SonicWall
Company Details
Linkedin ID:
SonicWall
Website:
Employees number:
1,993
Number of followers:
97,611
NAICS:
541514
Industry Type:
Homepage:
sonicwall.com
IP Addresses:
0
Company ID:
SON_2852562
Scan Status:
In-progress
SonicWall Company CyberSecurity Posture
sonicwall.com
About SonicWall SonicWall has been fighting the cyber-criminal industry for over 30 years defending small, medium-size businesses and enterprises worldwide. Backed by research from the Global Response Intelligent Defense (GRID) Threat Network, our award-winning real-time breach detection and prevention solutions, coupled with the formidable resources of over 10,000 loyal channel partners around the globe, are the backbone securing more than a million business and mobile networks and their emails, applications and data. This combination of products and partners has enabled a real-time cyber defense solution tuned to the specific needs of the more than 500,000 global businesses in more than 215 countries and territories. Originally founded in 1991. *U.S. Patents 7,310,815; 7,600,257; 7,738,380; 7,835,361; 7,991,723
SonicWall A.I CyberSecurity Scoring
SonicWall Risk Score (AI oriented)Between 650 and 699
SonicWall
Updated:
- Powered by our proprietary A.I cyber incident model
- Insurance preferes TPRM score to calculate premium
SonicWall Global Score (TPRM)XXXX
SonicWall
- Instant access to detailed risk factors
- Benchmark vs. industry & size peers
- Vulnerabilities
- Findings
SonicWall Company CyberSecurity News & History
Past Incidents
18
Attack Types
4
SonicWall
Ransomware
Rankiteo Explanation
Attack threatening the organization’s existence
Description: SonicWall, a cybersecurity company, experienced breaches into enterprise networks through Fog and Akira ransomware exploiting the VPN vulnerability CVE-2024-40766. The critical flaw led to unauthorized access and potential firewall crashes, impacting Gen 5, 6, and early Gen 7 devices. Despite patches being released, ongoing intrusions via unpatched SSL VPNs have led to a rise in ransomware attacks since August 2024. The vulnerability allowed a rapid pivot from initial access to ransom activities, with a timeline as short as 1.5 hours. The targeted ransomware attacks demonstrate the urgency of applying security updates to prevent severe repercussions, including loss of resources and compromised data.
SonicWall
Breach
Rankiteo Explanation
Attack limited on finance or reputation
Description: SonicWall detected a security incident where threat actors accessed encrypted backup firewall preference files stored in the MySonicWall cloud service for fewer than 5% of its firewall install base. Although no files were leaked online, the exposed data included encrypted credentials and configuration details that could facilitate further exploitation of affected firewalls. The breach resulted from brute-force attacks targeting the cloud backup service, not ransomware. SonicWall locked out the attackers, notified authorities, and urged impacted customers to reset credentials, reconfigure VPN pre-shared keys, and update TOTP bindings to mitigate risks. The remediation process requires importing new preference files, which disrupts VPNs and user access, necessitating manual reconfiguration. The company emphasized no evidence of data leaks but warned of potential follow-on attacks if exposed configurations were misused.
SonicWall
Breach
Rankiteo Explanation
Attack with significant impact with internal employee data leaks
Description: SonicWall experienced a security breach in September where state-sponsored hackers gained unauthorized access to a specific cloud environment via an API call, exposing firewall configuration backup files stored in **MySonicWall** accounts. While the breach was isolated and did not compromise SonicWall’s products, firmware, source code, or customer networks, the exposed files contained sensitive credentials (e.g., access tokens, LDAP/RADIUS/TACACS+ passwords, VPN shared secrets, and WAN interface passwords). This information could have significantly eased follow-on attacks against customers' firewalls by allowing threat actors to exploit misconfigured or weakly secured systems. SonicWall promptly advised affected users to reset all related credentials and secrets. The incident was later confirmed to be unrelated to concurrent Akira ransomware attacks or the separate wave of SSLVPN credential-stuffing attacks reported by Huntress in October. Mandiant’s investigation concluded that the breach was contained, with no evidence of lateral movement or broader system disruption.
SonicWall
Breach
Rankiteo Explanation
Attack with significant impact with customers data leaks
Description: SonicWall suffered a cyberattack where threat actors brute-forced their **MySonicWall** cloud backup service, exposing firewall configuration files of **all customers** using the feature. The leaked files included sensitive data such as **network rules, VPN configurations, admin credentials (LDAP, RADIUS, SNMP), and stored passwords**, increasing the risk of **targeted network intrusions**. Initially downplaying the impact (claiming <5% of customers were affected), SonicWall later acknowledged the breach was far broader, potentially compromising **hundreds of thousands of global customers**. While encryption remained intact, attackers could decrypt or exploit the exposed configurations to **bypass defenses, launch insider-like attacks, or steal service credentials**. SonicWall urged customers to **delete cloud backups, rotate secrets, and recreate configurations locally** to mitigate risks. The breach did not affect other MySonicWall services or devices but posed severe operational and security threats to affected organizations.
SonicWall
Breach
Rankiteo Explanation
Attack with significant impact with customers data leaks
Description: SonicWall confirmed that **all customers** using its **MySonicWall cloud backup service** were impacted by a cybersecurity breach initially disclosed in September 2023. The attackers accessed **firewall configuration backup files**, which include critical network settings, policies, user/group/domain details, DNS/log configurations, and certificates. While SonicWall claims no evidence of compromise to production firewalls or other systems, the exposed data could enable threat actors—including nation-state groups or ransomware operators—to **map internal infrastructure, pivot into connected environments, or launch follow-on attacks**. Initially, SonicWall downplayed the incident, stating only **<5% of customers** were affected, but an independent forensic review revealed **100% of cloud backup users** were exposed. Customers were advised to **delete cloud backups, rotate credentials, and recreate backups locally**. The company has not disclosed the attack vector, attributed the breach to a specific threat actor, or confirmed whether data was exfiltrated, leaked, or destroyed. This incident follows prior SonicWall breaches, including a **zero-day VPN exploit** linked to ransomware attacks earlier in 2023, further eroding customer trust in its security posture.
SonicWall
Breach
Rankiteo Explanation
Attack threatening the organization's existence
Description: SonicWall confirmed a severe breach where hackers accessed **firewall configuration backup files** for **all customers** using its cloud backup service (MySonicWall portal). Initially downplayed as affecting only 5% of users, an internal investigation (assisted by Mandiant) revealed a **full compromise** of encrypted backups—including firewall rules, VPN configurations, and access controls—via brute-force attacks. While SonicWall claims the exfiltrated data is encrypted, experts warn it could be decrypted or leveraged for targeted exploits, phishing, or network mapping. The breach forces **thousands of enterprises** to reset credentials, regenerate encryption keys, and conduct forensic audits, disrupting operations. The incident exacerbates SonicWall’s reputation after repeated vulnerabilities since 2021 (e.g., zero-days in Secure Mobile Access) and raises compliance concerns under **GDPR/NIST**. Though no immediate exploitation is reported, the stolen data poses long-term risks, including supply-chain attacks akin to SolarWinds. Customers are advised to update firmware, monitor anomalies, and adopt zero-trust architectures to mitigate fallout.
SonicWall
Cyber Attack
Rankiteo Explanation
Attack threatening the organization’s existence
Description: A sophisticated cyberattack campaign targeted **SonicWall SSL VPN devices**, compromising over **100 accounts** since early October. Attackers exploited **valid, exposed credentials** (not brute-force) from a centralized IP (202.155.8.73), indicating a **premeditated, highly coordinated operation**. The breach aligns with SonicWall’s disclosure that **unauthorized parties accessed encrypted firewall configuration backups** (containing sensitive credentials) via the **MySonicWall cloud platform**, contradicting their earlier claim that only <5% of installations were affected.The attackers conducted **reconnaissance, credential validation, and network scans**, escalating to attempts at accessing **local Windows accounts** on compromised systems. While SonicWall denies a direct link between the backup leak and VPN intrusions, the **timing and methodical approach** suggest exploitation of stolen configurations. The risk includes **catastrophic data loss, lateral movement, and further system compromise**, prompting urgent remediation: **credential resets, service disablement (HTTP/S, SSH, SSL VPN), MFA enforcement, and enhanced logging**.The attack’s **scale, precision, and potential for widespread exploitation**—leveraging leaked configurations—poses a **severe threat to global organizations** relying on SonicWall’s infrastructure. Immediate action is critical to prevent further intrusions and mitigate damage.
SonicWall
Cyber Attack
Rankiteo Explanation
Attack threatening the organization’s existence
Description: A sophisticated cyberattack campaign targeted SonicWall SSL VPN devices, compromising over 100 accounts since early October 2023. Threat actors exploited valid, exposed credentials (rather than brute-force methods) to infiltrate systems, originating from a single IP (202.155.8.73), suggesting a centralized command structure. The breach escalated after SonicWall disclosed that unauthorized parties accessed encrypted firewall configuration backups—containing sensitive credentials—via its MySonicWall cloud service. While SonicWall initially claimed the breach affected under 5% of installations, the timing and precision of the attacks imply a direct link. Attackers conducted reconnaissance, scanned networks, and attempted to access local Windows accounts, posing risks of catastrophic data loss. SonicWall urged immediate mitigation: resetting all credentials (admin, VPN, LDAP, API), disabling remote services, enabling MFA, and enforcing strict access controls. The campaign’s scale and methodical execution highlight severe vulnerabilities in critical network infrastructure, with potential for widespread exploitation if unchecked.
SonicWall
Cyber Attack
Rankiteo Explanation
Attack threatening the organization’s existence
Description: The SonicWall Cyber Threat Report highlights the escalating costs and frequencies of cyberattacks on organizations, underlining a worrying trend that affects businesses globally. In the last year, organizations with a relatively modest size of 100-5,000 users have not been spared, with more than half experiencing one or several cyber incidents. These unwelcome events have been financially damaging, with the average cost soaring to $5.34 million. Such a figure represents not just a direct financial burden but also unleashes a series of indirect consequences, including but not limited to, tarnished reputations, operational disruptions, and potential regulatory penalties. These findings, drawn from an exhaustive collection of real-world data and threat intelligence, underscore the critical need for heightened cybersecurity vigilance. A proactive and comprehensive approach to cybersecurity, backed by real-time threat intelligence and robust defense mechanisms, is imperative for organizations seeking to navigate the digital landscape securely and mitigate the risks posed by an ever-evolving threat landscape.
SonicWall
Ransomware
Rankiteo Explanation
Attack with significant impact with customers data leaks
Description: In Q3 2025, SonicWall faced a prolonged ransomware campaign by the **Akira group**, exploiting weak access controls in its **SSLVPN services**. Attackers leveraged **credential stuffing** to bypass authentication, targeting devices with **absent MFA and insufficient lockout policies**. The breach enabled unauthorized access to corporate networks, potentially exposing sensitive data and operational integrity. While the report does not confirm data exfiltration, the exploitation of SonicWall’s security appliances—critical for VPN access—poses severe risks, including **lateral movement into customer environments, financial fraud, or operational disruptions**. The incident underscores systemic vulnerabilities in access management, with attackers commoditizing stolen credentials via infostealers like **Rhadamanthys**. Though no direct customer data leak was confirmed, the compromise of VPN infrastructure threatens **financial reputation, regulatory compliance, and trust in SonicWall’s security products**. Mitigation required emergency patches, MFA enforcement, and forensic investigations to assess potential downstream impacts.
SonicWall
Ransomware
Rankiteo Explanation
Attack threatening the organization’s existence
Description: Over the past year, organizations ranging from 100 to 5,000 users have faced an increasing wave of cyberattacks. The 2024 SonicWall Cyber Threat Report highlights a concerning trend where 57% of these organizations endured at least one cyberattack, with an average financial toll of $5.34 million. This significant economic impact underscores the evolving and sophisticated nature of cyber threats. The report draws its conclusions from a robust dataset, courtesy of the SonicWall Capture Labs. This network, comprising over 1.1 million security sensors spread across 215 countries and territories, offers a unique vantage point into the tactics and vectors preferred by cyber adversaries. By analyzing cross-vector threat information and leveraging global malware and IP reputation data, SonicWall provides invaluable insights into cyber incidents. This comprehensive intelligence is not only a testament to the severity of the cybersecurity landscape but also serves as a critical resource for organizations aiming to navigate and mitigate the risks of cyberattacks.
SonicWall
Ransomware
Rankiteo Explanation
Attack threatening the organization’s existence
Description: The Akira ransomware group exploited **CVE-2024-40766**, an improper access control flaw in **SonicWall SonicOS SSL VPN**, to breach organizations in under four hours. Attackers reused stolen credentials—harvested months prior from unpatched or improperly secured Gen 6-to-Gen 7 firewall upgrades—bypassing MFA via misconfigured **SSLVPN Default Users Group** settings and OTP manipulation. Once inside, they conducted lateral movement via **SMB (Impacket)**, **RDP**, and **Domain Controller compromise**, exfiltrating data using **WinRAR, rclone, and FileZilla** before deploying **Akira ransomware**. The attack disabled **EDR tools**, deleted **Shadow Copies**, and cleared **event logs**, crippling recovery efforts. Victims spanned multiple industries, with SonicWall’s cloud backup service also targeted separately. The breach highlights credential reuse risks, even on patched systems, and the speed of modern ransomware operations. Organizations were urged to reset **all SSL VPN/LDAP credentials** and monitor for **VPS logins, SMB anomalies, and unauthorized archival tools** to mitigate future intrusions.
SonicWall
Ransomware
Rankiteo Explanation
Attack threatening the organization’s existence
Description: The Akira ransomware gang exploited a critical **CVE-2024-40766** (CVSS 9.8) vulnerability in SonicWall’s SSLVPN appliances, a flaw originally disclosed in August 2024 but left unpatched by many organizations. Over **438,000 SonicWall devices remained publicly exposed**, enabling attackers to gain unauthorized access via misconfigurations, legacy credentials, and improper LDAP group settings. Akira and other ransomware groups (e.g., Fog) used this to encrypt systems within **10 hours of initial access**, leading to widespread disruptions. Rapid7 reported **double-digit incidents** among its customers, while SonicWall confirmed **fewer than 40 cases** in early August 2025—though the actual impact is likely higher due to underreporting. The attacks leveraged **default Virtual Office portal configurations**, allowing MFA bypasses if credentials were previously exposed. Organizations failing to apply patches, enforce MFA, or restrict portal access faced **full-system encryption**, operational outages, and potential **data exfiltration**, threatening business continuity. The persistent exploitation highlights systemic negligence in mitigating known vulnerabilities, amplifying the risk of **financial losses, reputational damage, and regulatory penalties** for affected entities.
SonicWall
Ransomware
Rankiteo Explanation
Attack threatening the organization's existence
Description: A previously unseen malware called OVERSTEP has been deployed by a threat actor targeting SonicWall Secure Mobile Access (SMA) appliances. The malware, identified as a user-mode rootkit, allows hackers to maintain persistent access, steal sensitive credentials, and hide malicious components. The threat actor, tracked as UNC6148, has been operating since at least October 2023 and has targeted organizations as recently as May. The attacks may have utilized a zero-day remote code execution vulnerability and have resulted in data theft and extortion, with potential deployment of Abyss ransomware.
SonicWall
Ransomware
Rankiteo Explanation
Attack threatening the organization’s existence
Description: SonicWall suffered a **prolonged ransomware campaign** by the **Akira group**, exploiting compromised VPN credentials (SSLVPN services) as the primary initial access vector. The attack involved **credential stuffing and brute-force techniques**, targeting weak or absent MFA controls and insufficient lockout policies. The breach extended to SonicWall’s **cloud service**, exposing **sensitive configuration backups** of client devices—critical data that could facilitate further attacks on customers. Akira accounted for **39% of Beazley’s incident response cases** in Q3, highlighting systemic vulnerabilities in SonicWall’s security posture. The incident underscores the risk of **leaked credentials on the dark web**, which were weaponized to deploy ransomware across multiple victim environments. The compromise not only disrupted SonicWall’s operations but also **amplified supply-chain risks** for its clients, as attackers leveraged stolen backups to exploit downstream targets. The financial and reputational damage includes **regulatory scrutiny, customer distrust, and potential litigation**, compounded by the **operational outages** caused by ransomware encryption. The attack also revealed **critical gaps in patch management**, as Akira exploited unpatched systems alongside weak credential hygiene. While the report does not confirm data exfiltration beyond configuration backups, the **potential for broader data leaks** (e.g., customer or employee PII) remains a latent risk, given the nature of ransomware operations. The incident aligns with broader trends where **VPN appliances are prime targets**, with SonicWall’s breach serving as a case study in how **initial access brokers monetize stolen credentials** to deploy high-impact ransomware.
SonicWall
Ransomware
Rankiteo Explanation
Attack threatening the organization’s existence
Description: A suspected zero-day vulnerability in SonicWall firewall devices has led to a significant increase in ransomware attacks by the Akira ransomware group. The flaw allows attackers to gain initial access to corporate networks through SonicWall's SSL VPN feature, leading to subsequent ransomware deployment. The attackers have bypassed multi-factor authentication (MFA), indicating a sophisticated attack vector. The time between the initial VPN breach and the deployment of ransomware is short, giving victims little time to react. Arctic Wolf has recommended disabling the SonicWall SSL VPN service immediately until an official patch is developed and deployed.
SonicWall
Ransomware
Rankiteo Explanation
The description provided does not specify a single event's impact, making it impossible to assign a severity score or categorize the impact based on the given criteria.
Description: Over the past year, organizations ranging from small to medium businesses with 100-5,000 users have faced a significant cyber threat landscape, with 57% experiencing at least one cyberattack. These incidents have resulted in substantial financial losses, averaging $5.34 million per attack. This figure underscores the grave financial implications cyber threats pose, compelling businesses to reassess their cybersecurity measures. SonicWall, renowned for its real-time cyber threat intelligence, has been at the forefront of these observations. Their 2024 Cyber Threat Report compiles extensive data from 1.1 million security sensors across 215 countries, offering invaluable insights into the nature and frequency of these threats. By analyzing cross-vector threat-related information and leveraging shared intelligence within the cybersecurity community, SonicWall plays a pivotal role in enabling organizations worldwide to bolster their defenses against an evolving cyber threat landscape.
SonicWall
Vulnerability
Rankiteo Explanation
Attack with significant impact with customers data leaks
Description: SonicWall has experienced a cyber attack due to a remote code execution vulnerability affecting its Secure Mobile Access (SMA) appliances. These flaws impacted various SMA models and were exploited despite being patched four years ago. The flaw allowed remote threat actors to inject arbitrary commands and execute arbitrary code. This has been under active exploitation since at least January 2025 as confirmed by cybersecurity company Arctic Wolf and federal agencies. As a response to the attack, SonicWall has updated the security advisory and revised the CVSS score based on the newfound impacts.
SonicWall Company Scoring based on AI Models
Cyber Incidents Likelihood 3 - 6 - 9 months
A.I Risk Score Likelihood 3 - 6 - 9 months
Underwriter Stats for SonicWall
Incidents vs Computer and Network Security Industry Average (This Year)
No incidents recorded for SonicWall in 2025.
Incidents vs All-Companies Average (This Year)
No incidents recorded for SonicWall in 2025.
Incident Types SonicWall vs Computer and Network Security Industry Avg (This Year)
No incidents recorded for SonicWall in 2025.
Incident History — SonicWall (X = Date, Y = Severity)
SonicWall cyber incidents detection timeline including parent company and subsidiaries
SonicWall Company Subsidiaries
About SonicWall SonicWall has been fighting the cyber-criminal industry for over 30 years defending small, medium-size businesses and enterprises worldwide. Backed by research from the Global Response Intelligent Defense (GRID) Threat Network, our award-winning real-time breach detection and prevention solutions, coupled with the formidable resources of over 10,000 loyal channel partners around the globe, are the backbone securing more than a million business and mobile networks and their emails, applications and data. This combination of products and partners has enabled a real-time cyber defense solution tuned to the specific needs of the more than 500,000 global businesses in more than 215 countries and territories. Originally founded in 1991. *U.S. Patents 7,310,815; 7,600,257; 7,738,380; 7,835,361; 7,991,723
Loading...
SonicWall Similar Companies
CrowdStrike
CrowdStrike (Nasdaq: CRWD), a global cybersecurity leader, has redefined modern security with the world’s most advanced cloud-native platform for protecting critical areas of enterprise risk — endpoints and cloud workloads, identity and data. Powered by the CrowdStrike Security Cloud and world-clas
Palo Alto Networks, the global cybersecurity leader, is shaping the cloud-centric future with technology that is transforming the way people and organizations operate. Our mission is to be the cybersecurity partner of choice, protecting our digital way of life. We help address the world's greatest s
.png)
SonicWall CyberSecurity News
November 18, 2025 10:00 PM
SonicWall maintains perfect threat efficacy in firewall testing
SonicWall achieved a perfect 100% threat block rate in independent firewall tests for a second year, highlighting its leading network...
November 18, 2025 07:30 AM
SonicWall sees 500% surge in cloud & zero trust bookings
SonicWall's cloud and zero trust bookings soar over 500%, driven by a surge in partners and a shift to cloud-first cybersecurity solutions.
November 06, 2025 02:11 PM
SonicWall Confirms State-Sponsored Hackers Behind Massive Firewall Breach
The breach, while serious, remained isolated to cloud backup data and did not compromise the company's core products, firmware,...
November 06, 2025 01:51 PM
SonicWall Confirms State-Sponsored Hackers Behind the Massive Firewall Backup Breach
SonicWall, a global cybersecurity company, confirmed that state-sponsored hackers were behind a recent incident involving unauthorized...
