPS) hits in the first half of 2026.

Key findings from the report include:

• 242% Increase in Attacks: A dramatic surge compared to the previous year.
• High Attack Density: The SLED sector recorded 162,062 IPS hits per firewall, a rate higher than any enterprise vertical analyzed.
• Web Attacks Dominate: Web-based attacks accounted for 85.1% of the total attack volume.
• Legacy Vulnerabilities Persist: The Log4Shell vulnerability (CVE-2021-44228), first disclosed in late 2021, was still responsible for 19.5 million attack attempts against government firewalls, demonstrating a significant failure in patch management.

Attackers are actively exploiting the "structural friction points" in these organizations, such as decentralized IT, limited budgets, and a lack of cybersecurity expertise.

Technical Analysis

The threat landscape for the SLED sector is characterized by opportunistic attacks exploiting well-known vulnerabilities. The high volume of IPS hits suggests widespread, automated scanning and exploitation attempts rather than sophisticated, targeted campaigns.

The continued prevalence of Log4Shell attacks nearly five years after its disclosure is a critical data point. It highlights a core technical challenge in the SLED sector: identifying and patching vulnerabilities in Java-based applications, which are often embedded in third-party software or legacy systems. The attack vector for Log4Shell (T1190 - Exploit Public-Facing Application) involves sending a specially crafted string to a vulnerable application, which can result in unauthenticated remote code execution. The high number of attempts indicates that many public-facing government systems remain unpatched and exposed.

The dominance of web attacks suggests that attackers are primarily targeting public-facing websites and web applications, which are often the most exposed and sometimes least maintained assets in a government entity's portfolio.

Impact Assessment

A successful cyberattack on a SLED organization can have severe consequences for the public.

• Disruption of Public Services: An attack could take down systems responsible for emergency services, utilities, tax collection, or school administration, directly impacting citizens.
• Data Breach of Sensitive Information: State and local governments hold vast amounts of personally identifiable information (PII) on residents. A breach can lead to widespread identity theft and fraud.
• Financial Loss: The cost of incident response, system recovery, and potential ransom payments can be crippling for a budget-constrained public entity.
• Erosion of Public Trust: Cyberattacks undermine public confidence in the government's ability to protect their data and provide essential services.

The report suggests that the SLED sector is becoming a target of choice because it is perceived as a soft target with a high potential for impact.

IOCs — Directly from Articles

No specific Indicators of Compromise (IOCs) were provided in the source report summary.

Cyber Observables — Hunting Hints

To hunt for threats common in the SLED sector, security teams should look for:

Detection & Response

1. Asset Inventory: Maintain a complete and accurate inventory of all hardware and software assets, especially public-facing applications. This is the foundation for any effective security program. D3FEND: D3-PSA: Platform System Analysis.
2. Vulnerability Scanning: Implement continuous, authenticated vulnerability scanning of all internal and external assets to identify missing patches and misconfigurations. D3FEND: D3-VS: Vulnerability Scanning.
3. Web Application Firewall (WAF): Deploy a WAF to protect public-facing web applications from common attacks, including attempts to exploit vulnerabilities like Log4Shell. D3FEND: D3-ITF: Inbound Traffic Filtering.

Mitigation

1. Patch Management: Prioritize patching of known exploited vulnerabilities, especially on internet-facing systems. The fact that Log4Shell is still a major threat underscores the critical need for a disciplined patch management process. D3FEND: D3-SU: Software Update.
2. Network Segmentation: Segment networks to limit the blast radius of an attack. Prevent a compromise of a public-facing web server from immediately leading to access to the entire internal network.
3. Funding and Resources: SLED organizations must advocate for increased cybersecurity funding to hire skilled personnel, replace legacy systems, and invest in modern security tools.
4. Shared Services: Smaller local governments and school districts should explore shared security services or managed security service providers (MSSPs) to gain access to expertise and technology they cannot afford on their own.