November 06, 2025 12:42 PM
State-sponsored hackers named as culprits in SonicWall cyber hit
SonicWall, a major VPN, firewall, and other network security solutions provider, has formally blamed state-sponsored threat actors for the...
November 06, 2025 08:00 AM
SonicWall Firewall Backups Stolen by Nation-State Actor
The network security vendor said the MySonicWall breach was unrelated to the recent wave of Akira ransomware attacks targeting the company's...
November 06, 2025 08:00 AM
SonicWall says state-linked actor behind attacks against cloud backup service
CEO announces security and governance reforms inside the company, including the adoption of secure-by-design practices.
November 06, 2025 08:00 AM
SonicWall breach linked to state-backed threat actors
SonicWall has attributed the cyberattack against MySonicWall accounts that exposed certain firewall backup files in September to a...
November 06, 2025 08:00 AM
SonicWall fingers state-backed cyber crew for September firewall breach
SonicWall has blamed an unnamed, state-sponsored collective for the September break-in that saw cybercriminals rifle through a cache of...
Frequently Asked Questions
Explore insights on cybersecurity incidents, risk posture, and Rankiteo's assessments.
SonicWall CyberSecurity History Information
Official Website of SonicWall
The official website of SonicWall is http://www.sonicwall.com.
SonicWall’s AI-Generated Cybersecurity Score
According to Rankiteo, SonicWall’s AI-generated cybersecurity score is 685, reflecting their Weak security posture.
How many security badges does SonicWall’ have ?
According to Rankiteo, SonicWall currently holds 0 security badges, indicating that no recognized compliance certifications are currently verified for the organization.
Does SonicWall have SOC 2 Type 1 certification ?
According to Rankiteo, SonicWall is not certified under SOC 2 Type 1.
Does SonicWall have SOC 2 Type 2 certification ?
According to Rankiteo, SonicWall does not hold a SOC 2 Type 2 certification.
Does SonicWall comply with GDPR ?
According to Rankiteo, SonicWall is not listed as GDPR compliant.
Does SonicWall have PCI DSS certification ?
According to Rankiteo, SonicWall does not currently maintain PCI DSS compliance.
Does SonicWall comply with HIPAA ?
According to Rankiteo, SonicWall is not compliant with HIPAA regulations.
Does SonicWall have ISO 27001 certification ?
According to Rankiteo,SonicWall is not certified under ISO 27001, indicating the absence of a formally recognized information security management framework.
Industry Classification of SonicWall
SonicWall operates primarily in the Computer and Network Security industry.
Number of Employees at SonicWall
SonicWall employs approximately 1,993 people worldwide.
Subsidiaries Owned by SonicWall
SonicWall presently has no subsidiaries across any sectors.
SonicWall’s LinkedIn Followers
SonicWall’s official LinkedIn profile has approximately 97,611 followers.
NAICS Classification of SonicWall
SonicWall is classified under the NAICS code 541514, which corresponds to Others.
SonicWall’s Presence on Crunchbase
No, SonicWall does not have a profile on Crunchbase.
SonicWall’s Presence on LinkedIn
Yes, SonicWall maintains an official LinkedIn profile, which is actively utilized for branding and talent engagement, which can be accessed here: https://www.linkedin.com/company/SonicWall.
Cybersecurity Incidents Involving SonicWall
As of November 29, 2025, Rankiteo reports that SonicWall has experienced 18 cybersecurity incidents.
Number of Peer and Competitor Companies
SonicWall has an estimated 2,799 peer or competitor companies worldwide.
What types of cybersecurity incidents have occurred at SonicWall ?
Incident Types: The types of cybersecurity incidents that have occurred include Vulnerability, Breach, Cyber Attack and Ransomware.
What was the total financial impact of these incidents on SonicWall ?
Total Financial Loss: The total financial loss from these incidents is estimated to be $16.02 million.
How does SonicWall detect and respond to cybersecurity incidents ?
Detection and Response: The company detects and responds to cybersecurity incidents through an communication strategy with updated security advisory and revised cvss score, and third party assistance with google threat intelligence group (gtig), mandiant, sonicwall’s product security incident response team (psirt), and containment measures with disable sonicwall ssl vpn service, and remediation measures with enable botnet protection, remediation measures with enforce mfa on all remote access accounts, remediation measures with practice good password hygiene, remediation measures with remove inactive or unused local user accounts, remediation measures with block vpn authentication attempts from specific asns, and and third party assistance with rapid7, third party assistance with threatlocker, third party assistance with arctic wolf, and containment measures with patching cve-2024-40766, containment measures with credential rotation, containment measures with upgrading to sonicos 7.3.0, and remediation measures with enforcing mfa for sonicwall services, remediation measures with restricting virtual office portal access to internal networks, remediation measures with disabling default ldap group configurations, and communication strategy with sonicwall public advisory (snlwid-2024-0015), communication strategy with rapid7 customer notifications, communication strategy with media alerts via the register, and incident response plan activated with recommended (not specified per victim), and third party assistance with arctic wolf (research), third party assistance with rapid7 (research), and containment measures with reset all sonicwall credentials (ssl vpn, otp mfa secrets, ldap sync accounts), containment measures with block logins from vps hosting providers, containment measures with disable virtual office portal if unused, and remediation measures with patch cve-2024-40766 (if unpatched), remediation measures with rotate all credentials with ssl vpn access, remediation measures with review ldap group mappings, remediation measures with implement network segmentation, and recovery measures with restore from offline backups (if available), recovery measures with rebuild domain controllers, recovery measures with reimage compromised systems, and network segmentation with recommended, and enhanced monitoring with anomalous smb activity (impacket), enhanced monitoring with ldap discovery activity, enhanced monitoring with execution of network scanning/archival tools (winrar, rclone), enhanced monitoring with logins from vps providers, and and third party assistance with cybersecurity experts, and and containment measures with blocked attackers' access to mysonicwall backups, and remediation measures with customers urged to reset credentials, remediation measures with import new preference files (disrupts vpns, totp, and user access), remediation measures with manual credential reset for customers unable to import new files, remediation measures with reconfiguration of vpn pre-shared keys, and recovery measures with guidance provided for manual remediation if new preference files cannot be imported, and communication strategy with public advisory issued (2025-09-18), communication strategy with customers notified via mysonicwall accounts (flagged serial numbers for affected devices), communication strategy with detailed remediation steps provided, and and third party assistance with independent investigation, third party assistance with external forensics review, and containment measures with disabled cloud backup service, containment measures with deleted compromised backups, and remediation measures with hardened infrastructure, remediation measures with additional logging, remediation measures with stronger authentication controls, and recovery measures with customers advised to recreate backups locally, and communication strategy with public disclosure updates, communication strategy with customer advisories to rotate credentials and delete backups, and and and containment measures with urged customers to delete existing cloud backups, containment measures with encouraged credential rotation and secret rotation, containment measures with recommended recreating backups locally, and remediation measures with released tools to assist with device assessment and remediation, and communication strategy with public notification via advisory, communication strategy with direct notification to impacted partners and customers, and and third party assistance with mandiant, and containment measures with disclosure of full scope, containment measures with urgent customer advisories, and remediation measures with credential resets, remediation measures with encryption key regeneration, remediation measures with firmware updates, remediation measures with anomaly monitoring, and recovery measures with forensic audits recommended, recovery measures with configuration reviews, and communication strategy with public advisory (october 8), communication strategy with collaboration with cybersecurity media (dark reading, the register, etc.), and enhanced monitoring with recommended for all customers, and and third party assistance with huntress security researchers, and containment measures with restrict wan management access, containment measures with disable http/s, ssh, and ssl vpn services, containment measures with reset all credentials (local admin, vpn keys, ldap, snmp, api secrets), containment measures with enable enhanced logging, and remediation measures with gradual service restoration post-credential reset, remediation measures with enforce multi-factor authentication (mfa) for all admin/remote users, remediation measures with limit management privileges, remediation measures with monitor for suspicious logins/configuration changes, and recovery measures with continuous monitoring, recovery measures with configuration audits, and communication strategy with sonicwall advisory via mysonicwall.com, communication strategy with urgent customer notifications, communication strategy with collaboration with security partners (e.g., huntress), and and incident response plan activated with yes (by sonicwall and affected organizations), and third party assistance with huntress security researchers, third party assistance with partner collaborations, and containment measures with restrict wan management access, containment measures with disable http/s, ssh, and ssl vpn services temporarily, containment measures with reset all credentials (local admin, vpn pre-shared keys, ldap, snmp, api/ddns secrets), containment measures with enable enhanced logging for suspicious activity, and remediation measures with gradual service restoration post-credential reset, remediation measures with enforce multi-factor authentication (mfa) for all admin/remote users, remediation measures with limit management privileges, remediation measures with continuous monitoring for anomalies, and communication strategy with sonicwall advisory via mysonicwall.com, communication strategy with urgent customer notifications, communication strategy with public disclosure (via huntress and security media), and enhanced monitoring with mandated for all affected systems, and and third party assistance with mandiant (incident response investigation), and containment measures with isolation of compromised cloud environment, containment measures with api access restrictions, and remediation measures with customer advisory to reset credentials (mysonicwall accounts, ldap/radius/tacacs+, vpn secrets), and communication strategy with public disclosure (2023-09-17), communication strategy with update on investigation completion (2023-10-09), communication strategy with assurance of product safety, and incident response plan activated with likely (beazley insurance clients), and third party assistance with beazley security labs, third party assistance with cybersecurity vendors (e.g., sonicwall, microsoft), and containment measures with temporary mitigations for zero-days, containment measures with network access lockdowns, containment measures with credential rotation (for vpns), and remediation measures with patch management for zero-days (cve-2025-*), remediation measures with mfa enforcement for vpns, remediation measures with access control hardening (lockout policies), and communication strategy with beazley security advisories, communication strategy with vendor security bulletins (e.g., sonicwall, microsoft), and network segmentation with recommended (for critically vulnerable devices), and enhanced monitoring with recommended (for zero-day exploits), and incident response plan activated with yes (beazley security incident response), and third party assistance with beazley security (insurance/cybersecurity arm), and containment measures with mfa enforcement for remote access, containment measures with dark web monitoring for leaked credentials, containment measures with patching critical vulnerabilities (cisco/citrix), containment measures with compensating controls for mfa-exempt accounts, and remediation measures with credential rotation for compromised accounts, remediation measures with lockout policy enhancements (sonicwall), remediation measures with vpn/rdp hardening, and communication strategy with public report by beazley security, and enhanced monitoring with dark web monitoring for credentials..
Incident Details
Can you provide details on each incident ?
Title: 2024 Cyber Attack Trends Reported by SonicWall
Description: A report by SonicWall highlights a significant increase in cyberattacks on organizations ranging from 100 to 5,000 users, with 57% experiencing at least one attack and an average financial cost of $5.34 million.
Type: Multiple
Title: Widespread Cyber Threats Across SMBs
Description: Over the past year, organizations ranging from small to medium businesses with 100-5,000 users have faced a significant cyber threat landscape, with 57% experiencing at least one cyberattack. These incidents have resulted in substantial financial losses, averaging $5.34 million per attack. This figure underscores the grave financial implications cyber threats pose, compelling businesses to reassess their cybersecurity measures.
Type: Cyberattack
Title: SonicWall Cyber Threat Report: Escalating Cyberattacks
Description: The SonicWall Cyber Threat Report highlights the escalating costs and frequencies of cyberattacks on organizations, underlining a worrying trend that affects businesses globally. In the last year, organizations with a relatively modest size of 100-5,000 users have not been spared, with more than half experiencing one or several cyber incidents. These unwelcome events have been financially damaging, with the average cost soaring to $5.34 million. Such a figure represents not just a direct financial burden but also unleashes a series of indirect consequences, including but not limited to, tarnished reputations, operational disruptions, and potential regulatory penalties. These findings, drawn from an exhaustive collection of real-world data and threat intelligence, underscore the critical need for heightened cybersecurity vigilance. A proactive and comprehensive approach to cybersecurity, backed by real-time threat intelligence and robust defense mechanisms, is imperative for organizations seeking to navigate the digital landscape securely and mitigate the risks posed by an ever-evolving threat landscape.
Type: Cyberattack
Title: SonicWall Ransomware Attacks via VPN Vulnerability
Description: SonicWall, a cybersecurity company, experienced breaches into enterprise networks through Fog and Akira ransomware exploiting the VPN vulnerability CVE-2024-40766. The critical flaw led to unauthorized access and potential firewall crashes, impacting Gen 5, 6, and early Gen 7 devices. Despite patches being released, ongoing intrusions via unpatched SSL VPNs have led to a rise in ransomware attacks since August 2024. The vulnerability allowed a rapid pivot from initial access to ransom activities, with a timeline as short as 1.5 hours. The targeted ransomware attacks demonstrate the urgency of applying security updates to prevent severe repercussions, including loss of resources and compromised data.
Type: Ransomware
Attack Vector: VPN vulnerability
Vulnerability Exploited: CVE-2024-40766
Motivation: Financial gain through ransomware attacks
Title: SonicWall Cyber Attack
Description: SonicWall has experienced a cyber attack due to a remote code execution vulnerability affecting its Secure Mobile Access (SMA) appliances. These flaws impacted various SMA models and were exploited despite being patched four years ago. The flaw allowed remote threat actors to inject arbitrary commands and execute arbitrary code. This has been under active exploitation since at least January 2025 as confirmed by cybersecurity company Arctic Wolf and federal agencies. As a response to the attack, SonicWall has updated the security advisory and revised the CVSS score based on the newfound impacts.
Type: Remote Code Execution
Attack Vector: Exploitation of a remote code execution vulnerability
Vulnerability Exploited: Remote code execution vulnerability in Secure Mobile Access (SMA) appliances
Title: OVERSTEP Malware Targeting SonicWall SMA Appliances
Description: A threat actor has been deploying a previously unseen malware called OVERSTEP that modifies the boot process of fully-patched but no longer supported SonicWall Secure Mobile Access appliances. The backdoor is a user-mode rootkit that allows hackers to hide malicious components, maintain persistent access on the device, and steal sensitive credentials.
Type: Malware (Rootkit)
Attack Vector: Unknown, zero-day remote code execution vulnerability
Vulnerability Exploited: CVE-2021-20038CVE-2024-38475CVE-2021-20035CVE-2021-20039CVE-2025-32819
Threat Actor: UNC6148
Motivation: Data theft and extortion
Title: Zero-Day Vulnerability in SonicWall Firewall Devices Exploited by Akira Ransomware Group
Description: A suspected zero-day vulnerability in SonicWall firewall devices that the Akira ransomware group is actively exploiting. The flaw allows attackers to gain initial access to corporate networks through SonicWall’s SSL VPN feature, leading to subsequent ransomware deployment.
Date Detected: 2025-07-15
Type: Ransomware
Attack Vector: Zero-Day ExploitCompromised Credentials
Vulnerability Exploited: Zero-Day Vulnerability in SonicWall SSL VPN
Threat Actor: Akira Ransomware Group
Motivation: Financial Gain
Title: Akira Ransomware Exploits Critical SonicWall Vulnerability (CVE-2024-40766) in Ongoing Attacks
Description: Affiliates of the Akira ransomware gang are exploiting a critical SonicWall vulnerability (CVE-2024-40766, CVSS 9.8) originally disclosed in August 2024, along with SSLVPN misconfigurations and default LDAP group settings. The attacks target unpatched SonicWall devices, with over 438,000 devices still publicly accessible. Akira and Fog ransomware groups have used this flaw since late 2024, gaining initial access and encrypting systems in under 10 hours in some cases. SonicWall confirmed fewer than 40 cases as of early August 2025, linked to legacy credential use during firewall migrations. Rapid7 and other security firms warn of widespread industry impact, urging patches, MFA enforcement, and Virtual Office portal restrictions.
Date Detected: 2024-09-01
Date Publicly Disclosed: 2024-08-01
Type: ransomware
Attack Vector: exploitation of CVE-2024-40766 (improper access control)SSLVPN misconfigurationsdefault LDAP group over-provisioningVirtual Office portal public accesslegacy credential abuse
Vulnerability Exploited: CVE-2024-40766 (SonicWall improper access control, CVSS 9.8)SonicWall SSLVPN misconfigurationsdefault LDAP group configurationsVirtual Office portal public access
Threat Actor: Akira ransomware gangFog ransomware gang
Motivation: financial gain (ransomware)
Title: Akira Ransomware Attacks Exploiting SonicWall SSL VPN Vulnerability (CVE-2024-40766)
Description: Akira ransomware affiliates are exploiting stolen SonicWall SSL VPN credentials (including CVE-2024-40766) to breach organizations in under four hours. Attackers bypass MFA, conduct lateral movement via SMB/RDP, exfiltrate data using tools like WinRAR/rclone, and deploy Akira ransomware. Initial access leverages credentials harvested months prior from unpatched or misconfigured SonicWall devices. Opportunistic attacks span multiple industries, with rapid execution requiring urgent detection/response measures.
Date Detected: July 2025
Date Publicly Disclosed: 2025-07
Type: ransomware
Attack Vector: exploitation of public-facing application (CVE-2024-40766)valid accounts (stolen SSL VPN credentials)misconfigured SonicWall SSLVPN Default Users GroupOTP MFA bypass via Virtual Office Portal
Threat Actor: Name: Akira ransomware affiliatesAttribution Confidence: HighMotivation: ['financial gain', 'opportunistic']Sophistication Level: Moderate to High
Motivation: financial gain (ransomware)data theft (double extortion)
Title: SonicWall MySonicWall Backup Exposure Incident
Description: SonicWall detected suspicious activity targeting its cloud backup service for firewalls, confirming a security incident where threat actors accessed backup firewall preference files for fewer than 5% of its firewall install base. While credentials in the files were encrypted, the exposed information could facilitate potential exploitation of related firewalls. No files were leaked, but SonicWall urged customers to reset credentials and import new preference files to mitigate risks. The incident was not ransomware-related but involved brute force attacks aimed at accessing preference files for potential future misuse.
Date Detected: 2025-09-18T00:00:00Z
Date Publicly Disclosed: 2025-09-18T00:00:00Z
Type: Data Exposure
Attack Vector: Brute Force AttackCloud Storage Exploitation
Vulnerability Exploited: Exposed backup firewall preference files in MySonicWall cloud service
Motivation: Data TheftPotential Future Exploitation
Title: SonicWall Cloud Backup Service Data Breach
Description: SonicWall admitted that all customers using its MySonicWall cloud backup feature were affected by a cybersecurity incident first disclosed in mid-September 2023. Attackers accessed firewall configuration backup files, which include sensitive network settings, policies, and infrastructure details. Initially, SonicWall claimed only 5% of users were impacted, but an independent investigation later confirmed that 100% of cloud backup users were affected. The company has since urged customers to delete backups, rotate credentials, and recreate backups locally. SonicWall has hardened its infrastructure and implemented stronger authentication controls but has not disclosed how initial access was gained.
Date Detected: 2023-09-17
Date Publicly Disclosed: 2023-09-17
Type: Data Breach
Attack Vector: Cloud Storage ExploitationUnauthorized Access to Backup Archives
Motivation: Data ExfiltrationPotential Follow-on Attacks
Title: SonicWall Cloud Backup Breach Exposes Firewall Configuration Files
Description: Attackers brute-forced SonicWall’s MySonicWall cloud service, exposing firewall configuration files of global customers. The files included network rules, access policies, VPN configurations, and service credentials (LDAP, RADIUS, SNMP), as well as admin usernames and passwords if stored in the config. SonicWall initially underestimated the scale, later revealing that all customers using the MySonicWall cloud backup feature were affected. The company urged users to delete backups, rotate secrets, and recreate configurations locally to mitigate risks of credential leaks and targeted network intrusions.
Date Detected: 2025-09-15
Date Publicly Disclosed: 2025-09-15
Type: Data Breach
Attack Vector: Brute Force Attack
Vulnerability Exploited: Weak Authentication Mechanisms in MySonicWall Cloud Service
Threat Actor: Unnamed Threat Actors
Motivation: Credential TheftTargeted Network IntrusionsInsider Knowledge for Future Attacks
Title: SonicWall Cloud Backup Service Breach Exposes All Customer Firewall Configurations
Description: Cybersecurity firm SonicWall confirmed that hackers accessed firewall configuration backup files for every customer using its cloud backup service (MySonicWall portal). The breach, initially downplayed as limited, was later revealed to affect all users after an internal investigation assisted by Mandiant. Attackers brute-forced their way into the system, exfiltrating encrypted credentials, network settings, firewall rules, VPN configurations, and access controls. While SonicWall claims the data is encrypted, experts warn it could be decrypted or leveraged for targeted exploits. Customers were urged to reset credentials, regenerate encryption keys, update firmware, and monitor for anomalies. The incident highlights risks in cloud-based backup services and supply-chain vulnerabilities, with potential compliance implications under GDPR and NIST.
Date Detected: 2023-09-15
Date Publicly Disclosed: 2023-09-15
Type: Data Breach
Attack Vector: Brute Force AttackExploitation of Cloud Backup Infrastructure Weaknesses
Vulnerability Exploited: Weak Authentication MechanismsLack of Rate-LimitingInsufficient Anomaly Detection
Motivation: Data ExfiltrationPotential Future ExploitsNetwork Mapping
Title: Coordinated Cyber Intrusions Targeting SonicWall SSL VPN Devices
Description: A coordinated wave of cyber intrusions has put organizations worldwide on high alert after Huntress security researchers discovered a rapid-fire attack campaign targeting SonicWall SSL VPN devices. Over 100 accounts have been compromised since early October, with attackers leveraging valid, exposed credentials rather than brute-force methods. The campaign originated from a single IP (202.155.8.73) and involved rapid, surgical attacks, including reconnaissance, credential validation, and network scans. The breach aligns with SonicWall’s disclosure of unauthorized access to firewall configuration backup files, raising concerns about widespread exploitation potential.
Date Detected: 2023-10-04
Type: Unauthorized Access
Attack Vector: Exposed CredentialsSSL VPN ExploitationFirewall Configuration Backup Leak
Vulnerability Exploited: SonicWall SSL VPN Vulnerability (Credentials in Backup Files)Weak or Reused Credentials
Motivation: EspionageData TheftPotential Follow-on Attacks
Title: Coordinated Cyber Intrusions Targeting SonicWall SSL VPN Devices
Description: A coordinated wave of cyber intrusions has put organizations worldwide on high alert after Huntress security researchers discovered a rapid-fire attack campaign targeting SonicWall SSL VPN devices. More than 100 accounts have been compromised since early October, with attackers leveraging valid, exposed credentials rather than brute-force methods. The campaign demonstrates a high level of operational proficiency, with evidence suggesting a potential link to SonicWall’s recent disclosure of unauthorized access to firewall configuration backup files via the MySonicWall platform.
Date Detected: 2023-10-04
Type: Unauthorized Access
Attack Vector: Exposed CredentialsSSL VPN ExploitationFirewall Configuration Backup Leak
Vulnerability Exploited: SonicWall SSL VPN MisconfigurationWeak or Reused CredentialsExposed Firewall Configuration Backups (Encrypted but Sensitive)
Motivation: EspionageData TheftNetwork CompromisePotential Ransomware Preparation
Title: SonicWall Security Breach Exposing Firewall Configuration Backup Files
Description: SonicWall's investigation into the September 2023 security breach confirmed that state-sponsored hackers accessed customers' firewall configuration backup files stored in a specific cloud environment via an unauthorized API call. The exposed files contained sensitive credentials and tokens, potentially facilitating further exploitation of customer firewalls. The breach was isolated and did not impact SonicWall's products, firmware, systems, tools, source code, or customer networks. Customers were advised to reset multiple credentials, including MySonicWall account passwords, LDAP/RADIUS/TACACS+ server passwords, and VPN-related secrets. The incident was unrelated to concurrent Akira ransomware attacks targeting SonicWall VPN accounts.
Date Detected: 2023-09-17
Date Publicly Disclosed: 2023-09-17
Type: Data Breach
Attack Vector: API ExploitationCloud Storage Compromise
Vulnerability Exploited: Unauthorized API access to cloud backup files
Threat Actor: State-sponsored threat actor
Motivation: EspionageCredential Harvesting
Title: Q3 2025 Ransomware Surge and VPN Credential Exploits
Description: Ransomware attacks surged in Q3 2025, with Akira, Qilin, and INC Ransomware groups accounting for 65% of cases. Initial access was primarily achieved via compromised VPN credentials (48% of breaches), followed by external service exploits (23%). Akira targeted SonicWall SSLVPN appliances using credential stuffing attacks, exploiting weak access controls like absent MFA. The quarter also saw a 38% increase in zero-day vulnerability advisories, including critical flaws in Microsoft SharePoint, CrushFTP, Cisco ASA VPN, and Citrix NetScaler. Beazley emphasized the need for continuous vulnerability management and robust MFA policies.
Date Detected: 2025-07-01
Date Publicly Disclosed: 2025-10-01
Type: Ransomware
Attack Vector: Compromised VPN Credentials (48%)External Service Exploits (23%)Credential StuffingZero-Day Vulnerabilities
Vulnerability Exploited: Weak Access Controls (Absent MFA, Insufficient Lockout Policies) in SonicWall SSLVPNCVE-2025-53770 (Microsoft SharePoint 'ToolShell')CVE-2025-54309 (CrushFTP)CVE-2025-20333 & CVE-2025-20363 (Cisco ASA VPN)CVE-2025-7775 (Citrix NetScaler)
Threat Actor: Akira RansomwareQilin RansomwareINC RansomwareRhadamanthys Infostealer
Motivation: Financial Gain (Ransomware)Data Theft (Credential Harvesting)Cybercrime-as-a-Service (Infostealers)
Title: Rise in Ransomware Attacks Exploiting Compromised VPN Credentials in Q3 2024
Description: A report by Beazley Security highlights that nearly half (48%) of ransomware attacks in Q3 2024 abused compromised VPN credentials as the initial access vector. The Akira ransomware group was particularly active, exploiting SonicWall VPN vulnerabilities (including credential stuffing and brute force attacks) due to weak MFA policies and unpatched systems. Other ransomware groups like Qilin and INC also leveraged VPN/RDP credential compromises, while vulnerabilities in Cisco ASA, Citrix NetScaler, and SEO poisoning (e.g., Rhysida ransomware) were additional attack vectors. The report emphasizes the critical need for MFA, dark web monitoring for leaked credentials, and compensating controls for MFA-exempt accounts.
Date Publicly Disclosed: 2024-10-01T00:00:00Z
Type: Ransomware
Attack Vector: Compromised VPN Credentials (48%)External Service Exploitation (24%)Remote Desktop Service (RDS) Credential Compromise (6%)Supply Chain Attacks (6%)Social Engineering (6%)SEO Poisoning (Rhysida)Malicious AdvertisementsPhishing (Qilin, INC)Exploitation of Enterprise Appliances (INC)Credential Stuffing (Akira)Brute Force Attacks (Akira, Qilin)
Vulnerability Exploited: SonicWall SSLVPN (Weak MFA/Access Controls)CVE-2025-20333 (Cisco ASA VPN)CVE-2025-20363 (Cisco ASA VPN)CVE-2025-20352 (Cisco IOS SNMP Flaw)CVE-2025-7775 (Citrix NetScaler)CVE-2025-5777 (Citrix Bleed 2)
Threat Actor: AkiraQilinINC RansomwareRhysidaUnnamed Sophisticated Threat Actor (Cisco Exploits)
Motivation: Financial Gain (Ransomware)Data TheftUnauthorized Access
What are the most common types of attacks the company has faced ?
Common Attack Types: The most common types of attacks the company has faced is Ransomware.
How does the company identify the attack vectors used in incidents ?
Identification of Attack Vectors: The company identifies the attack vectors used in incidents through VPN vulnerability, Unknown, SonicWall SSL VPN, CVE-2024-40766 exploitationSSLVPN misconfigurationslegacy credentialsVirtual Office portal public access, SonicWall SSL VPN (via CVE-2024-40766 or stolen credentials)Misconfigured SSLVPN Default Users GroupVirtual Office Portal (OTP MFA bypass), MySonicWall cloud backup service, Unauthorized access to cloud storage environment, MySonicWall Cloud Service (via brute-force attack), MySonicWall PortalCloud Backup Service, SonicWall SSL VPN DevicesExposed Credentials in Backup Files, SonicWall SSL VPN (Via Exposed Credentials)Potential Exploitation of Leaked Firewall Backups, Unauthorized API call to cloud backup environment, Compromised VPN Credentials (48%)External Service Exploits (23%) and VPN Credentials (48%)RDP (6%)External Services (24%)SEO Poisoning (Rhysida).
Impact of the Incidents
What was the impact of each incident ?
Incident : Multiple SON705050724
Financial Loss: $5.34 million
Incident : Cyberattack SON105050824
Financial Loss: $5.34 million per attack
Incident : Cyberattack SON407050824
Financial Loss: $5.34 million
Operational Impact: Operational disruptions
Brand Reputation Impact: Tarnished reputations
Legal Liabilities: Potential regulatory penalties
Incident : Ransomware SON000103024
Systems Affected: Gen 5, 6, and early Gen 7 devices
Incident : Remote Code Execution SON502042125
Systems Affected: Various SMA models
Incident : Malware (Rootkit) SON417071725
Data Compromised: Sensitive credentials, persist.db database, certificate files
Systems Affected: SonicWall SMA 100 Series devices
Incident : Ransomware SON517080325
Systems Affected: SonicWall Firewall Devices
Incident : ransomware SON2902029091125
Systems Affected: SonicWall firewall devices (Gen 6/Gen 7), SSLVPN services, Virtual Office portal
Downtime: <10 hours (encryption timeframe in some cases)
Operational Impact: potential widespread disruption (438,000+ devices exposed)
Brand Reputation Impact: high (publicized vulnerability exploitation)
Incident : ransomware SON0492204092925
Data Compromised: Yes (exfiltrated prior to encryption)
Systems Affected: Domain Controllersvirtual machine storagebackup systemsendpoints with RMM/EDR tools
Operational Impact: system encryptiondata exfiltrationdisruption of backup/recovery processes
Brand Reputation Impact: High (public disclosure of breaches)
Identity Theft Risk: Potential (PII likely exfiltrated)
Incident : Data Exposure SON1091810100325
Data Compromised: Firewall preference files (encrypted credentials and configuration details)
Systems Affected: SonicWall Firewalls with MySonicWall cloud backups enabled
Downtime: Potential downtime during remediation (VPN reconfiguration, TOTP reset, and firewall reboot)
Operational Impact: Disruption of IPSec VPNsTOTP bindings resetUser access reconfigurationMaintenance window requirements for remediation
Brand Reputation Impact: Moderate (urgent advisory issued, but no data leakage confirmed)
Identity Theft Risk: Low (credentials were encrypted, but exposure increases risk)
Incident : Data Breach SON2392523100925
Data Compromised: Firewall configuration files, Network policies, User/group/domain settings, Dns and log settings, Certificates
Systems Affected: MySonicWall Cloud Backup Service
Operational Impact: Customers advised to delete backups, rotate credentials, and recreate backups locally
Brand Reputation Impact: Loss of customer trust due to revised impact scope (from 5% to 100%)
Incident : Data Breach SON2892228101025
Data Compromised: Firewall configuration files (network rules, access policies, vpn configurations), Service credentials (ldap, radius, snmp), Admin usernames and passwords (if stored in config)
Systems Affected: MySonicWall Cloud Backup Service
Operational Impact: Increased Risk of Targeted Attacks Due to Exposed Configuration DetailsNeed for Customers to Delete Backups, Rotate Secrets, and Recreate Configurations Locally
Brand Reputation Impact: Potential Loss of Trust Due to Underestimation of Incident Scale and Exposure of Sensitive Configuration Data
Identity Theft Risk: ['High (Due to Potential Exposure of Admin Credentials and Service Secrets)']
Incident : Data Breach SON5492754101225
Data Compromised: Firewall configuration backups, Encrypted credentials, Network settings, Vpn configurations, Access controls
Systems Affected: MySonicWall PortalCloud Backup Service
Operational Impact: Forensic Audits Required for All CustomersDisruption of OperationsUrgent Credential Resets
Brand Reputation Impact: Heightened ScrutinyLoss of TrustComparisons to SolarWinds Breach
Legal Liabilities: Potential Regulatory ProbesPossible LawsuitsCompliance Risks (GDPR, NIST)
Identity Theft Risk: ['Low (Data Encrypted but Potentially Decryptable)']
Incident : Unauthorized Access SON1132511101325
Data Compromised: Firewall configuration data, Credentials (local windows accounts, vpn pre-shared keys, ldap, snmp, api secrets)
Systems Affected: SonicWall SSL VPN DevicesCompromised Customer Networks
Operational Impact: Network ScansUnauthorized Access AttemptsPotential Lateral Movement
Brand Reputation Impact: High (Due to Widespread Compromises and Credential Exposure)
Identity Theft Risk: ['High (If Credentials Are Abused)']
Incident : Unauthorized Access SON1232512101325
Data Compromised: Firewall configuration data, Credentials (potential), Network access
Systems Affected: SonicWall SSL VPN DevicesLocal Windows Accounts (Attempted Access)Firewall Configurations
Operational Impact: Network Scans ConductedUnauthorized Access AttemptsPotential Lateral Movement
Brand Reputation Impact: High (Due to Widespread Advisory and Urgent Remediation)Loss of Trust in SonicWall Security Products
Identity Theft Risk: ['High (If Credentials Compromised)', 'Potential for Further Exploitation']
Incident : Data Breach SON0592205110525
Data Compromised: Firewall configuration backup files, Access credentials, Tokens, Ldap/radius/tacacs+ passwords, Vpn shared secrets
Systems Affected: MySonicWall cloud backup service
Operational Impact: None (isolated to backup files; no disruption to products or networks)
Brand Reputation Impact: Potential reputational risk due to exposure of sensitive customer credentials
Identity Theft Risk: High (exposed credentials could facilitate further attacks)
Incident : Ransomware SON3832338111925
Data Compromised: Vpn credentials, Corporate data (via ransomware), Potential pii (via infostealers)
Systems Affected: SonicWall SSLVPN AppliancesMicrosoft SharePointCrushFTP ServersCisco ASA VPNCitrix NetScaler
Operational Impact: Disrupted Business Operations (Ransomware)Increased Incident Response WorkloadPotential Supply Chain Risks
Brand Reputation Impact: Erosion of Trust in Affected VPN/Software VendorsReputational Damage to Victim Organizations
Identity Theft Risk: ['High (via Stolen Credentials)', 'Potential Follow-on Attacks']
Incident : Ransomware SON5792057112025
Data Compromised: Sensitive configuration backups (sonicwall cloud breach), Potential pii/enterprise data (via ransomware)
Systems Affected: SonicWall VPN DevicesCisco ASA VPN AppliancesCitrix NetScaler GatewaysEnterprise Endpoints (via SEO Poisoning)
Operational Impact: Disrupted Remote AccessPotential Data Encryption (Ransomware)Supply Chain Risks
Brand Reputation Impact: Erosion of Trust in VPN/RDP SecurityReputational Damage to SonicWall/Cisco/Citrix
Identity Theft Risk: ['High (Due to Credential Theft)']
What is the average financial loss per incident ?
Average Financial Loss: The average financial loss per incident is $890.00 thousand.
What types of data are most commonly compromised in incidents ?
Commonly Compromised Data Types: The types of data most commonly compromised in incidents are Sensitive credentials, persist.db database, certificate files, Sensitive Corporate Data, Potentially Pii, Virtual Machine Storage, Backup Data, , Firewall Preference Files (Configuration Details And Encrypted Credentials), , Firewall Configuration Files, Network Settings, Policies, Certificates, , Firewall Configuration Files, Network Rules, Access Policies, Vpn Configurations, Service Credentials (Ldap, Radius, Snmp), Admin Usernames And Passwords (If Stored In Config), , Firewall Configuration Backups, Encrypted Credentials, Network Topology Data, Vpn Settings, Access Control Rules, , Firewall Configuration Backups, Encrypted Credentials, Network Access Credentials, , Firewall Configuration Backups (Encrypted), Credentials (Potential), Network Topology Data, , Firewall Configuration Files, Authentication Credentials, Encryption Tokens, , Vpn Credentials, Corporate Data (Ransomware), Potential Pii (Infostealers), , Configuration Backups (Sonicwall Cloud), Potential Pii/Enterprise Data (Ransomware) and .
Which entities were affected by each incident ?
Incident : Ransomware SON000103024
Entity Name: SonicWall
Entity Type: Cybersecurity Company
Industry: Technology
Incident : Remote Code Execution SON502042125
Entity Name: SonicWall
Entity Type: Company
Industry: Cybersecurity
Incident : Malware (Rootkit) SON417071725
Entity Type: Organization
Incident : Ransomware SON517080325
Entity Name: SonicWall
Entity Type: Technology Company
Industry: Cybersecurity
Incident : ransomware SON2902029091125
Entity Name: SonicWall customers (hundreds of Rapid7 clients affected)
Entity Type: private organizations, enterprises
Location: global
Incident : ransomware SON2902029091125
Entity Name: At least 100 organizations (2024-09 to 2024-12)
Entity Type: private organizations, enterprises
Location: global
Incident : ransomware SON2902029091125
Entity Name: <40 confirmed cases (as of early August 2025)
Entity Type: private organizations, enterprises
Location: global
Incident : ransomware SON0492204092925
Entity Type: private organizations, public sector (potential)
Industry: Multiple (opportunistic targeting)
Location: Global
Size: Varies (SMB to enterprise)
Incident : Data Exposure SON1091810100325
Entity Name: SonicWall
Entity Type: Private Company
Industry: Cybersecurity
Location: Global (HQ in Milpitas, California, USA)
Customers Affected: Fewer than 5% of SonicWall firewall install base
Incident : Data Breach SON2392523100925
Entity Name: SonicWall
Entity Type: Network Security Vendor
Industry: Cybersecurity
Location: California, USA
Customers Affected: All customers using MySonicWall cloud backup feature
Incident : Data Breach SON2892228101025
Entity Name: SonicWall
Entity Type: Cybersecurity Company
Industry: Network Security
Location: Global
Size: ~500,000 customers (not all using firewall/cloud backup services)
Customers Affected: All customers using MySonicWall cloud backup feature (initially claimed <5%, later revealed to be all users of the feature)
Incident : Data Breach SON5492754101225
Entity Name: SonicWall
Entity Type: Cybersecurity Firm
Industry: Technology/Network Security
Location: Global (HQ: San Jose, California, USA)
Size: Thousands of Enterprise Customers
Customers Affected: 100% of MySonicWall Cloud Backup Service Users
Incident : Unauthorized Access SON1132511101325
Entity Name: SonicWall (Primary Vendor)
Entity Type: Cybersecurity Company
Industry: Network Security
Location: Global
Customers Affected: 100+ (Across 16+ Customer Environments)
Incident : Unauthorized Access SON1132511101325
Entity Name: SonicWall Customers (Multiple Organizations)
Entity Type: Enterprises, Government Agencies, SMBs
Industry: Various (Global)
Location: Worldwide
Incident : Unauthorized Access SON1232512101325
Entity Name: SonicWall (Primary Vendor)
Entity Type: Cybersecurity Company
Industry: Network Security
Location: Global
Customers Affected: 100+ (Across 16+ Customer Environments)
Incident : Unauthorized Access SON1232512101325
Entity Name: SonicWall Customers (Using SSL VPN and MySonicWall Cloud Backup)
Entity Type: Enterprises, Government Agencies, SMBs
Industry: Multiple (Global)
Location: Worldwide
Customers Affected: Potentially All Customers Using MySonicWall Cloud Backup
Incident : Data Breach SON0592205110525
Entity Name: SonicWall
Entity Type: Network Security Vendor
Industry: Cybersecurity
Location: United States
Customers Affected: All customers using SonicWall’s cloud backup service for firewall configuration files
Incident : Ransomware SON3832338111925
Entity Name: SonicWall
Entity Type: Technology Vendor
Industry: Cybersecurity
Location: Global
Incident : Ransomware SON3832338111925
Entity Name: Microsoft (SharePoint)
Entity Type: Technology Vendor
Industry: Software
Location: Global
Incident : Ransomware SON3832338111925
Entity Name: CrushFTP
Entity Type: Software Vendor
Industry: File Transfer
Location: Global
Incident : Ransomware SON3832338111925
Entity Name: Cisco (ASA VPN)
Entity Type: Technology Vendor
Industry: Networking
Location: Global
Incident : Ransomware SON3832338111925
Entity Name: Citrix (NetScaler)
Entity Type: Technology Vendor
Industry: Virtualization/Networking
Location: Global
Incident : Ransomware SON3832338111925
Entity Name: Unspecified Organizations (Ransomware Victims)
Entity Type: Corporate, Government, Healthcare, Education
Industry: Multiple
Location: Global
Incident : Ransomware SON5792057112025
Entity Name: SonicWall
Entity Type: Technology Vendor
Industry: Cybersecurity
Location: Global
Customers Affected: Multiple (via Cloud Service Breach)
Incident : Ransomware SON5792057112025
Entity Name: Cisco
Entity Type: Technology Vendor
Industry: Networking
Location: Global
Incident : Ransomware SON5792057112025
Entity Name: Citrix
Entity Type: Technology Vendor
Industry: Virtualization/Networking
Location: Global
Incident : Ransomware SON5792057112025
Entity Name: Unnamed Victims of Akira/Qilin/INC Ransomware
Entity Type: Enterprises, Organizations
Industry: Multiple
Location: Global
Response to the Incidents
What measures were taken in response to each incident ?
Incident : Remote Code Execution SON502042125
Communication Strategy: Updated security advisory and revised CVSS score
Incident : Malware (Rootkit) SON417071725
Third Party Assistance: Google Threat Intelligence Group (GTIG), Mandiant, SonicWall’s Product Security Incident Response Team (PSIRT)
Incident : Ransomware SON517080325
Containment Measures: Disable SonicWall SSL VPN service
Remediation Measures: Enable Botnet ProtectionEnforce MFA on all remote access accountsPractice good password hygieneRemove inactive or unused local user accountsBlock VPN authentication attempts from specific ASNs
Incident : ransomware SON2902029091125
Incident Response Plan Activated: True
Third Party Assistance: Rapid7, Threatlocker, Arctic Wolf.
Containment Measures: patching CVE-2024-40766credential rotationupgrading to SonicOS 7.3.0
Remediation Measures: enforcing MFA for SonicWall servicesrestricting Virtual Office portal access to internal networksdisabling default LDAP group configurations
Communication Strategy: SonicWall public advisory (SNLWID-2024-0015)Rapid7 customer notificationsmedia alerts via The Register
Incident : ransomware SON0492204092925
Incident Response Plan Activated: Recommended (not specified per victim)
Third Party Assistance: Arctic Wolf (Research), Rapid7 (Research).
Containment Measures: Reset all SonicWall credentials (SSL VPN, OTP MFA secrets, LDAP sync accounts)Block logins from VPS hosting providersDisable Virtual Office Portal if unused
Remediation Measures: Patch CVE-2024-40766 (if unpatched)Rotate all credentials with SSL VPN accessReview LDAP group mappingsImplement network segmentation
Recovery Measures: Restore from offline backups (if available)Rebuild Domain ControllersReimage compromised systems
Network Segmentation: Recommended
Enhanced Monitoring: Anomalous SMB activity (Impacket)LDAP discovery activityExecution of network scanning/archival tools (WinRAR, rclone)Logins from VPS providers
Incident : Data Exposure SON1091810100325
Incident Response Plan Activated: True
Third Party Assistance: Cybersecurity Experts.
Containment Measures: Blocked attackers' access to MySonicWall backups
Remediation Measures: Customers urged to reset credentialsImport new preference files (disrupts VPNs, TOTP, and user access)Manual credential reset for customers unable to import new filesReconfiguration of VPN pre-shared keys
Recovery Measures: Guidance provided for manual remediation if new preference files cannot be imported
Communication Strategy: Public advisory issued (2025-09-18)Customers notified via MySonicWall accounts (flagged serial numbers for affected devices)Detailed remediation steps provided
Incident : Data Breach SON2392523100925
Incident Response Plan Activated: True
Third Party Assistance: Independent Investigation, External Forensics Review.
Containment Measures: Disabled cloud backup serviceDeleted compromised backups
Remediation Measures: Hardened infrastructureAdditional loggingStronger authentication controls
Recovery Measures: Customers advised to recreate backups locally
Communication Strategy: Public disclosure updatesCustomer advisories to rotate credentials and delete backups
Incident : Data Breach SON2892228101025
Incident Response Plan Activated: True
Containment Measures: Urged customers to delete existing cloud backupsEncouraged credential rotation and secret rotationRecommended recreating backups locally
Remediation Measures: Released tools to assist with device assessment and remediation
Communication Strategy: Public notification via advisoryDirect notification to impacted partners and customers
Incident : Data Breach SON5492754101225
Incident Response Plan Activated: True
Third Party Assistance: Mandiant.
Containment Measures: Disclosure of Full ScopeUrgent Customer Advisories
Remediation Measures: Credential ResetsEncryption Key RegenerationFirmware UpdatesAnomaly Monitoring
Recovery Measures: Forensic Audits RecommendedConfiguration Reviews
Communication Strategy: Public Advisory (October 8)Collaboration with Cybersecurity Media (Dark Reading, The Register, etc.)
Enhanced Monitoring: Recommended for All Customers
Incident : Unauthorized Access SON1132511101325
Incident Response Plan Activated: True
Third Party Assistance: Huntress Security Researchers.
Containment Measures: Restrict WAN Management AccessDisable HTTP/S, SSH, and SSL VPN ServicesReset All Credentials (Local Admin, VPN Keys, LDAP, SNMP, API Secrets)Enable Enhanced Logging
Remediation Measures: Gradual Service Restoration Post-Credential ResetEnforce Multi-Factor Authentication (MFA) for All Admin/Remote UsersLimit Management PrivilegesMonitor for Suspicious Logins/Configuration Changes
Recovery Measures: Continuous MonitoringConfiguration Audits
Communication Strategy: SonicWall Advisory via MySonicWall.comUrgent Customer NotificationsCollaboration with Security Partners (e.g., Huntress)
Incident : Unauthorized Access SON1232512101325
Incident Response Plan Activated: Yes (By SonicWall and Affected Organizations)
Third Party Assistance: Huntress Security Researchers, Partner Collaborations.
Containment Measures: Restrict WAN Management AccessDisable HTTP/S, SSH, and SSL VPN Services TemporarilyReset All Credentials (Local Admin, VPN Pre-Shared Keys, LDAP, SNMP, API/DDNS Secrets)Enable Enhanced Logging for Suspicious Activity
Remediation Measures: Gradual Service Restoration Post-Credential ResetEnforce Multi-Factor Authentication (MFA) for All Admin/Remote UsersLimit Management PrivilegesContinuous Monitoring for Anomalies
Communication Strategy: SonicWall Advisory via MySonicWall.comUrgent Customer NotificationsPublic Disclosure (via Huntress and Security Media)
Enhanced Monitoring: Mandated for All Affected Systems
Incident : Data Breach SON0592205110525
Incident Response Plan Activated: True
Third Party Assistance: Mandiant (Incident Response Investigation).
Containment Measures: Isolation of compromised cloud environmentAPI access restrictions
Remediation Measures: Customer advisory to reset credentials (MySonicWall accounts, LDAP/RADIUS/TACACS+, VPN secrets)
Communication Strategy: Public disclosure (2023-09-17)Update on investigation completion (2023-10-09)Assurance of product safety
Incident : Ransomware SON3832338111925
Incident Response Plan Activated: Likely (Beazley Insurance Clients)
Third Party Assistance: Beazley Security Labs, Cybersecurity Vendors (E.G., Sonicwall, Microsoft).
Containment Measures: Temporary Mitigations for Zero-DaysNetwork Access LockdownsCredential Rotation (for VPNs)
Remediation Measures: Patch Management for Zero-Days (CVE-2025-*)MFA Enforcement for VPNsAccess Control Hardening (Lockout Policies)
Communication Strategy: Beazley Security AdvisoriesVendor Security Bulletins (e.g., SonicWall, Microsoft)
Network Segmentation: Recommended (for Critically Vulnerable Devices)
Enhanced Monitoring: Recommended (for Zero-Day Exploits)
Incident : Ransomware SON5792057112025
Incident Response Plan Activated: Yes (Beazley Security Incident Response)
Third Party Assistance: Beazley Security (Insurance/Cybersecurity Arm).
Containment Measures: MFA Enforcement for Remote AccessDark Web Monitoring for Leaked CredentialsPatching Critical Vulnerabilities (Cisco/Citrix)Compensating Controls for MFA-Exempt Accounts
Remediation Measures: Credential Rotation for Compromised AccountsLockout Policy Enhancements (SonicWall)VPN/RDP Hardening
Communication Strategy: Public Report by Beazley Security
Enhanced Monitoring: Dark Web Monitoring for Credentials
What is the company's incident response plan?
Incident Response Plan: The company's incident response plan is described as Recommended (not specified per victim), , , , , , Yes (By SonicWall and Affected Organizations), , Likely (Beazley Insurance Clients), Yes (Beazley Security Incident Response).
How does the company involve third-party assistance in incident response ?
Third-Party Assistance: The company involves third-party assistance in incident response through Google Threat Intelligence Group (GTIG), Mandiant, SonicWall’s Product Security Incident Response Team (PSIRT), Rapid7, ThreatLocker, Arctic Wolf, , Arctic Wolf (research), Rapid7 (research), , Cybersecurity experts, , Independent Investigation, External Forensics Review, , Mandiant, , Huntress Security Researchers, , Huntress Security Researchers, Partner Collaborations, , Mandiant (incident response investigation), , Beazley Security Labs, Cybersecurity Vendors (e.g., SonicWall, Microsoft), , Beazley Security (Insurance/Cybersecurity Arm), .
Data Breach Information
What type of data was compromised in each breach ?
Incident : Malware (Rootkit) SON417071725
Type of Data Compromised: Sensitive credentials, persist.db database, certificate files
Sensitivity of Data: High
File Types Exposed: persist.db database, certificate files
Incident : ransomware SON2902029091125
Data Encryption: full system encryption (ransomware)
Incident : ransomware SON0492204092925
Type of Data Compromised: Sensitive corporate data, Potentially pii, Virtual machine storage, Backup data
Sensitivity of Data: High
Data Exfiltration: Yes (via rclone/FileZilla to attacker-controlled VPS)
Data Encryption: Yes (Akira ransomware)
Personally Identifiable Information: Likely (not specified)
Incident : Data Exposure SON1091810100325
Type of Data Compromised: Firewall preference files (configuration details and encrypted credentials)
Sensitivity of Data: Medium (encrypted credentials but potential for exploitation)
Data Encryption: Partially (credentials were encrypted, but other configuration details were exposed)
File Types Exposed: Firewall backup preference files
Incident : Data Breach SON2392523100925
Type of Data Compromised: Firewall configuration files, Network settings, Policies, Certificates
Sensitivity of Data: High (includes internal infrastructure details, user/group/domain settings, DNS/log settings)
Data Encryption: ['Backups were encrypted and compressed (but still accessed)']
File Types Exposed: Configuration Backup Files
Incident : Data Breach SON2892228101025
Type of Data Compromised: Firewall configuration files, Network rules, Access policies, Vpn configurations, Service credentials (ldap, radius, snmp), Admin usernames and passwords (if stored in config)
Sensitivity of Data: High (Includes credentials and network topology details)
Data Encryption: ['Files were encrypted but possession increases risk of decryption/brute-forcing']
File Types Exposed: Firewall Configuration Files
Personally Identifiable Information: Potentially (if admin credentials included PII)
Incident : Data Breach SON5492754101225
Type of Data Compromised: Firewall configuration backups, Encrypted credentials, Network topology data, Vpn settings, Access control rules
Number of Records Exposed: All Customer Backups (Previously Estimated 5%, Revised to 100%)
Sensitivity of Data: High (Network Infrastructure Details)Medium (Encrypted but Potentially Decryptable)
Data Encryption: ['Claimed by SonicWall', 'Experts Warn of Potential Decryption Risks']
File Types Exposed: Configuration BackupsEncrypted Credential Files
Personally Identifiable Information: Indirect (via Network Mapping Potential)
Incident : Unauthorized Access SON1132511101325
Type of Data Compromised: Firewall configuration backups, Encrypted credentials, Network access credentials
Sensitivity of Data: High (Configuration Data + Credentials)
Data Exfiltration: Potential (Unconfirmed but Likely Given Reconnaissance Activity)
Data Encryption: ['Backups Were Encrypted (But Credentials Still Exposed)']
File Types Exposed: Configuration FilesBackup Files
Incident : Unauthorized Access SON1232512101325
Type of Data Compromised: Firewall configuration backups (encrypted), Credentials (potential), Network topology data
Sensitivity of Data: High (Configuration Files Contain Sensitive Network/Credential Data)
Data Exfiltration: Unconfirmed (But Strong Indication of Reconnaissance and Potential Exfiltration)
Data Encryption: Yes (Backups Were Encrypted, but Credentials May Still Be Exposed)
File Types Exposed: Firewall Configuration FilesBackup Data
Personally Identifiable Information: Potential (If Credentials Include PII)
Incident : Data Breach SON0592205110525
Type of Data Compromised: Firewall configuration files, Authentication credentials, Encryption tokens
Sensitivity of Data: High (credentials for firewalls, VPNs, and authentication servers)
File Types Exposed: Configuration backup files
Incident : Ransomware SON3832338111925
Type of Data Compromised: Vpn credentials, Corporate data (ransomware), Potential pii (infostealers)
Sensitivity of Data: High (Credentials)Variable (Corporate/Data Theft)
Data Exfiltration: Likely (Ransomware Double Extortion)
Data Encryption: Yes (Ransomware)
Personally Identifiable Information: Potential (via Infostealers)
Incident : Ransomware SON5792057112025
Type of Data Compromised: Configuration backups (sonicwall cloud), Potential pii/enterprise data (ransomware)
Sensitivity of Data: High (Configuration Backups)Potentially High (Ransomware)
Data Exfiltration: Likely (Akira/Qilin/INC Modus Operandi)
Data Encryption: Yes (Ransomware Attacks)
Personally Identifiable Information: Potential (Via Credential Theft/Ransomware)
What measures does the company take to prevent data exfiltration ?
Prevention of Data Exfiltration: The company takes the following measures to prevent data exfiltration: Enable Botnet Protection, Enforce MFA on all remote access accounts, Practice good password hygiene, Remove inactive or unused local user accounts, Block VPN authentication attempts from specific ASNs, , enforcing MFA for SonicWall services, restricting Virtual Office portal access to internal networks, disabling default LDAP group configurations, , Patch CVE-2024-40766 (if unpatched), Rotate all credentials with SSL VPN access, Review LDAP group mappings, Implement network segmentation, , Customers urged to reset credentials, Import new preference files (disrupts VPNs, TOTP, and user access), Manual credential reset for customers unable to import new files, Reconfiguration of VPN pre-shared keys, , Hardened infrastructure, Additional logging, Stronger authentication controls, , Released tools to assist with device assessment and remediation, , Credential Resets, Encryption Key Regeneration, Firmware Updates, Anomaly Monitoring, , Gradual Service Restoration Post-Credential Reset, Enforce Multi-Factor Authentication (MFA) for All Admin/Remote Users, Limit Management Privileges, Monitor for Suspicious Logins/Configuration Changes, , Gradual Service Restoration Post-Credential Reset, Enforce Multi-Factor Authentication (MFA) for All Admin/Remote Users, Limit Management Privileges, Continuous Monitoring for Anomalies, , Customer advisory to reset credentials (MySonicWall accounts, LDAP/RADIUS/TACACS+, VPN secrets), , Patch Management for Zero-Days (CVE-2025-*), MFA Enforcement for VPNs, Access Control Hardening (Lockout Policies), , Credential Rotation for Compromised Accounts, Lockout Policy Enhancements (SonicWall), VPN/RDP Hardening, .
How does the company handle incidents involving personally identifiable information (PII) ?
Handling of PII Incidents: The company handles incidents involving personally identifiable information (PII) through by disable sonicwall ssl vpn service, patching cve-2024-40766, credential rotation, upgrading to sonicos 7.3.0, , reset all sonicwall credentials (ssl vpn, otp mfa secrets, ldap sync accounts), block logins from vps hosting providers, disable virtual office portal if unused, , blocked attackers' access to mysonicwall backups, , disabled cloud backup service, deleted compromised backups, , urged customers to delete existing cloud backups, encouraged credential rotation and secret rotation, recommended recreating backups locally, , disclosure of full scope, urgent customer advisories, , restrict wan management access, disable http/s, ssh, and ssl vpn services, reset all credentials (local admin, vpn keys, ldap, snmp, api secrets), enable enhanced logging, , restrict wan management access, disable http/s, ssh, and ssl vpn services temporarily, reset all credentials (local admin, vpn pre-shared keys, ldap, snmp, api/ddns secrets), enable enhanced logging for suspicious activity, , isolation of compromised cloud environment, api access restrictions, , temporary mitigations for zero-days, network access lockdowns, credential rotation (for vpns), , mfa enforcement for remote access, dark web monitoring for leaked credentials, patching critical vulnerabilities (cisco/citrix), compensating controls for mfa-exempt accounts and .
Ransomware Information
Was ransomware involved in any of the incidents ?
Incident : Ransomware SON000103024
Ransomware Strain: FogAkira
Incident : Malware (Rootkit) SON417071725
Ransomware Strain: Abyss (VSOCIETY)
Incident : Ransomware SON517080325
Ransomware Strain: Akira
Incident : ransomware SON0492204092925
Ransomware Strain: Akira
Data Encryption: Yes (AES + RSA hybrid)
Data Exfiltration: Yes (double extortion)
Incident : Ransomware SON3832338111925
Ransomware Strain: AkiraQilinINC Ransomware
Data Encryption: Yes
Data Exfiltration: Likely (Double Extortion Tactics)
Incident : Ransomware SON5792057112025
Ransomware Strain: AkiraQilinINCRhysida
Data Encryption: Yes
Data Exfiltration: Likely (Double Extortion Tactics)
How does the company recover data encrypted by ransomware ?
Data Recovery from Ransomware: The company recovers data encrypted by ransomware through Restore from offline backups (if available), Rebuild Domain Controllers, Reimage compromised systems, , Guidance provided for manual remediation if new preference files cannot be imported, , Customers advised to recreate backups locally, , Forensic Audits Recommended, Configuration Reviews, , Continuous Monitoring, Configuration Audits, .
Regulatory Compliance
Were there any regulatory violations and fines imposed for each incident ?
Incident : ransomware SON0492204092925
Regulatory Notifications: Recommended (if PII breached)
Incident : Data Exposure SON1091810100325
Regulatory Notifications: Law enforcement notified
Incident : Data Breach SON5492754101225
Regulations Violated: Potential GDPR Non-Compliance, Potential NIST Violations,
Legal Actions: Possible Lawsuits from Affected Customers, Potential Regulatory Probes,
How does the company ensure compliance with regulatory requirements ?
Ensuring Regulatory Compliance: The company ensures compliance with regulatory requirements through Possible Lawsuits from Affected Customers, Potential Regulatory Probes, .
Lessons Learned and Recommendations
What lessons were learned from each incident ?
Incident : Ransomware SON000103024
Lessons Learned: The urgency of applying security updates to prevent severe repercussions, including loss of resources and compromised data.
Incident : Ransomware SON517080325
Lessons Learned: Importance of disabling potentially vulnerable services and hardening firewall security
Incident : ransomware SON2902029091125
Lessons Learned: Legacy credentials and misconfigurations (e.g., default LDAP groups, public Virtual Office portal access) significantly increase risk even after patching. Rapid encryption (<10 hours) underscores the need for immediate mitigation. MFA and network access restrictions are critical supplementary controls.
Incident : ransomware SON0492204092925
Lessons Learned: Credential rotation is critical even after patching (attackers reuse old credentials), MFA bypass techniques (e.g., Virtual Office Portal abuse) require additional controls, Rapid attack timelines (<4 hours) necessitate real-time detection capabilities, Default configurations (e.g., SSLVPN Default Users Group) can introduce risk, LDAP-synchronized accounts require strict access reviews
Incident : Data Breach SON2392523100925
Lessons Learned: Initial impact assessment was inaccurate (underestimated scope from 5% to 100% of users)., Cloud-stored firewall configurations are high-value targets for threat actors., Need for stronger access controls and monitoring of cloud backup environments., Importance of transparent communication during incident response.
Incident : Data Breach SON2892228101025
Lessons Learned: Underestimation of incident scale can erode trust; transparency is critical. Weak authentication mechanisms in cloud services pose significant risks. Firewall configuration files are high-value targets for threat actors seeking insider knowledge for targeted attacks.
Incident : Data Breach SON5492754101225
Lessons Learned: Cloud backup services can become high-value targets if not properly secured., Initial breach assessments may underestimate scope; thorough investigations are critical., Multi-factor authentication and rate-limiting are essential for preventing brute-force attacks., Vendor transparency is crucial for maintaining customer trust during incidents., Supply-chain risks require diversified security stacks and zero-trust architectures.
Incident : Unauthorized Access SON1132511101325
Lessons Learned: Exposed credentials in backup files create systemic risk even if encrypted., Rapid, coordinated attacks underscore the need for real-time monitoring and credential hygiene., Vendor disclosures must be transparent about scope to prevent underestimation of threats., MFA and least-privilege access are critical for mitigating VPN-based intrusions.
Incident : Unauthorized Access SON1232512101325
Lessons Learned: Exposed Credentials Pose Significant Risk Even Without Brute-Force Attacks, Cloud Backup Services Must Implement Stricter Access Controls, Rapid Credential Rotation and MFA Are Critical for Mitigating VPN-Based Intrusions, Configuration Backups, Even Encrypted, Can Be Exploited for Targeted Attacks
Incident : Data Breach SON0592205110525
Lessons Learned: Isolation of cloud environments and API security are critical to preventing lateral movement. Proactive credential rotation advisories can mitigate downstream risks from exposed configuration files.
Incident : Ransomware SON3832338111925
Lessons Learned: Credential stuffing and weak MFA policies are primary attack vectors for ransomware groups., Zero-day exploits require continuous vulnerability management and proactive mitigations., Infostealers (e.g., Rhadamanthys) fuel credential-based attacks, necessitating monitoring of cybercrime markets., Exposed, unpatched devices should be assumed compromised and investigated.
Incident : Ransomware SON5792057112025
Lessons Learned: MFA is critical for VPN/RDP access but must be universally applied (no exceptions)., Dark web monitoring for leaked credentials can preempt attacks., Unpatched enterprise appliances (SonicWall/Cisco/Citrix) are high-value targets., SEO poisoning and malicious ads bypass traditional email filters, requiring endpoint protection., Credential stuffing/brute force attacks exploit weak lockout policies and password hygiene.
What recommendations were made to prevent future incidents ?
Incident : Cyberattack SON407050824
Recommendations: Heightened cybersecurity vigilance, Proactive and comprehensive approach to cybersecurity, Real-time threat intelligence, Robust defense mechanismsHeightened cybersecurity vigilance, Proactive and comprehensive approach to cybersecurity, Real-time threat intelligence, Robust defense mechanismsHeightened cybersecurity vigilance, Proactive and comprehensive approach to cybersecurity, Real-time threat intelligence, Robust defense mechanismsHeightened cybersecurity vigilance, Proactive and comprehensive approach to cybersecurity, Real-time threat intelligence, Robust defense mechanisms
Incident : Ransomware SON000103024
Recommendations: Apply security updates promptly to prevent ransomware attacks.
Incident : Malware (Rootkit) SON417071725
Recommendations: Organizations with SMA appliances are recommended to check the devices for potential compromise by acquiring disk images, which should prevent interference from the rootkit. GTIG provides a set of indicators of compromise along with the signs analysts should look for to determine if the device was hacked.
Incident : Ransomware SON517080325
Recommendations: Disable SonicWall SSL VPN service, Enable Botnet Protection, Enforce MFA on all remote access accounts, Practice good password hygiene, Remove inactive or unused local user accounts, Block VPN authentication attempts from specific ASNsDisable SonicWall SSL VPN service, Enable Botnet Protection, Enforce MFA on all remote access accounts, Practice good password hygiene, Remove inactive or unused local user accounts, Block VPN authentication attempts from specific ASNsDisable SonicWall SSL VPN service, Enable Botnet Protection, Enforce MFA on all remote access accounts, Practice good password hygiene, Remove inactive or unused local user accounts, Block VPN authentication attempts from specific ASNsDisable SonicWall SSL VPN service, Enable Botnet Protection, Enforce MFA on all remote access accounts, Practice good password hygiene, Remove inactive or unused local user accounts, Block VPN authentication attempts from specific ASNsDisable SonicWall SSL VPN service, Enable Botnet Protection, Enforce MFA on all remote access accounts, Practice good password hygiene, Remove inactive or unused local user accounts, Block VPN authentication attempts from specific ASNsDisable SonicWall SSL VPN service, Enable Botnet Protection, Enforce MFA on all remote access accounts, Practice good password hygiene, Remove inactive or unused local user accounts, Block VPN authentication attempts from specific ASNs
Incident : ransomware SON2902029091125
Recommendations: Apply SonicWall patches for CVE-2024-40766 immediately, Upgrade to SonicOS 7.3.0 with enhanced MFA protections, Rotate legacy credentials, especially during Gen 6→Gen 7 firewall migrations, Disable default LDAP group configurations to prevent over-provisioning, Restrict Virtual Office portal access to internal networks only, Monitor for anomalous VPN logins (e.g., via Rapid7/Arctic Wolf), Assume compromise if unpatched; conduct thorough incident responseApply SonicWall patches for CVE-2024-40766 immediately, Upgrade to SonicOS 7.3.0 with enhanced MFA protections, Rotate legacy credentials, especially during Gen 6→Gen 7 firewall migrations, Disable default LDAP group configurations to prevent over-provisioning, Restrict Virtual Office portal access to internal networks only, Monitor for anomalous VPN logins (e.g., via Rapid7/Arctic Wolf), Assume compromise if unpatched; conduct thorough incident responseApply SonicWall patches for CVE-2024-40766 immediately, Upgrade to SonicOS 7.3.0 with enhanced MFA protections, Rotate legacy credentials, especially during Gen 6→Gen 7 firewall migrations, Disable default LDAP group configurations to prevent over-provisioning, Restrict Virtual Office portal access to internal networks only, Monitor for anomalous VPN logins (e.g., via Rapid7/Arctic Wolf), Assume compromise if unpatched; conduct thorough incident responseApply SonicWall patches for CVE-2024-40766 immediately, Upgrade to SonicOS 7.3.0 with enhanced MFA protections, Rotate legacy credentials, especially during Gen 6→Gen 7 firewall migrations, Disable default LDAP group configurations to prevent over-provisioning, Restrict Virtual Office portal access to internal networks only, Monitor for anomalous VPN logins (e.g., via Rapid7/Arctic Wolf), Assume compromise if unpatched; conduct thorough incident responseApply SonicWall patches for CVE-2024-40766 immediately, Upgrade to SonicOS 7.3.0 with enhanced MFA protections, Rotate legacy credentials, especially during Gen 6→Gen 7 firewall migrations, Disable default LDAP group configurations to prevent over-provisioning, Restrict Virtual Office portal access to internal networks only, Monitor for anomalous VPN logins (e.g., via Rapid7/Arctic Wolf), Assume compromise if unpatched; conduct thorough incident responseApply SonicWall patches for CVE-2024-40766 immediately, Upgrade to SonicOS 7.3.0 with enhanced MFA protections, Rotate legacy credentials, especially during Gen 6→Gen 7 firewall migrations, Disable default LDAP group configurations to prevent over-provisioning, Restrict Virtual Office portal access to internal networks only, Monitor for anomalous VPN logins (e.g., via Rapid7/Arctic Wolf), Assume compromise if unpatched; conduct thorough incident responseApply SonicWall patches for CVE-2024-40766 immediately, Upgrade to SonicOS 7.3.0 with enhanced MFA protections, Rotate legacy credentials, especially during Gen 6→Gen 7 firewall migrations, Disable default LDAP group configurations to prevent over-provisioning, Restrict Virtual Office portal access to internal networks only, Monitor for anomalous VPN logins (e.g., via Rapid7/Arctic Wolf), Assume compromise if unpatched; conduct thorough incident response
Incident : ransomware SON0492204092925
Recommendations: Category: Response, Items: Isolate compromised SonicWall devices immediately, Assume total credential compromise; rotate all passwords/secrets, Engage incident response team within <4 hours of detection, Preserve logs (attackers clear event logs), Notify law enforcement if ransomware deployed, Category: Response, Items: Isolate compromised SonicWall devices immediately, Assume total credential compromise; rotate all passwords/secrets, Engage incident response team within <4 hours of detection, Preserve logs (attackers clear event logs), Notify law enforcement if ransomware deployed, Category: Response, Items: Isolate compromised SonicWall devices immediately, Assume total credential compromise; rotate all passwords/secrets, Engage incident response team within <4 hours of detection, Preserve logs (attackers clear event logs), Notify law enforcement if ransomware deployed.
Incident : Data Exposure SON1091810100325
Recommendations: Enable multi-factor authentication (MFA) for MySonicWall accounts, Regularly audit cloud backup configurations, Monitor for suspicious activity in firewall preference files, Conduct periodic credential rotation for firewall administrators, Schedule remediation during low-activity periods to minimize downtimeEnable multi-factor authentication (MFA) for MySonicWall accounts, Regularly audit cloud backup configurations, Monitor for suspicious activity in firewall preference files, Conduct periodic credential rotation for firewall administrators, Schedule remediation during low-activity periods to minimize downtimeEnable multi-factor authentication (MFA) for MySonicWall accounts, Regularly audit cloud backup configurations, Monitor for suspicious activity in firewall preference files, Conduct periodic credential rotation for firewall administrators, Schedule remediation during low-activity periods to minimize downtimeEnable multi-factor authentication (MFA) for MySonicWall accounts, Regularly audit cloud backup configurations, Monitor for suspicious activity in firewall preference files, Conduct periodic credential rotation for firewall administrators, Schedule remediation during low-activity periods to minimize downtimeEnable multi-factor authentication (MFA) for MySonicWall accounts, Regularly audit cloud backup configurations, Monitor for suspicious activity in firewall preference files, Conduct periodic credential rotation for firewall administrators, Schedule remediation during low-activity periods to minimize downtime
Incident : Data Breach SON2392523100925
Recommendations: Avoid storing sensitive configuration files in cloud backups unless absolutely necessary., Implement multi-factor authentication (MFA) and least-privilege access for cloud services., Regularly audit and rotate credentials, shared secrets, and certificates., Monitor for unusual access patterns in cloud storage environments., Prepare for follow-on attacks leveraging exfiltrated configuration data.Avoid storing sensitive configuration files in cloud backups unless absolutely necessary., Implement multi-factor authentication (MFA) and least-privilege access for cloud services., Regularly audit and rotate credentials, shared secrets, and certificates., Monitor for unusual access patterns in cloud storage environments., Prepare for follow-on attacks leveraging exfiltrated configuration data.Avoid storing sensitive configuration files in cloud backups unless absolutely necessary., Implement multi-factor authentication (MFA) and least-privilege access for cloud services., Regularly audit and rotate credentials, shared secrets, and certificates., Monitor for unusual access patterns in cloud storage environments., Prepare for follow-on attacks leveraging exfiltrated configuration data.Avoid storing sensitive configuration files in cloud backups unless absolutely necessary., Implement multi-factor authentication (MFA) and least-privilege access for cloud services., Regularly audit and rotate credentials, shared secrets, and certificates., Monitor for unusual access patterns in cloud storage environments., Prepare for follow-on attacks leveraging exfiltrated configuration data.Avoid storing sensitive configuration files in cloud backups unless absolutely necessary., Implement multi-factor authentication (MFA) and least-privilege access for cloud services., Regularly audit and rotate credentials, shared secrets, and certificates., Monitor for unusual access patterns in cloud storage environments., Prepare for follow-on attacks leveraging exfiltrated configuration data.
Incident : Data Breach SON2892228101025
Recommendations: Implement multi-factor authentication (MFA) for cloud services, especially those storing sensitive configurations., Regularly audit and rotate credentials and secrets stored in firewall configurations., Avoid storing plaintext or weakly encrypted credentials in configuration backups., Monitor for unusual access patterns or brute-force attempts on cloud services., Conduct third-party security assessments for cloud backup solutions., Educate customers on secure backup practices, including local storage of sensitive configurations.Implement multi-factor authentication (MFA) for cloud services, especially those storing sensitive configurations., Regularly audit and rotate credentials and secrets stored in firewall configurations., Avoid storing plaintext or weakly encrypted credentials in configuration backups., Monitor for unusual access patterns or brute-force attempts on cloud services., Conduct third-party security assessments for cloud backup solutions., Educate customers on secure backup practices, including local storage of sensitive configurations.Implement multi-factor authentication (MFA) for cloud services, especially those storing sensitive configurations., Regularly audit and rotate credentials and secrets stored in firewall configurations., Avoid storing plaintext or weakly encrypted credentials in configuration backups., Monitor for unusual access patterns or brute-force attempts on cloud services., Conduct third-party security assessments for cloud backup solutions., Educate customers on secure backup practices, including local storage of sensitive configurations.Implement multi-factor authentication (MFA) for cloud services, especially those storing sensitive configurations., Regularly audit and rotate credentials and secrets stored in firewall configurations., Avoid storing plaintext or weakly encrypted credentials in configuration backups., Monitor for unusual access patterns or brute-force attempts on cloud services., Conduct third-party security assessments for cloud backup solutions., Educate customers on secure backup practices, including local storage of sensitive configurations.Implement multi-factor authentication (MFA) for cloud services, especially those storing sensitive configurations., Regularly audit and rotate credentials and secrets stored in firewall configurations., Avoid storing plaintext or weakly encrypted credentials in configuration backups., Monitor for unusual access patterns or brute-force attempts on cloud services., Conduct third-party security assessments for cloud backup solutions., Educate customers on secure backup practices, including local storage of sensitive configurations.Implement multi-factor authentication (MFA) for cloud services, especially those storing sensitive configurations., Regularly audit and rotate credentials and secrets stored in firewall configurations., Avoid storing plaintext or weakly encrypted credentials in configuration backups., Monitor for unusual access patterns or brute-force attempts on cloud services., Conduct third-party security assessments for cloud backup solutions., Educate customers on secure backup practices, including local storage of sensitive configurations.
Incident : Data Breach SON5492754101225
Recommendations: Implement MFA and rate-limiting for all cloud services., Conduct third-party audits of cloud backup infrastructures., Adopt zero-trust architectures to mitigate single-vendor risks., Enhance anomaly detection and monitoring for brute-force attempts., Regenerate encryption keys and update firmware post-breach., Diversify security vendors to reduce dependency on single providers., Review compliance with GDPR, NIST, and other relevant standards.Implement MFA and rate-limiting for all cloud services., Conduct third-party audits of cloud backup infrastructures., Adopt zero-trust architectures to mitigate single-vendor risks., Enhance anomaly detection and monitoring for brute-force attempts., Regenerate encryption keys and update firmware post-breach., Diversify security vendors to reduce dependency on single providers., Review compliance with GDPR, NIST, and other relevant standards.Implement MFA and rate-limiting for all cloud services., Conduct third-party audits of cloud backup infrastructures., Adopt zero-trust architectures to mitigate single-vendor risks., Enhance anomaly detection and monitoring for brute-force attempts., Regenerate encryption keys and update firmware post-breach., Diversify security vendors to reduce dependency on single providers., Review compliance with GDPR, NIST, and other relevant standards.Implement MFA and rate-limiting for all cloud services., Conduct third-party audits of cloud backup infrastructures., Adopt zero-trust architectures to mitigate single-vendor risks., Enhance anomaly detection and monitoring for brute-force attempts., Regenerate encryption keys and update firmware post-breach., Diversify security vendors to reduce dependency on single providers., Review compliance with GDPR, NIST, and other relevant standards.Implement MFA and rate-limiting for all cloud services., Conduct third-party audits of cloud backup infrastructures., Adopt zero-trust architectures to mitigate single-vendor risks., Enhance anomaly detection and monitoring for brute-force attempts., Regenerate encryption keys and update firmware post-breach., Diversify security vendors to reduce dependency on single providers., Review compliance with GDPR, NIST, and other relevant standards.Implement MFA and rate-limiting for all cloud services., Conduct third-party audits of cloud backup infrastructures., Adopt zero-trust architectures to mitigate single-vendor risks., Enhance anomaly detection and monitoring for brute-force attempts., Regenerate encryption keys and update firmware post-breach., Diversify security vendors to reduce dependency on single providers., Review compliance with GDPR, NIST, and other relevant standards.Implement MFA and rate-limiting for all cloud services., Conduct third-party audits of cloud backup infrastructures., Adopt zero-trust architectures to mitigate single-vendor risks., Enhance anomaly detection and monitoring for brute-force attempts., Regenerate encryption keys and update firmware post-breach., Diversify security vendors to reduce dependency on single providers., Review compliance with GDPR, NIST, and other relevant standards.
Incident : Unauthorized Access SON1132511101325
Recommendations: Immediately reset all credentials linked to SonicWall devices (VPN, admin, API, etc.)., Enable MFA for all administrative and remote access accounts., Restrict WAN management access and disable unnecessary services (HTTP/S, SSH)., Audit firewall configurations for unauthorized changes or backdoors., Monitor for lateral movement or follow-on attacks using compromised credentials., Isolate affected devices until fully remediated., Conduct a thorough review of backup security practices (e.g., encryption of sensitive fields)., Engage third-party security firms for incident response and forensic analysis.Immediately reset all credentials linked to SonicWall devices (VPN, admin, API, etc.)., Enable MFA for all administrative and remote access accounts., Restrict WAN management access and disable unnecessary services (HTTP/S, SSH)., Audit firewall configurations for unauthorized changes or backdoors., Monitor for lateral movement or follow-on attacks using compromised credentials., Isolate affected devices until fully remediated., Conduct a thorough review of backup security practices (e.g., encryption of sensitive fields)., Engage third-party security firms for incident response and forensic analysis.Immediately reset all credentials linked to SonicWall devices (VPN, admin, API, etc.)., Enable MFA for all administrative and remote access accounts., Restrict WAN management access and disable unnecessary services (HTTP/S, SSH)., Audit firewall configurations for unauthorized changes or backdoors., Monitor for lateral movement or follow-on attacks using compromised credentials., Isolate affected devices until fully remediated., Conduct a thorough review of backup security practices (e.g., encryption of sensitive fields)., Engage third-party security firms for incident response and forensic analysis.Immediately reset all credentials linked to SonicWall devices (VPN, admin, API, etc.)., Enable MFA for all administrative and remote access accounts., Restrict WAN management access and disable unnecessary services (HTTP/S, SSH)., Audit firewall configurations for unauthorized changes or backdoors., Monitor for lateral movement or follow-on attacks using compromised credentials., Isolate affected devices until fully remediated., Conduct a thorough review of backup security practices (e.g., encryption of sensitive fields)., Engage third-party security firms for incident response and forensic analysis.Immediately reset all credentials linked to SonicWall devices (VPN, admin, API, etc.)., Enable MFA for all administrative and remote access accounts., Restrict WAN management access and disable unnecessary services (HTTP/S, SSH)., Audit firewall configurations for unauthorized changes or backdoors., Monitor for lateral movement or follow-on attacks using compromised credentials., Isolate affected devices until fully remediated., Conduct a thorough review of backup security practices (e.g., encryption of sensitive fields)., Engage third-party security firms for incident response and forensic analysis.Immediately reset all credentials linked to SonicWall devices (VPN, admin, API, etc.)., Enable MFA for all administrative and remote access accounts., Restrict WAN management access and disable unnecessary services (HTTP/S, SSH)., Audit firewall configurations for unauthorized changes or backdoors., Monitor for lateral movement or follow-on attacks using compromised credentials., Isolate affected devices until fully remediated., Conduct a thorough review of backup security practices (e.g., encryption of sensitive fields)., Engage third-party security firms for incident response and forensic analysis.Immediately reset all credentials linked to SonicWall devices (VPN, admin, API, etc.)., Enable MFA for all administrative and remote access accounts., Restrict WAN management access and disable unnecessary services (HTTP/S, SSH)., Audit firewall configurations for unauthorized changes or backdoors., Monitor for lateral movement or follow-on attacks using compromised credentials., Isolate affected devices until fully remediated., Conduct a thorough review of backup security practices (e.g., encryption of sensitive fields)., Engage third-party security firms for incident response and forensic analysis.Immediately reset all credentials linked to SonicWall devices (VPN, admin, API, etc.)., Enable MFA for all administrative and remote access accounts., Restrict WAN management access and disable unnecessary services (HTTP/S, SSH)., Audit firewall configurations for unauthorized changes or backdoors., Monitor for lateral movement or follow-on attacks using compromised credentials., Isolate affected devices until fully remediated., Conduct a thorough review of backup security practices (e.g., encryption of sensitive fields)., Engage third-party security firms for incident response and forensic analysis.
Incident : Unauthorized Access SON1232512101325
Recommendations: Immediate Credential Reset for All SonicWall SSL VPN Users, Enforce MFA for All Administrative and Remote Access, Disable Unnecessary External Management Interfaces (HTTP/S, SSH), Monitor for Unusual Authentication Patterns or Network Scans, Review and Harden Firewall Configuration Backups, Conduct Forensic Analysis to Detect Lateral Movement, Implement Zero Trust Principles for VPN AccessImmediate Credential Reset for All SonicWall SSL VPN Users, Enforce MFA for All Administrative and Remote Access, Disable Unnecessary External Management Interfaces (HTTP/S, SSH), Monitor for Unusual Authentication Patterns or Network Scans, Review and Harden Firewall Configuration Backups, Conduct Forensic Analysis to Detect Lateral Movement, Implement Zero Trust Principles for VPN AccessImmediate Credential Reset for All SonicWall SSL VPN Users, Enforce MFA for All Administrative and Remote Access, Disable Unnecessary External Management Interfaces (HTTP/S, SSH), Monitor for Unusual Authentication Patterns or Network Scans, Review and Harden Firewall Configuration Backups, Conduct Forensic Analysis to Detect Lateral Movement, Implement Zero Trust Principles for VPN AccessImmediate Credential Reset for All SonicWall SSL VPN Users, Enforce MFA for All Administrative and Remote Access, Disable Unnecessary External Management Interfaces (HTTP/S, SSH), Monitor for Unusual Authentication Patterns or Network Scans, Review and Harden Firewall Configuration Backups, Conduct Forensic Analysis to Detect Lateral Movement, Implement Zero Trust Principles for VPN AccessImmediate Credential Reset for All SonicWall SSL VPN Users, Enforce MFA for All Administrative and Remote Access, Disable Unnecessary External Management Interfaces (HTTP/S, SSH), Monitor for Unusual Authentication Patterns or Network Scans, Review and Harden Firewall Configuration Backups, Conduct Forensic Analysis to Detect Lateral Movement, Implement Zero Trust Principles for VPN AccessImmediate Credential Reset for All SonicWall SSL VPN Users, Enforce MFA for All Administrative and Remote Access, Disable Unnecessary External Management Interfaces (HTTP/S, SSH), Monitor for Unusual Authentication Patterns or Network Scans, Review and Harden Firewall Configuration Backups, Conduct Forensic Analysis to Detect Lateral Movement, Implement Zero Trust Principles for VPN AccessImmediate Credential Reset for All SonicWall SSL VPN Users, Enforce MFA for All Administrative and Remote Access, Disable Unnecessary External Management Interfaces (HTTP/S, SSH), Monitor for Unusual Authentication Patterns or Network Scans, Review and Harden Firewall Configuration Backups, Conduct Forensic Analysis to Detect Lateral Movement, Implement Zero Trust Principles for VPN Access
Incident : Data Breach SON0592205110525
Recommendations: Enhance API security controls for cloud services storing sensitive data., Implement multi-factor authentication (MFA) for cloud backup access., Regularly audit and rotate credentials stored in configuration files., Segment cloud environments to limit blast radius of breaches., Monitor for unauthorized API calls and anomalous access patterns.Enhance API security controls for cloud services storing sensitive data., Implement multi-factor authentication (MFA) for cloud backup access., Regularly audit and rotate credentials stored in configuration files., Segment cloud environments to limit blast radius of breaches., Monitor for unauthorized API calls and anomalous access patterns.Enhance API security controls for cloud services storing sensitive data., Implement multi-factor authentication (MFA) for cloud backup access., Regularly audit and rotate credentials stored in configuration files., Segment cloud environments to limit blast radius of breaches., Monitor for unauthorized API calls and anomalous access patterns.Enhance API security controls for cloud services storing sensitive data., Implement multi-factor authentication (MFA) for cloud backup access., Regularly audit and rotate credentials stored in configuration files., Segment cloud environments to limit blast radius of breaches., Monitor for unauthorized API calls and anomalous access patterns.Enhance API security controls for cloud services storing sensitive data., Implement multi-factor authentication (MFA) for cloud backup access., Regularly audit and rotate credentials stored in configuration files., Segment cloud environments to limit blast radius of breaches., Monitor for unauthorized API calls and anomalous access patterns.
Incident : Ransomware SON3832338111925
Recommendations: Implement comprehensive MFA and conditional access policies for VPNs/remote access., Enforce strong lockout policies and password hygiene to mitigate credential stuffing., Adopt continuous vulnerability management with prioritized patching for critical CVEs., Assume breach for internet-exposed, vulnerable devices and conduct thorough investigations., Monitor dark web for stolen credentials and proactively rotate compromised accounts., Segment networks to limit lateral movement in case of ransomware infections., Deploy behavioral WAFs and anomaly detection for zero-day exploit prevention.Implement comprehensive MFA and conditional access policies for VPNs/remote access., Enforce strong lockout policies and password hygiene to mitigate credential stuffing., Adopt continuous vulnerability management with prioritized patching for critical CVEs., Assume breach for internet-exposed, vulnerable devices and conduct thorough investigations., Monitor dark web for stolen credentials and proactively rotate compromised accounts., Segment networks to limit lateral movement in case of ransomware infections., Deploy behavioral WAFs and anomaly detection for zero-day exploit prevention.Implement comprehensive MFA and conditional access policies for VPNs/remote access., Enforce strong lockout policies and password hygiene to mitigate credential stuffing., Adopt continuous vulnerability management with prioritized patching for critical CVEs., Assume breach for internet-exposed, vulnerable devices and conduct thorough investigations., Monitor dark web for stolen credentials and proactively rotate compromised accounts., Segment networks to limit lateral movement in case of ransomware infections., Deploy behavioral WAFs and anomaly detection for zero-day exploit prevention.Implement comprehensive MFA and conditional access policies for VPNs/remote access., Enforce strong lockout policies and password hygiene to mitigate credential stuffing., Adopt continuous vulnerability management with prioritized patching for critical CVEs., Assume breach for internet-exposed, vulnerable devices and conduct thorough investigations., Monitor dark web for stolen credentials and proactively rotate compromised accounts., Segment networks to limit lateral movement in case of ransomware infections., Deploy behavioral WAFs and anomaly detection for zero-day exploit prevention.Implement comprehensive MFA and conditional access policies for VPNs/remote access., Enforce strong lockout policies and password hygiene to mitigate credential stuffing., Adopt continuous vulnerability management with prioritized patching for critical CVEs., Assume breach for internet-exposed, vulnerable devices and conduct thorough investigations., Monitor dark web for stolen credentials and proactively rotate compromised accounts., Segment networks to limit lateral movement in case of ransomware infections., Deploy behavioral WAFs and anomaly detection for zero-day exploit prevention.Implement comprehensive MFA and conditional access policies for VPNs/remote access., Enforce strong lockout policies and password hygiene to mitigate credential stuffing., Adopt continuous vulnerability management with prioritized patching for critical CVEs., Assume breach for internet-exposed, vulnerable devices and conduct thorough investigations., Monitor dark web for stolen credentials and proactively rotate compromised accounts., Segment networks to limit lateral movement in case of ransomware infections., Deploy behavioral WAFs and anomaly detection for zero-day exploit prevention.Implement comprehensive MFA and conditional access policies for VPNs/remote access., Enforce strong lockout policies and password hygiene to mitigate credential stuffing., Adopt continuous vulnerability management with prioritized patching for critical CVEs., Assume breach for internet-exposed, vulnerable devices and conduct thorough investigations., Monitor dark web for stolen credentials and proactively rotate compromised accounts., Segment networks to limit lateral movement in case of ransomware infections., Deploy behavioral WAFs and anomaly detection for zero-day exploit prevention.
Incident : Ransomware SON5792057112025
Recommendations: Enforce MFA for all remote access solutions (VPN, RDP, etc.) without exceptions., Implement dark web monitoring for leaked credentials., Apply patches promptly for critical vulnerabilities (e.g., Cisco/Citrix)., Strengthen lockout policies to thwart brute force attacks., Educate users on SEO poisoning risks (e.g., fake productivity tools)., Segment networks to limit lateral movement post-compromise., Audit and remove default/weak credentials from enterprise appliances.Enforce MFA for all remote access solutions (VPN, RDP, etc.) without exceptions., Implement dark web monitoring for leaked credentials., Apply patches promptly for critical vulnerabilities (e.g., Cisco/Citrix)., Strengthen lockout policies to thwart brute force attacks., Educate users on SEO poisoning risks (e.g., fake productivity tools)., Segment networks to limit lateral movement post-compromise., Audit and remove default/weak credentials from enterprise appliances.Enforce MFA for all remote access solutions (VPN, RDP, etc.) without exceptions., Implement dark web monitoring for leaked credentials., Apply patches promptly for critical vulnerabilities (e.g., Cisco/Citrix)., Strengthen lockout policies to thwart brute force attacks., Educate users on SEO poisoning risks (e.g., fake productivity tools)., Segment networks to limit lateral movement post-compromise., Audit and remove default/weak credentials from enterprise appliances.Enforce MFA for all remote access solutions (VPN, RDP, etc.) without exceptions., Implement dark web monitoring for leaked credentials., Apply patches promptly for critical vulnerabilities (e.g., Cisco/Citrix)., Strengthen lockout policies to thwart brute force attacks., Educate users on SEO poisoning risks (e.g., fake productivity tools)., Segment networks to limit lateral movement post-compromise., Audit and remove default/weak credentials from enterprise appliances.Enforce MFA for all remote access solutions (VPN, RDP, etc.) without exceptions., Implement dark web monitoring for leaked credentials., Apply patches promptly for critical vulnerabilities (e.g., Cisco/Citrix)., Strengthen lockout policies to thwart brute force attacks., Educate users on SEO poisoning risks (e.g., fake productivity tools)., Segment networks to limit lateral movement post-compromise., Audit and remove default/weak credentials from enterprise appliances.Enforce MFA for all remote access solutions (VPN, RDP, etc.) without exceptions., Implement dark web monitoring for leaked credentials., Apply patches promptly for critical vulnerabilities (e.g., Cisco/Citrix)., Strengthen lockout policies to thwart brute force attacks., Educate users on SEO poisoning risks (e.g., fake productivity tools)., Segment networks to limit lateral movement post-compromise., Audit and remove default/weak credentials from enterprise appliances.Enforce MFA for all remote access solutions (VPN, RDP, etc.) without exceptions., Implement dark web monitoring for leaked credentials., Apply patches promptly for critical vulnerabilities (e.g., Cisco/Citrix)., Strengthen lockout policies to thwart brute force attacks., Educate users on SEO poisoning risks (e.g., fake productivity tools)., Segment networks to limit lateral movement post-compromise., Audit and remove default/weak credentials from enterprise appliances.
What are the key lessons learned from past incidents ?
Key Lessons Learned: The key lessons learned from past incidents are The urgency of applying security updates to prevent severe repercussions, including loss of resources and compromised data.Importance of disabling potentially vulnerable services and hardening firewall securityLegacy credentials and misconfigurations (e.g., default LDAP groups, public Virtual Office portal access) significantly increase risk even after patching. Rapid encryption (<10 hours) underscores the need for immediate mitigation. MFA and network access restrictions are critical supplementary controls.Credential rotation is critical even after patching (attackers reuse old credentials),MFA bypass techniques (e.g., Virtual Office Portal abuse) require additional controls,Rapid attack timelines (<4 hours) necessitate real-time detection capabilities,Default configurations (e.g., SSLVPN Default Users Group) can introduce risk,LDAP-synchronized accounts require strict access reviewsInitial impact assessment was inaccurate (underestimated scope from 5% to 100% of users).,Cloud-stored firewall configurations are high-value targets for threat actors.,Need for stronger access controls and monitoring of cloud backup environments.,Importance of transparent communication during incident response.Underestimation of incident scale can erode trust; transparency is critical. Weak authentication mechanisms in cloud services pose significant risks. Firewall configuration files are high-value targets for threat actors seeking insider knowledge for targeted attacks.Cloud backup services can become high-value targets if not properly secured.,Initial breach assessments may underestimate scope; thorough investigations are critical.,Multi-factor authentication and rate-limiting are essential for preventing brute-force attacks.,Vendor transparency is crucial for maintaining customer trust during incidents.,Supply-chain risks require diversified security stacks and zero-trust architectures.Exposed credentials in backup files create systemic risk even if encrypted.,Rapid, coordinated attacks underscore the need for real-time monitoring and credential hygiene.,Vendor disclosures must be transparent about scope to prevent underestimation of threats.,MFA and least-privilege access are critical for mitigating VPN-based intrusions.Exposed Credentials Pose Significant Risk Even Without Brute-Force Attacks,Cloud Backup Services Must Implement Stricter Access Controls,Rapid Credential Rotation and MFA Are Critical for Mitigating VPN-Based Intrusions,Configuration Backups, Even Encrypted, Can Be Exploited for Targeted AttacksIsolation of cloud environments and API security are critical to preventing lateral movement. Proactive credential rotation advisories can mitigate downstream risks from exposed configuration files.Credential stuffing and weak MFA policies are primary attack vectors for ransomware groups.,Zero-day exploits require continuous vulnerability management and proactive mitigations.,Infostealers (e.g., Rhadamanthys) fuel credential-based attacks, necessitating monitoring of cybercrime markets.,Exposed, unpatched devices should be assumed compromised and investigated.MFA is critical for VPN/RDP access but must be universally applied (no exceptions).,Dark web monitoring for leaked credentials can preempt attacks.,Unpatched enterprise appliances (SonicWall/Cisco/Citrix) are high-value targets.,SEO poisoning and malicious ads bypass traditional email filters, requiring endpoint protection.,Credential stuffing/brute force attacks exploit weak lockout policies and password hygiene.
What recommendations has the company implemented to improve cybersecurity ?
Implemented Recommendations: The company has implemented the following recommendations to improve cybersecurity: Organizations with SMA appliances are recommended to check the devices for potential compromise by acquiring disk images, which should prevent interference from the rootkit. GTIG provides a set of indicators of compromise along with the signs analysts should look for to determine if the device was hacked., Enforce MFA for All Administrative and Remote Access, Implement comprehensive MFA and conditional access policies for VPNs/remote access., Enforce strong lockout policies and password hygiene to mitigate credential stuffing., Monitor for Unusual Authentication Patterns or Network Scans, Conduct Forensic Analysis to Detect Lateral Movement, Assume breach for internet-exposed, vulnerable devices and conduct thorough investigations., Apply security updates promptly to prevent ransomware attacks., Category: Response, , Deploy behavioral WAFs and anomaly detection for zero-day exploit prevention., Category: Detection, , Disable Unnecessary External Management Interfaces (HTTP/S, SSH), Category: Prevention, , Immediate Credential Reset for All SonicWall SSL VPN Users, Implement Zero Trust Principles for VPN Access, Monitor dark web for stolen credentials and proactively rotate compromised accounts., Segment networks to limit lateral movement in case of ransomware infections., Adopt continuous vulnerability management with prioritized patching for critical CVEs. and Review and Harden Firewall Configuration Backups.
References
Where can I find more information about each incident ?
Incident : Multiple SON705050724
Source: SonicWall Capture Labs
Incident : Cyberattack SON105050824
Source: SonicWall 2024 Cyber Threat Report
Incident : Cyberattack SON407050824
Source: SonicWall Cyber Threat Report
Incident : Remote Code Execution SON502042125
Source: Arctic Wolf
Incident : Remote Code Execution SON502042125
Source: Federal agencies
Incident : Malware (Rootkit) SON417071725
Source: Google Threat Intelligence Group (GTIG)
Incident : Ransomware SON517080325
Source: Arctic Wolf Labs
Incident : ransomware SON2902029091125
Source: SonicWall Public Advisory (SNLWID-2024-0015)
Date Accessed: 2024-08-01
Incident : ransomware SON2902029091125
Source: Bitsight Research (Emma Stevens)
Date Accessed: 2025-08-07
Incident : ransomware SON2902029091125
Source: ThreatLocker/Arctic Wolf Alerts
Date Accessed: 2025-07-22
Incident : ransomware SON0492204092925
Source: SonicWall Security Advisory (CVE-2024-40766)
Date Accessed: 2024-08
Incident : Data Exposure SON1091810100325
Source: SecurityAffairs
URL: https://securityaffairs.com/
Date Accessed: 2025-09-18
Incident : Data Breach SON2392523100925
Source: The Register
Incident : Data Breach SON2392523100925
Source: SonicWall Official Statement (September 2023)
Incident : Data Breach SON2392523100925
Source: Arctic Wolf Threat Intelligence Analysis
Incident : Data Breach SON2892228101025
Source: The Register
Incident : Data Breach SON5492754101225
Source: BleepingComputer
Incident : Unauthorized Access SON1132511101325
Source: Huntress Security Research
Incident : Unauthorized Access SON1132511101325
Source: SonicWall Advisory (MySonicWall.com)
Incident : Unauthorized Access SON1232512101325
Source: Huntress Security Research
Incident : Unauthorized Access SON1232512101325
Source: SonicWall Advisory (MySonicWall.com)
Incident : Data Breach SON0592205110525
Source: SonicWall Official Statement (September 17, 2023)
Incident : Data Breach SON0592205110525
Source: SonicWall Update (October 9, 2023)
Incident : Data Breach SON0592205110525
Source: Huntress Report on SonicWall SSLVPN Attacks (October 13, 2023)
Incident : Ransomware SON3832338111925
Source: Beazley Security Q3 2025 Report
Incident : Ransomware SON3832338111925
Source: SonicWall SSL VPN Attacks Escalate, Bypassing MFA
Incident : Ransomware SON3832338111925
Source: NIST CVE Database (CVE-2025-53770, CVE-2025-54309, etc.)
Incident : Ransomware SON5792057112025
Source: Beazley Security Q3 2024 Ransomware Report
Date Accessed: 2024-10-01
Where can stakeholders find additional resources on cybersecurity best practices ?
Additional Resources: Stakeholders can find additional resources on cybersecurity best practices at and Source: SonicWall Capture Labs, and Source: SonicWall 2024 Cyber Threat Report, and Source: SonicWall Cyber Threat Report, and Source: Arctic Wolf, and Source: Federal agencies, and Source: Google Threat Intelligence Group (GTIG), and Source: Arctic Wolf Labs, and Source: The RegisterDate Accessed: 2025-08-07, and Source: Rapid7 AdvisoryDate Accessed: 2025-08-07, and Source: SonicWall Public Advisory (SNLWID-2024-0015)Date Accessed: 2024-08-01, and Source: Bitsight Research (Emma Stevens)Date Accessed: 2025-08-07, and Source: ThreatLocker/Arctic Wolf AlertsDate Accessed: 2025-07-22, and Source: Arctic Wolf ResearchDate Accessed: 2025-07, and Source: Rapid7 AnalysisDate Accessed: 2025-07, and Source: SonicWall Security Advisory (CVE-2024-40766)Date Accessed: 2024-08, and Source: SecurityAffairsUrl: https://securityaffairs.com/Date Accessed: 2025-09-18, and Source: The Register, and Source: SonicWall Official Statement (September 2023), and Source: Arctic Wolf Threat Intelligence Analysis, and Source: The Register, and Source: TechRadar ProUrl: https://www.techradar.com, and Source: Dark ReadingUrl: https://www.darkreading.com, and Source: The RegisterUrl: https://www.theregister.com, and Source: CSO OnlineUrl: https://www.csoonline.com, and Source: The Hacker NewsUrl: https://thehackernews.com, and Source: BleepingComputerUrl: https://www.bleepingcomputer.com, and Source: Arctic WolfUrl: https://arcticwolf.com, and Source: Huntress Security Research, and Source: SonicWall Advisory (MySonicWall.com)Url: https://www.mysonicwall.com, and Source: Huntress Security Research, and Source: SonicWall Advisory (MySonicWall.com), and Source: SonicWall Official Statement (September 17, 2023), and Source: SonicWall Update (October 9, 2023), and Source: Huntress Report on SonicWall SSLVPN Attacks (October 13, 2023), and Source: Beazley Security Q3 2025 Report, and Source: SonicWall SSL VPN Attacks Escalate, Bypassing MFA, and Source: NIST CVE Database (CVE-2025-53770, CVE-2025-54309, etc.)Url: https://nvd.nist.gov/, and Source: Beazley Security Q3 2024 Ransomware ReportDate Accessed: 2024-10-01.
Investigation Status
What is the current status of the investigation for each incident ?
Incident : Ransomware SON517080325
Investigation Status: Ongoing
Incident : ransomware SON2902029091125
Investigation Status: ongoing (SonicWall investigating additional exploitation as of 2025-08)
Incident : ransomware SON0492204092925
Investigation Status: Ongoing (active attacks observed as of July 2025)
Incident : Data Exposure SON1091810100325
Investigation Status: Ongoing (collaboration with cybersecurity experts and law enforcement)
Incident : Data Breach SON2392523100925
Investigation Status: Completed (independent investigation and external forensics review concluded)
Incident : Data Breach SON2892228101025
Investigation Status: Ongoing (Customers urged to take remediation actions)
Incident : Data Breach SON5492754101225
Investigation Status: Concluded (Internal Investigation with Mandiant Assistance)
Incident : Unauthorized Access SON1132511101325
Investigation Status: Ongoing (Huntress and SonicWall Collaborating on Remediation)
Incident : Unauthorized Access SON1232512101325
Investigation Status: Ongoing (Collaboration Between SonicWall, Huntress, and Affected Organizations)
Incident : Data Breach SON0592205110525
Investigation Status: Completed (by Mandiant)
Incident : Ransomware SON3832338111925
Investigation Status: Ongoing (Beazley Security Labs & Affected Vendors)
Incident : Ransomware SON5792057112025
Investigation Status: Completed (Beazley Security Analysis)
How does the company communicate the status of incident investigations to stakeholders ?
Communication of Investigation Status: The company communicates the status of incident investigations to stakeholders through Updated security advisory and revised CVSS score, Sonicwall Public Advisory (Snlwid-2024-0015), Rapid7 Customer Notifications, Media Alerts Via The Register, Public Advisory Issued (2025-09-18), Customers Notified Via Mysonicwall Accounts (Flagged Serial Numbers For Affected Devices), Detailed Remediation Steps Provided, Public Disclosure Updates, Customer Advisories To Rotate Credentials And Delete Backups, Public Notification Via Advisory, Direct Notification To Impacted Partners And Customers, Public Advisory (October 8), Collaboration With Cybersecurity Media (Dark Reading, The Register, Etc.), Sonicwall Advisory Via Mysonicwall.Com, Urgent Customer Notifications, Collaboration With Security Partners (E.G., Huntress), Sonicwall Advisory Via Mysonicwall.Com, Urgent Customer Notifications, Public Disclosure (Via Huntress And Security Media), Public Disclosure (2023-09-17), Update On Investigation Completion (2023-10-09), Assurance Of Product Safety, Beazley Security Advisories, Vendor Security Bulletins (E.G., Sonicwall, Microsoft) and Public Report By Beazley Security.
Stakeholder and Customer Advisories
Were there any advisories issued to stakeholders or customers for each incident ?
Incident : ransomware SON2902029091125
Stakeholder Advisories: Sonicwall Updated Mitigation Guidance, Rapid7 Customer Notifications.
Customer Advisories: Patch immediatelyEnable MFARestrict Virtual Office portal access
Incident : ransomware SON0492204092925
Stakeholder Advisories: Reset All Sonicwall Credentials (Including Ldap-Synchronized Accounts), Review Mfa Configurations For Otp Vulnerabilities, Audit Ssl Vpn Access Logs For Anomalous Activity.
Customer Advisories: Organizations using SonicWall Gen 6/7 firewalls should assume credential compromise if CVE-2024-40766 was unpatched pre-August 2024Monitor for signs of Akira ransomware (e.g., .akira extensions, ransom notes)Prepare for potential data breach notifications if exfiltration occurred
Incident : Data Exposure SON1091810100325
Stakeholder Advisories: Customers Advised To Check Mysonicwall Accounts For Flagged Serial Numbers And Follow Remediation Steps.
Customer Advisories: Reset credentials immediately if cloud backups are enabledImport new preference files (with awareness of VPN/TOTP disruptions)Reconfigure VPN pre-shared keys and TOTP post-importFollow manual remediation guidance if unable to import new files
Incident : Data Breach SON2392523100925
Stakeholder Advisories: Customers Advised To Delete Cloud Backups, Change Mysonicwall Credentials, Rotate Shared Secrets/Passwords, And Recreate Backups Locally..
Customer Advisories: Treat incident seriously despite no evidence of compromise to production firewalls or customer-hosted systems.
Incident : Data Breach SON2892228101025
Stakeholder Advisories: Sonicwall Notified All Impacted Partners And Customers With Remediation Guidance..
Customer Advisories: Delete existing cloud backups, change credentials, rotate shared secrets, and recreate configurations locally.
Incident : Data Breach SON5492754101225
Stakeholder Advisories: Urgent Customer Notifications, Public Disclosure (October 8 Update).
Customer Advisories: Reset all credentials associated with MySonicWall portal.Regenerate encryption keys for firewall backups.Update firmware to the latest secure versions.Monitor networks for anomalous activity.Conduct forensic audits of firewall configurations.Review and harden VPN and access control settings.
Incident : Unauthorized Access SON1132511101325
Stakeholder Advisories: Sonicwall Urgent Customer Advisory, Huntress Threat Briefing For Partners.
Customer Advisories: Check device status via MySonicWall.comFollow immediate protection steps (credential resets, service restrictions).
Incident : Unauthorized Access SON1232512101325
Stakeholder Advisories: Sonicwall Urgent Customer Advisory, Huntress Threat Briefing, General Cybersecurity Alerts (E.G., Cisa, Industry Forums).
Customer Advisories: Check Device Status via MySonicWall.comFollow Immediate Mitigation Steps (Credential Resets, Service Disabling)Enable MFA and Enhanced LoggingReport Suspicious Activity to SonicWall Support
Incident : Data Breach SON0592205110525
Stakeholder Advisories: Customers advised to reset credentials for MySonicWall accounts, LDAP/RADIUS/TACACS+ servers, and VPN interfaces.
Customer Advisories: Immediate credential rotation recommended for all potentially exposed secrets.
Incident : Ransomware SON3832338111925
Stakeholder Advisories: Beazley Security Advisories, Vendor Patches/Workarounds (Sonicwall, Microsoft, Etc.).
Customer Advisories: Urgent Patching NoticesMFA Enforcement Guidelines
Incident : Ransomware SON5792057112025
Stakeholder Advisories: Beazley Security Report (Public).
Customer Advisories: SonicWall (Cloud Breach Notification)
What advisories does the company provide to stakeholders and customers following an incident ?
Advisories Provided: The company provides the following advisories to stakeholders and customers following an incident: were Sonicwall Updated Mitigation Guidance, Rapid7 Customer Notifications, Patch Immediately, Enable Mfa, Restrict Virtual Office Portal Access, , Reset All Sonicwall Credentials (Including Ldap-Synchronized Accounts), Review Mfa Configurations For Otp Vulnerabilities, Audit Ssl Vpn Access Logs For Anomalous Activity, Organizations Using Sonicwall Gen 6/7 Firewalls Should Assume Credential Compromise If Cve-2024-40766 Was Unpatched Pre-August 2024, Monitor For Signs Of Akira Ransomware (E.G., .Akira Extensions, Ransom Notes), Prepare For Potential Data Breach Notifications If Exfiltration Occurred, , Customers Advised To Check Mysonicwall Accounts For Flagged Serial Numbers And Follow Remediation Steps, Reset Credentials Immediately If Cloud Backups Are Enabled, Import New Preference Files (With Awareness Of Vpn/Totp Disruptions), Reconfigure Vpn Pre-Shared Keys And Totp Post-Import, Follow Manual Remediation Guidance If Unable To Import New Files, , Customers Advised To Delete Cloud Backups, Change Mysonicwall Credentials, Rotate Shared Secrets/Passwords, And Recreate Backups Locally., Treat Incident Seriously Despite No Evidence Of Compromise To Production Firewalls Or Customer-Hosted Systems., , Sonicwall Notified All Impacted Partners And Customers With Remediation Guidance., Delete Existing Cloud Backups, Change Credentials, Rotate Shared Secrets, And Recreate Configurations Locally., , Urgent Customer Notifications, Public Disclosure (October 8 Update), Reset All Credentials Associated With Mysonicwall Portal., Regenerate Encryption Keys For Firewall Backups., Update Firmware To The Latest Secure Versions., Monitor Networks For Anomalous Activity., Conduct Forensic Audits Of Firewall Configurations., Review And Harden Vpn And Access Control Settings., , Sonicwall Urgent Customer Advisory, Huntress Threat Briefing For Partners, Check Device Status Via Mysonicwall.Com, Follow Immediate Protection Steps (Credential Resets, Service Restrictions)., , Sonicwall Urgent Customer Advisory, Huntress Threat Briefing, General Cybersecurity Alerts (E.G., Cisa, Industry Forums), Check Device Status Via Mysonicwall.Com, Follow Immediate Mitigation Steps (Credential Resets, Service Disabling), Enable Mfa And Enhanced Logging, Report Suspicious Activity To Sonicwall Support, , Customers advised to reset credentials for MySonicWall accounts, LDAP/RADIUS/TACACS+ servers, and VPN interfaces., Immediate credential rotation recommended for all potentially exposed secrets., Beazley Security Advisories, Vendor Patches/Workarounds (Sonicwall, Microsoft, Etc.), Urgent Patching Notices, Mfa Enforcement Guidelines, , Beazley Security Report (Public), Sonicwall (Cloud Breach Notification) and .
Initial Access Broker
How did the initial access broker gain entry for each incident ?
Incident : Ransomware SON000103024
Entry Point: VPN vulnerability
Incident : Ransomware SON517080325
Entry Point: SonicWall SSL VPN
Reconnaissance Period: From at least October 2024
Backdoors Established: OVERSTEP
Incident : ransomware SON2902029091125
Entry Point: Cve-2024-40766 Exploitation, Sslvpn Misconfigurations, Legacy Credentials, Virtual Office Portal Public Access,
High Value Targets: SonicWall firewall/VPN devices
Data Sold on Dark Web: SonicWall firewall/VPN devices
Incident : ransomware SON0492204092925
Entry Point: Sonicwall Ssl Vpn (Via Cve-2024-40766 Or Stolen Credentials), Misconfigured Sslvpn Default Users Group, Virtual Office Portal (Otp Mfa Bypass),
Reconnaissance Period: Months (credentials harvested in prior intrusions)
Backdoors Established: ['Additional domain accounts created', 'RMM tools installed', 'C2 channels established']
High Value Targets: Domain Controllers, Virtual Machine Storage, Backup Systems,
Data Sold on Dark Web: Domain Controllers, Virtual Machine Storage, Backup Systems,
Incident : Data Exposure SON1091810100325
Entry Point: MySonicWall cloud backup service
High Value Targets: Firewall Preference Files,
Data Sold on Dark Web: Firewall Preference Files,
Incident : Data Breach SON2392523100925
Entry Point: Unauthorized Access To Cloud Storage Environment,
High Value Targets: Firewall Configuration Files (For Network Mapping And Pivoting),
Data Sold on Dark Web: Firewall Configuration Files (For Network Mapping And Pivoting),
Incident : Data Breach SON2892228101025
Entry Point: Mysonicwall Cloud Service (Via Brute-Force Attack),
High Value Targets: Firewall Configuration Files Containing Network Topology, Credentials, And Access Policies,
Data Sold on Dark Web: Firewall Configuration Files Containing Network Topology, Credentials, And Access Policies,
Incident : Data Breach SON5492754101225
Entry Point: Mysonicwall Portal, Cloud Backup Service,
High Value Targets: Firewall Configurations, Vpn Settings, Network Topology Data,
Data Sold on Dark Web: Firewall Configurations, Vpn Settings, Network Topology Data,
Incident : Unauthorized Access SON1132511101325
Entry Point: Sonicwall Ssl Vpn Devices, Exposed Credentials In Backup Files,
Reconnaissance Period: ['Brief Connections for Credential Validation (October 4 Onward)']
High Value Targets: Firewall Configurations, Local Windows Accounts, Network Access,
Data Sold on Dark Web: Firewall Configurations, Local Windows Accounts, Network Access,
Incident : Unauthorized Access SON1232512101325
Entry Point: Sonicwall Ssl Vpn (Via Exposed Credentials), Potential Exploitation Of Leaked Firewall Backups,
Reconnaissance Period: Observed Since 2023-10-04 (Clustered Authentication Attempts Over 2 Days)
High Value Targets: Firewall Configurations, Local Windows Accounts, Network Access,
Data Sold on Dark Web: Firewall Configurations, Local Windows Accounts, Network Access,
Incident : Data Breach SON0592205110525
Entry Point: Unauthorized API call to cloud backup environment
High Value Targets: Firewall Configuration Files, Authentication Credentials,
Data Sold on Dark Web: Firewall Configuration Files, Authentication Credentials,
Incident : Ransomware SON3832338111925
Entry Point: Compromised Vpn Credentials (48%), External Service Exploits (23%),
Reconnaissance Period: Prolonged (Akira Campaign Against SonicWall)
Backdoors Established: Likely (Post-Exploitation)
High Value Targets: Vpn Appliances, Corporate Data Repositories, Zero-Day Vulnerable Systems,
Data Sold on Dark Web: Vpn Appliances, Corporate Data Repositories, Zero-Day Vulnerable Systems,
Incident : Ransomware SON5792057112025
Entry Point: Vpn Credentials (48%), Rdp (6%), External Services (24%), Seo Poisoning (Rhysida),
Backdoors Established: Likely (Post-Exploitation)
High Value Targets: Enterprise Appliances (Sonicwall/Cisco/Citrix), Configuration Backups,
Data Sold on Dark Web: Enterprise Appliances (Sonicwall/Cisco/Citrix), Configuration Backups,
Post-Incident Analysis
What were the root causes and corrective actions taken for each incident ?
Incident : Ransomware SON000103024
Root Causes: Vulnerability CVE-2024-40766
Corrective Actions: Patching the vulnerability
Incident : Malware (Rootkit) SON417071725
Root Causes: Exploitation of known vulnerabilities to steal administrator credentials
Incident : Ransomware SON517080325
Root Causes: Zero-day vulnerability in SonicWall SSL VPN
Corrective Actions: Disable SonicWall SSL VPN service, enable security services, enforce MFA, practice good password hygiene, remove inactive user accounts, block suspicious VPN authentication attempts
Incident : ransomware SON2902029091125
Root Causes: Unpatched Cve-2024-40766 (Known Since August 2024), Default Ldap Group Over-Provisioning, Publicly Accessible Virtual Office Portal, Legacy Credential Reuse During Migrations, Insufficient Mfa Enforcement,
Corrective Actions: Mandatory Patching With Verification, Mfa Enforcement For All Sonicwall Services, Network Segmentation For Vpn Portals, Credential Hygiene Audits, Dark Web Monitoring For Exposed Credentials,
Incident : ransomware SON0492204092925
Root Causes: Failure To Rotate Credentials After Patching Cve-2024-40766, Overprivileged Ldap-Synchronized Accounts In Sslvpn Default Users Group, Lack Of Mfa Resilience (Otp Bypass Via Virtual Office Portal), Insufficient Monitoring For Rapid Attack Patterns (<4 Hours), Default Configurations Enabling Lateral Movement (Smb/Rdp),
Corrective Actions: Mandate Credential Rotation After Critical Vulnerability Patches, Audit All Ldap Group Mappings To Sensitive Services, Implement Behavioral Detection For Impacket/Rclone Usage, Segment Networks To Limit Domain Controller Exposure, Deploy Application Control To Block Unauthorized Remote Tools,
Incident : Data Exposure SON1091810100325
Root Causes: Brute Force Attacks On Mysonicwall Cloud Backups, Insufficient Protection For Stored Preference Files,
Incident : Data Breach SON2392523100925
Root Causes: Inadequate Access Controls For Cloud Backup Storage., Insufficient Monitoring/Logging Of Cloud Storage Environment., Initial Underestimation Of Breach Scope.,
Corrective Actions: Hardened Infrastructure With Additional Logging., Implemented Stronger Authentication Controls., Disabled Vulnerable Cloud Backup Service., Advised Customers On Mitigation Steps (Credential Rotation, Local Backups).,
Incident : Data Breach SON2892228101025
Root Causes: Weak Authentication Mechanisms In Mysonicwall Cloud Service, Enabling Brute-Force Attacks., Underestimation Of The Incident'S Scope During Initial Disclosure.,
Corrective Actions: Enhanced Authentication For Cloud Services., Improved Incident Communication Protocols., Development Of Tools For Customer Remediation.,
Incident : Data Breach SON5492754101225
Root Causes: Inadequate Brute-Force Protection (Lack Of Rate-Limiting/Mfa)., Underestimation Of Breach Scope During Initial Assessment., Centralized Cloud Storage Creating A Single Point Of Failure., Persistent Vulnerabilities In Sonicwall Products (Historical Context Since 2021).,
Corrective Actions: Collaboration With Mandiant For Forensic Analysis., Public Disclosure Revision To Reflect Full Scope., Recommendations For Customer Remediation (Credential Resets, Key Regeneration)., Emphasis On Diversifying Security Stacks And Zero-Trust Adoption.,
Incident : Unauthorized Access SON1132511101325
Root Causes: Exposure Of Credentials In Firewall Backup Files (Despite Encryption)., Lack Of Mfa Enforcement For Vpn/Admin Access., Insufficient Monitoring For Clustered Authentication Attempts., Delayed Or Incomplete Vendor Disclosure About Breach Scope.,
Corrective Actions: Sonicwall: Secure Backup Files By Redacting/Encrypting Credentials Separately., Customers: Implement Zero-Trust Principles (Mfa, Least Privilege, Segmentation)., Enhance Logging And Anomaly Detection For Vpn/Authentication Systems., Regular Credential Rotation And Audits For Network Devices.,
Incident : Unauthorized Access SON1232512101325
Root Causes: Exposed Or Reused Credentials In Sonicwall Ssl Vpn, Inadequate Protection Of Firewall Configuration Backups In Mysonicwall Cloud, Lack Of Mfa Enforcement For Administrative Access, Delayed Detection Due To Brief, Surgical Attack Patterns,
Corrective Actions: Sonicwall To Enhance Cloud Backup Security (E.G., Additional Encryption, Access Controls), Mandatory Mfa For All Sonicwall Product Access, Automated Alerts For Unusual Authentication Patterns, Regular Credential Rotation Policies For Customers, Third-Party Audits Of Sonicwall’S Security Practices,
Incident : Data Breach SON0592205110525
Root Causes: Insufficient Api Access Controls, Lack Of Segmentation In Cloud Backup Environment,
Corrective Actions: Api Security Enhancements, Customer Credential Reset Advisory,
Incident : Ransomware SON3832338111925
Root Causes: Weak Mfa And Lockout Policies On Vpns (Sonicwall)., Delayed Patching Of Zero-Day Vulnerabilities (Cve-2025-*)., Commoditization Of Stolen Credentials Via Infostealers (E.G., Rhadamanthys)., Insufficient Network Segmentation Enabling Lateral Movement.,
Corrective Actions: Mandatory Mfa For All Remote Access (Vpn, Rdp)., Automated Vulnerability Scanning And Patch Prioritization., Dark Web Monitoring For Credential Leaks., Network Segmentation And Micro-Segmentation For Critical Assets., Incident Response Playbooks Updated For Ransomware/Zero-Day Scenarios.,
Incident : Ransomware SON5792057112025
Root Causes: Lack Of Universal Mfa On Vpn/Rdp, Weak Lockout Policies (Sonicwall), Unpatched Critical Vulnerabilities (Cisco/Citrix), Credential Hygiene Failures (Reused/Weak Passwords), Insufficient Dark Web Monitoring For Leaked Credentials,
Corrective Actions: Mandate Mfa For All Remote Access., Enforce Password Complexity And Lockout Policies., Prioritize Patching For Internet-Facing Appliances., Deploy Dark Web Monitoring For Credential Leaks., Train Users On Seo Poisoning And Social Engineering Risks.,
What is the company's process for conducting post-incident analysis ?
Post-Incident Analysis Process: The company's process for conducting post-incident analysis is described as Google Threat Intelligence Group (GTIG), Mandiant, SonicWall’s Product Security Incident Response Team (PSIRT), Rapid7, Threatlocker, Arctic Wolf, , Arctic Wolf (Research), Rapid7 (Research), , Anomalous Smb Activity (Impacket), Ldap Discovery Activity, Execution Of Network Scanning/Archival Tools (Winrar, Rclone), Logins From Vps Providers, , Cybersecurity Experts, , Independent Investigation, External Forensics Review, , , Mandiant, , Recommended For All Customers, , Huntress Security Researchers, , , Huntress Security Researchers, Partner Collaborations, , Mandated for All Affected Systems, Mandiant (Incident Response Investigation), , Beazley Security Labs, Cybersecurity Vendors (E.G., Sonicwall, Microsoft), , Recommended (for Zero-Day Exploits), Beazley Security (Insurance/Cybersecurity Arm), , Dark Web Monitoring For Credentials, .
What corrective actions has the company taken based on post-incident analysis ?
Corrective Actions Taken: The company has taken the following corrective actions based on post-incident analysis: Patching the vulnerability, Disable SonicWall SSL VPN service, enable security services, enforce MFA, practice good password hygiene, remove inactive user accounts, block suspicious VPN authentication attempts, Mandatory Patching With Verification, Mfa Enforcement For All Sonicwall Services, Network Segmentation For Vpn Portals, Credential Hygiene Audits, Dark Web Monitoring For Exposed Credentials, , Mandate Credential Rotation After Critical Vulnerability Patches, Audit All Ldap Group Mappings To Sensitive Services, Implement Behavioral Detection For Impacket/Rclone Usage, Segment Networks To Limit Domain Controller Exposure, Deploy Application Control To Block Unauthorized Remote Tools, , Hardened Infrastructure With Additional Logging., Implemented Stronger Authentication Controls., Disabled Vulnerable Cloud Backup Service., Advised Customers On Mitigation Steps (Credential Rotation, Local Backups)., , Enhanced Authentication For Cloud Services., Improved Incident Communication Protocols., Development Of Tools For Customer Remediation., , Collaboration With Mandiant For Forensic Analysis., Public Disclosure Revision To Reflect Full Scope., Recommendations For Customer Remediation (Credential Resets, Key Regeneration)., Emphasis On Diversifying Security Stacks And Zero-Trust Adoption., , Sonicwall: Secure Backup Files By Redacting/Encrypting Credentials Separately., Customers: Implement Zero-Trust Principles (Mfa, Least Privilege, Segmentation)., Enhance Logging And Anomaly Detection For Vpn/Authentication Systems., Regular Credential Rotation And Audits For Network Devices., , Sonicwall To Enhance Cloud Backup Security (E.G., Additional Encryption, Access Controls), Mandatory Mfa For All Sonicwall Product Access, Automated Alerts For Unusual Authentication Patterns, Regular Credential Rotation Policies For Customers, Third-Party Audits Of Sonicwall’S Security Practices, , Api Security Enhancements, Customer Credential Reset Advisory, , Mandatory Mfa For All Remote Access (Vpn, Rdp)., Automated Vulnerability Scanning And Patch Prioritization., Dark Web Monitoring For Credential Leaks., Network Segmentation And Micro-Segmentation For Critical Assets., Incident Response Playbooks Updated For Ransomware/Zero-Day Scenarios., , Mandate Mfa For All Remote Access., Enforce Password Complexity And Lockout Policies., Prioritize Patching For Internet-Facing Appliances., Deploy Dark Web Monitoring For Credential Leaks., Train Users On Seo Poisoning And Social Engineering Risks., .
Additional Questions
General Information
Who was the attacking group in the last incident ?
Last Attacking Group: The attacking group in the last incident were an UNC6148, Akira Ransomware Group, Akira ransomware gangFog ransomware gang, Name: Akira ransomware affiliatesAttribution Confidence: HighMotivation: ['financial gain', 'opportunistic']Sophistication Level: Moderate to High, Unnamed Threat Actors, State-sponsored threat actor, Akira RansomwareQilin RansomwareINC RansomwareRhadamanthys Infostealer and AkiraQilinINC RansomwareRhysidaUnnamed Sophisticated Threat Actor (Cisco Exploits).
Incident Details
What was the most recent incident detected ?
Most Recent Incident Detected: The most recent incident detected was on 2025-07-15.
What was the most recent incident publicly disclosed ?
Most Recent Incident Publicly Disclosed: The most recent incident publicly disclosed was on 2024-10-01T00:00:00Z.
Impact of the Incidents
What was the highest financial loss from an incident ?
Highest Financial Loss: The highest financial loss from an incident was $5.34 million.
What was the most significant data compromised in an incident ?
Most Significant Data Compromised: The most significant data compromised in an incident were Sensitive credentials, persist.db database, certificate files, Yes (exfiltrated prior to encryption), Firewall preference files (encrypted credentials and configuration details), , Firewall Configuration Files, Network Policies, User/Group/Domain Settings, DNS and Log Settings, Certificates, , Firewall Configuration Files (Network Rules, Access Policies, VPN Configurations), Service Credentials (LDAP, RADIUS, SNMP), Admin Usernames and Passwords (if stored in config), , Firewall Configuration Backups, Encrypted Credentials, Network Settings, VPN Configurations, Access Controls, , Firewall Configuration Data, Credentials (Local Windows Accounts, VPN Pre-Shared Keys, LDAP, SNMP, API Secrets), , Firewall Configuration Data, Credentials (Potential), Network Access, , Firewall configuration backup files, Access credentials, Tokens, LDAP/RADIUS/TACACS+ passwords, VPN shared secrets, , VPN Credentials, Corporate Data (via Ransomware), Potential PII (via Infostealers), , Sensitive Configuration Backups (SonicWall Cloud Breach), Potential PII/Enterprise Data (via Ransomware) and .
What was the most significant system affected in an incident ?
Most Significant System Affected: The most significant system affected in an incident was Domain Controllersvirtual machine storagebackup systemsendpoints with RMM/EDR tools and SonicWall Firewalls with MySonicWall cloud backups enabled and MySonicWall Cloud Backup Service and MySonicWall Cloud Backup Service and MySonicWall PortalCloud Backup Service and SonicWall SSL VPN DevicesCompromised Customer Networks and SonicWall SSL VPN DevicesLocal Windows Accounts (Attempted Access)Firewall Configurations and MySonicWall cloud backup service and SonicWall SSLVPN AppliancesMicrosoft SharePointCrushFTP ServersCisco ASA VPNCitrix NetScaler and SonicWall VPN DevicesCisco ASA VPN AppliancesCitrix NetScaler GatewaysEnterprise Endpoints (via SEO Poisoning).
Response to the Incidents
What third-party assistance was involved in the most recent incident ?
Third-Party Assistance in Most Recent Incident: The third-party assistance involved in the most recent incident was Google Threat Intelligence Group (GTIG), Mandiant, SonicWall’s Product Security Incident Response Team (PSIRT), rapid7, threatlocker, arctic wolf, , arctic wolf (research), rapid7 (research), , cybersecurity experts, , independent investigation, external forensics review, , mandiant, , huntress security researchers, , huntress security researchers, partner collaborations, , mandiant (incident response investigation), , beazley security labs, cybersecurity vendors (e.g., sonicwall, microsoft), , beazley security (insurance/cybersecurity arm), .
What containment measures were taken in the most recent incident ?
Containment Measures in Most Recent Incident: The containment measures taken in the most recent incident were Disable SonicWall SSL VPN service, patching CVE-2024-40766credential rotationupgrading to SonicOS 7.3.0, Reset all SonicWall credentials (SSL VPN, OTP MFA secrets, LDAP sync accounts)Block logins from VPS hosting providersDisable Virtual Office Portal if unused, Blocked attackers' access to MySonicWall backups, Disabled cloud backup serviceDeleted compromised backups, Urged customers to delete existing cloud backupsEncouraged credential rotation and secret rotationRecommended recreating backups locally, Disclosure of Full ScopeUrgent Customer Advisories, Restrict WAN Management AccessDisable HTTP/S, SSH, and SSL VPN ServicesReset All Credentials (Local Admin, VPN Keys, LDAP, SNMP, API Secrets)Enable Enhanced Logging, Restrict WAN Management AccessDisable HTTP/S, SSH, and SSL VPN Services TemporarilyReset All Credentials (Local Admin, VPN Pre-Shared Keys, LDAP, SNMP, API/DDNS Secrets)Enable Enhanced Logging for Suspicious Activity, Isolation of compromised cloud environmentAPI access restrictions, Temporary Mitigations for Zero-DaysNetwork Access LockdownsCredential Rotation (for VPNs) and MFA Enforcement for Remote AccessDark Web Monitoring for Leaked CredentialsPatching Critical Vulnerabilities (Cisco/Citrix)Compensating Controls for MFA-Exempt Accounts.
Data Breach Information
What was the most sensitive data compromised in a breach ?
Most Sensitive Data Compromised: The most sensitive data compromised in a breach were Tokens, Potential PII/Enterprise Data (via Ransomware), Network Settings, Access Controls, LDAP/RADIUS/TACACS+ passwords, Sensitive Configuration Backups (SonicWall Cloud Breach), Firewall preference files (encrypted credentials and configuration details), Firewall Configuration Files (Network Rules, Access Policies, VPN Configurations), Firewall Configuration Data, Firewall configuration backup files, Potential PII (via Infostealers), Network Policies, Yes (exfiltrated prior to encryption), VPN Credentials, Credentials (Potential), Network Access, Firewall Configuration Backups, Credentials (Local Windows Accounts, VPN Pre-Shared Keys, LDAP, SNMP, API Secrets), Corporate Data (via Ransomware), Service Credentials (LDAP, RADIUS, SNMP), User/Group/Domain Settings, VPN Configurations, Certificates, Access credentials, Admin Usernames and Passwords (if stored in config), Firewall Configuration Files, Encrypted Credentials, VPN shared secrets, DNS and Log Settings, Sensitive credentials, persist.db database and certificate files.
What was the number of records exposed in the most significant breach ?
Number of Records Exposed in Most Significant Breach: The number of records exposed in the most significant breach was 105.0.
Regulatory Compliance
What was the most significant legal action taken for a regulatory violation ?
Most Significant Legal Action: The most significant legal action taken for a regulatory violation was Possible Lawsuits from Affected Customers, Potential Regulatory Probes, .
Lessons Learned and Recommendations
What was the most significant lesson learned from past incidents ?
Most Significant Lesson Learned: The most significant lesson learned from past incidents was Credential stuffing/brute force attacks exploit weak lockout policies and password hygiene.
What was the most significant recommendation implemented to improve cybersecurity ?
Most Significant Recommendation Implemented: The most significant recommendation implemented to improve cybersecurity was Upgrade to SonicOS 7.3.0 with enhanced MFA protections, Enable multi-factor authentication (MFA) for MySonicWall accounts, Diversify security vendors to reduce dependency on single providers., Restrict WAN management access and disable unnecessary services (HTTP/S, SSH)., Apply patches promptly for critical vulnerabilities (e.g., Cisco/Citrix)., Monitor for Unusual Authentication Patterns or Network Scans, Enforce MFA for all remote access solutions (VPN, RDP, etc.) without exceptions., Audit firewall configurations for unauthorized changes or backdoors., Isolate affected devices until fully remediated., Implement multi-factor authentication (MFA) and least-privilege access for cloud services., Monitor for unusual access patterns or brute-force attempts on cloud services., Adopt zero-trust architectures to mitigate single-vendor risks., Audit and remove default/weak credentials from enterprise appliances., Implement multi-factor authentication (MFA) for cloud services, especially those storing sensitive configurations., Implement Zero Trust Principles for VPN Access, Adopt continuous vulnerability management with prioritized patching for critical CVEs., Review and Harden Firewall Configuration Backups, Category: Prevention, , Monitor for anomalous VPN logins (e.g., via Rapid7/Arctic Wolf), Proactive and comprehensive approach to cybersecurity, Educate customers on secure backup practices, including local storage of sensitive configurations., Regularly audit and rotate credentials and secrets stored in firewall configurations., Regularly audit and rotate credentials, shared secrets, and certificates., Enforce MFA for All Administrative and Remote Access, Implement dark web monitoring for leaked credentials., Enhance API security controls for cloud services storing sensitive data., Educate users on SEO poisoning risks (e.g., fake productivity tools)., Engage third-party security firms for incident response and forensic analysis., Segment networks to limit lateral movement post-compromise., Assume breach for internet-exposed, vulnerable devices and conduct thorough investigations., Regularly audit and rotate credentials stored in configuration files., Apply security updates promptly to prevent ransomware attacks., Category: Response, , Segment cloud environments to limit blast radius of breaches., Monitor for unusual access patterns in cloud storage environments., Enhance anomaly detection and monitoring for brute-force attempts., Practice good password hygiene, Immediate Credential Reset for All SonicWall SSL VPN Users, Monitor dark web for stolen credentials and proactively rotate compromised accounts., Prepare for follow-on attacks leveraging exfiltrated configuration data., Enable MFA for all administrative and remote access accounts., Enforce strong lockout policies and password hygiene to mitigate credential stuffing., Restrict Virtual Office portal access to internal networks only, Organizations with SMA appliances are recommended to check the devices for potential compromise by acquiring disk images, which should prevent interference from the rootkit. GTIG provides a set of indicators of compromise along with the signs analysts should look for to determine if the device was hacked., Monitor for unauthorized API calls and anomalous access patterns., Real-time threat intelligence, Conduct third-party security assessments for cloud backup solutions., Strengthen lockout policies to thwart brute force attacks., Conduct third-party audits of cloud backup infrastructures., Disable SonicWall SSL VPN service, Implement comprehensive MFA and conditional access policies for VPNs/remote access., Monitor for suspicious activity in firewall preference files, Remove inactive or unused local user accounts, Monitor for lateral movement or follow-on attacks using compromised credentials., Disable default LDAP group configurations to prevent over-provisioning, Enable Botnet Protection, Deploy behavioral WAFs and anomaly detection for zero-day exploit prevention., Avoid storing plaintext or weakly encrypted credentials in configuration backups., Disable Unnecessary External Management Interfaces (HTTP/S, SSH), Segment networks to limit lateral movement in case of ransomware infections., Apply SonicWall patches for CVE-2024-40766 immediately, Regularly audit cloud backup configurations, Heightened cybersecurity vigilance, Schedule remediation during low-activity periods to minimize downtime, Assume compromise if unpatched; conduct thorough incident response, Rotate legacy credentials, especially during Gen 6→Gen 7 firewall migrations, Implement multi-factor authentication (MFA) for cloud backup access., Enforce MFA on all remote access accounts, Review compliance with GDPR, NIST, and other relevant standards., Conduct Forensic Analysis to Detect Lateral Movement, Category: Detection, , Block VPN authentication attempts from specific ASNs, Implement MFA and rate-limiting for all cloud services., Robust defense mechanisms, Immediately reset all credentials linked to SonicWall devices (VPN, admin, API, etc.)., Conduct periodic credential rotation for firewall administrators, Avoid storing sensitive configuration files in cloud backups unless absolutely necessary., Regenerate encryption keys and update firmware post-breach., Conduct a thorough review of backup security practices (e.g. and encryption of sensitive fields)..
References
What is the most recent source of information about an incident ?
Most Recent Source: The most recent source of information about an incident are SonicWall SSL VPN Attacks Escalate, Bypassing MFA, Huntress Security Research, Arctic Wolf Threat Intelligence Analysis, Rapid7 Analysis, SonicWall Official Statement (September 2023), SonicWall Advisory (MySonicWall.com), SonicWall Cyber Threat Report, SonicWall Official Statement (September 17, 2023), SonicWall Update (October 9, 2023), Arctic Wolf Research, SonicWall Public Advisory (SNLWID-2024-0015), Huntress Report on SonicWall SSLVPN Attacks (October 13, 2023), ThreatLocker/Arctic Wolf Alerts, Federal agencies, Arctic Wolf, TechRadar Pro, The Register, Rapid7 Advisory, The Hacker News, Beazley Security Q3 2025 Report, BleepingComputer, Arctic Wolf Labs, NIST CVE Database (CVE-2025-53770, CVE-2025-54309, etc.), SonicWall Security Advisory (CVE-2024-40766), Dark Reading, SonicWall Capture Labs, SecurityAffairs, Bitsight Research (Emma Stevens), SonicWall 2024 Cyber Threat Report, Google Threat Intelligence Group (GTIG), CSO Online and Beazley Security Q3 2024 Ransomware Report.
What is the most recent URL for additional resources on cybersecurity best practices ?
Most Recent URL for Additional Resources: The most recent URL for additional resources on cybersecurity best practices is https://securityaffairs.com/, https://www.techradar.com, https://www.darkreading.com, https://www.theregister.com, https://www.csoonline.com, https://thehackernews.com, https://www.bleepingcomputer.com, https://arcticwolf.com, https://www.mysonicwall.com, https://nvd.nist.gov/ .
Investigation Status
What is the current status of the most recent investigation ?
Current Status of Most Recent Investigation: The current status of the most recent investigation is Ongoing.
Stakeholder and Customer Advisories
What was the most recent stakeholder advisory issued ?
Most Recent Stakeholder Advisory: The most recent stakeholder advisory issued was SonicWall updated mitigation guidance, Rapid7 customer notifications, Reset all SonicWall credentials (including LDAP-synchronized accounts), Review MFA configurations for OTP vulnerabilities, Audit SSL VPN access logs for anomalous activity, Customers advised to check MySonicWall accounts for flagged serial numbers and follow remediation steps, Customers advised to delete cloud backups, change MySonicWall credentials, rotate shared secrets/passwords, and recreate backups locally., SonicWall notified all impacted partners and customers with remediation guidance., Urgent Customer Notifications, Public Disclosure (October 8 Update), SonicWall Urgent Customer Advisory, Huntress Threat Briefing for Partners, SonicWall Urgent Customer Advisory, Huntress Threat Briefing, General Cybersecurity Alerts (e.g., CISA, Industry Forums), Customers advised to reset credentials for MySonicWall accounts, LDAP/RADIUS/TACACS+ servers, and VPN interfaces., Beazley Security Advisories, Vendor Patches/Workarounds (SonicWall, Microsoft, etc.), Beazley Security Report (Public), .
What was the most recent customer advisory issued ?
Most Recent Customer Advisory: The most recent customer advisory issued were an Patch immediatelyEnable MFARestrict Virtual Office portal access, Organizations using SonicWall Gen 6/7 firewalls should assume credential compromise if CVE-2024-40766 was unpatched pre-August 2024Monitor for signs of Akira ransomware (e.g., .akira extensions, ransom notes)Prepare for potential data breach notifications if exfiltration occurred, Reset credentials immediately if cloud backups are enabledImport new preference files (with awareness of VPN/TOTP disruptions)Reconfigure VPN pre-shared keys and TOTP post-importFollow manual remediation guidance if unable to import new files, Treat incident seriously despite no evidence of compromise to production firewalls or customer-hosted systems., Delete existing cloud backups, change credentials, rotate shared secrets, and recreate configurations locally., Reset all credentials associated with MySonicWall portal.Regenerate encryption keys for firewall backups.Update firmware to the latest secure versions.Monitor networks for anomalous activity.Conduct forensic audits of firewall configurations.Review and harden VPN and access control settings., Check device status via MySonicWall.comFollow immediate protection steps (credential resets, service restrictions)., Check Device Status via MySonicWall.comFollow Immediate Mitigation Steps (Credential Resets, Service Disabling)Enable MFA and Enhanced LoggingReport Suspicious Activity to SonicWall Support, Immediate credential rotation recommended for all potentially exposed secrets., Urgent Patching NoticesMFA Enforcement Guidelines and SonicWall (Cloud Breach Notification).
Initial Access Broker
What was the most recent entry point used by an initial access broker ?
Most Recent Entry Point: The most recent entry point used by an initial access broker were an VPN vulnerability, Unknown, SonicWall SSL VPN, Unauthorized API call to cloud backup environment and MySonicWall cloud backup service.
What was the most recent reconnaissance period for an incident ?
Most Recent Reconnaissance Period: The most recent reconnaissance period for an incident was From at least October 2024, Months (credentials harvested in prior intrusions), Brief Connections for Credential Validation (October 4 Onward), Observed Since 2023-10-04 (Clustered Authentication Attempts Over 2 Days), Prolonged (Akira Campaign Against SonicWall).
Post-Incident Analysis
What was the most significant root cause identified in post-incident analysis ?
Most Significant Root Cause: The most significant root cause identified in post-incident analysis was Vulnerability CVE-2024-40766, Exploitation of known vulnerabilities to steal administrator credentials, Zero-day vulnerability in SonicWall SSL VPN, Unpatched CVE-2024-40766 (known since August 2024)Default LDAP group over-provisioningPublicly accessible Virtual Office portalLegacy credential reuse during migrationsInsufficient MFA enforcement, Failure to rotate credentials after patching CVE-2024-40766Overprivileged LDAP-synchronized accounts in SSLVPN Default Users GroupLack of MFA resilience (OTP bypass via Virtual Office Portal)Insufficient monitoring for rapid attack patterns (<4 hours)Default configurations enabling lateral movement (SMB/RDP), Brute force attacks on MySonicWall cloud backupsInsufficient protection for stored preference files, Inadequate access controls for cloud backup storage.Insufficient monitoring/logging of cloud storage environment.Initial underestimation of breach scope., Weak authentication mechanisms in MySonicWall cloud service, enabling brute-force attacks.Underestimation of the incident's scope during initial disclosure., Inadequate brute-force protection (lack of rate-limiting/MFA).Underestimation of breach scope during initial assessment.Centralized cloud storage creating a single point of failure.Persistent vulnerabilities in SonicWall products (historical context since 2021)., Exposure of credentials in firewall backup files (despite encryption).Lack of MFA enforcement for VPN/admin access.Insufficient monitoring for clustered authentication attempts.Delayed or incomplete vendor disclosure about breach scope., Exposed or Reused Credentials in SonicWall SSL VPNInadequate Protection of Firewall Configuration Backups in MySonicWall CloudLack of MFA Enforcement for Administrative AccessDelayed Detection Due to Brief, Surgical Attack Patterns, Insufficient API access controlsLack of segmentation in cloud backup environment, Weak MFA and lockout policies on VPNs (SonicWall).Delayed patching of zero-day vulnerabilities (CVE-2025-*).Commoditization of stolen credentials via infostealers (e.g., Rhadamanthys).Insufficient network segmentation enabling lateral movement., Lack of Universal MFA on VPN/RDPWeak Lockout Policies (SonicWall)Unpatched Critical Vulnerabilities (Cisco/Citrix)Credential Hygiene Failures (Reused/Weak Passwords)Insufficient Dark Web Monitoring for Leaked Credentials.
What was the most significant corrective action taken based on post-incident analysis ?
Most Significant Corrective Action: The most significant corrective action taken based on post-incident analysis was Patching the vulnerability, Disable SonicWall SSL VPN service, enable security services, enforce MFA, practice good password hygiene, remove inactive user accounts, block suspicious VPN authentication attempts, Mandatory patching with verificationMFA enforcement for all SonicWall servicesNetwork segmentation for VPN portalsCredential hygiene auditsDark web monitoring for exposed credentials, Mandate credential rotation after critical vulnerability patchesAudit all LDAP group mappings to sensitive servicesImplement behavioral detection for Impacket/rclone usageSegment networks to limit Domain Controller exposureDeploy application control to block unauthorized remote tools, Hardened infrastructure with additional logging.Implemented stronger authentication controls.Disabled vulnerable cloud backup service.Advised customers on mitigation steps (credential rotation, local backups)., Enhanced authentication for cloud services.Improved incident communication protocols.Development of tools for customer remediation., Collaboration with Mandiant for forensic analysis.Public disclosure revision to reflect full scope.Recommendations for customer remediation (credential resets, key regeneration).Emphasis on diversifying security stacks and zero-trust adoption., SonicWall: Secure backup files by redacting/encrypting credentials separately.Customers: Implement zero-trust principles (MFA, least privilege, segmentation).Enhance logging and anomaly detection for VPN/authentication systems.Regular credential rotation and audits for network devices., SonicWall to Enhance Cloud Backup Security (e.g., Additional Encryption, Access Controls)Mandatory MFA for All SonicWall Product AccessAutomated Alerts for Unusual Authentication PatternsRegular Credential Rotation Policies for CustomersThird-Party Audits of SonicWall’s Security Practices, API security enhancementsCustomer credential reset advisory, Mandatory MFA for all remote access (VPN, RDP).Automated vulnerability scanning and patch prioritization.Dark web monitoring for credential leaks.Network segmentation and micro-segmentation for critical assets.Incident response playbooks updated for ransomware/zero-day scenarios., Mandate MFA for all remote access.Enforce password complexity and lockout policies.Prioritize patching for internet-facing appliances.Deploy dark web monitoring for credential leaks.Train users on SEO poisoning and social engineering risks..
.png)
Latest Global CVEs (Not Company-Specific)
Description
ThingsBoard in versions prior to v4.2.1 allows an authenticated user to upload malicious SVG images via the "Image Gallery", leading to a Stored Cross-Site Scripting (XSS) vulnerability. The exploit can be triggered when any user accesses the public API endpoint of the malicious SVG images, or if the malicious images are embedded in an `iframe` element, during a widget creation, deployed to any page of the platform (e.g., dashboards), and accessed during normal operations. The vulnerability resides in the `ImageController`, which fails to restrict the execution of JavaScript code when an image is loaded by the user's browser. This vulnerability can lead to the execution of malicious code in the context of other users' sessions, potentially compromising their accounts and allowing unauthorized actions.
Risk Information
cvss4
Base: 6.2
Severity: LOW
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:H/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Description
Mattermost versions 11.0.x <= 11.0.2, 10.12.x <= 10.12.1, 10.11.x <= 10.11.4, 10.5.x <= 10.5.12 fail to to verify that the token used during the code exchange originates from the same authentication flow, which allows an authenticated user to perform account takeover via a specially crafted email address used when switching authentication methods and sending a request to the /users/login/sso/code-exchange endpoint. The vulnerability requires ExperimentalEnableAuthenticationTransfer to be enabled (default: enabled) and RequireEmailVerification to be disabled (default: disabled).
Risk Information
cvss3
Base: 9.9
Severity: LOW
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
References
Description
Mattermost versions 11.0.x <= 11.0.2, 10.12.x <= 10.12.1, 10.11.x <= 10.11.4, 10.5.x <= 10.5.12 fail to sanitize team email addresses to be visible only to Team Admins, which allows any authenticated user to view team email addresses via the GET /api/v4/channels/{channel_id}/common_teams endpoint
Risk Information
cvss3
Base: 4.3
Severity: LOW
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
References
Description
Exposure of email service credentials to users without administrative rights in Devolutions Server.This issue affects Devolutions Server: before 2025.2.21, before 2025.3.9.
Description
Exposure of credentials in unintended requests in Devolutions Server.This issue affects Server: through 2025.2.20, through 2025.3.8.
Access Data Using Our API
Get company history
curl -i -X GET 'https://api.rankiteo.com/underwriter-getcompany-history?linkedin_id=SonicWall' -H 'apikey: YOUR_API_KEY_HERE'
RapidWhat Do We Measure ?
Incident
Finding
Grade
Digital Assets
Every week, Rankiteo analyzes billions of signals to give organizations a sharper, faster view of emerging risks. With deeper, more actionable intelligence at their fingertips, security teams can outpace threat actors, respond instantly to Zero-Day attacks, and dramatically shrink their risk exposure window.
These are some of the factors we use to calculate the overall score:
Network Security
Identify exposed access points, detect misconfigured SSL certificates, and uncover vulnerabilities across the network infrastructure.
SBOM (Software Bill of Materials)
Gain visibility into the software components used within an organization to detect vulnerabilities, manage risk, and ensure supply chain security.
CMDB (Configuration Management Database)
Monitor and manage all IT assets and their configurations to ensure accurate, real-time visibility across the company's technology environment.
Threat Intelligence
Leverage real-time insights on active threats, malware campaigns, and emerging vulnerabilities to proactively defend against evolving cyberattacks.
Rankiteo is a unified scoring and risk platform that analyzes billions of signals weekly to help organizations gain faster, more actionable insights into emerging threats. Empowering teams to outpace adversaries and reduce exposure.
