Loading story…
SonicWall has released a security advisory after a malicious actor used brute force techniques to access a subset of customer preference files in MySonicWall cloud backups. Although credentials were encrypted, the files contained information that could be used to compromise SonicWall Firewall devices. Customers are urged to follow the advisory's containment and remediation steps immediately.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
7 events from the most recent confirmed update back to the earliest known activity.
The Canadian Centre for Cyber Security published alert AV25-614 for a Citrix security advisory. No additional technical details were included in the source content.
CISA published a notice stating that SonicWall released an advisory for customers following a security incident. The provided content did not include details on the nature, scope, or impact of the incident.
The Canadian Centre for Cyber Security published alert AV25-611 for a Microsoft Edge security advisory. No synopsis or remediation details were available in the reference.
The Canadian Centre for Cyber Security published alert AV25-607 related to a Dell security advisory. The provided reference contained no further description of the issue.
The Canadian Centre for Cyber Security published alert AV25-608 for an Ubuntu security advisory. No synopsis or vulnerability specifics were included in the provided content.
The Canadian Centre for Cyber Security published alert AV25-609 covering a Red Hat security advisory. The reference did not include further technical or impact details.
The Canadian Centre for Cyber Security published alert AV25-606 for an IBM security advisory. No additional incident details were provided in the reference content.
7 references tracked. Mallory keeps watching after this page renders.
cyber.gc.ca
Open sourcecyber.gc.ca
Open sourcecyber.gc.ca
Open sourcecyber.gc.ca
Open sourcecisa.gov
Open sourcecyber.gc.ca
Open sourcecyber.gc.ca
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Hackers gained unauthorized access to firewall configuration backup files stored in SonicWall’s MySonicWall cloud backup service, impacting all users of the platform. The breach was initially disclosed in September 2025, when SonicWall urged customers to reset credentials after discovering that backup files tied to MySonicWall accounts had been exposed. Although SonicWall’s initial advisory suggested that under 5% of customers were affected, subsequent investigation confirmed that all customers using the cloud backup service were impacted. The stolen configuration files contain sensitive information, including encrypted credentials, user and group settings, DNS and log settings, and certificates, which could be leveraged by threat actors to compromise organizational networks. Only Gen 7 and newer SonicWall firewalls encrypt credentials and secrets in exported configuration files using AES-256, leaving older devices more vulnerable to exploitation. SonicWall has blocked further unauthorized access and is collaborating with cybersecurity experts and law enforcement to assess the full scope of the incident. The company has notified affected customers and provided detailed instructions for identifying impacted devices and remediating the risk. Customers are advised to import new preference files, a process that disrupts IPSec VPNs, TOTP bindings, and user access, requiring reconfiguration of VPN pre-shared keys and reset of TOTP and user passwords. To minimize operational impact, SonicWall recommends performing these actions during maintenance windows or periods of low activity, as the process necessitates an immediate firewall reboot. Arctic Wolf notes that threat actors, including nation-state and ransomware groups, have previously exploited exfiltrated firewall configuration files in subsequent attacks. SonicWall has established a dedicated support team to assist organizations with remediation and has published an in-depth advisory with up-to-date guidance. Organizations are strongly urged to reset credentials on all affected firewalls and to follow SonicWall’s recommendations to prevent unauthorized access. The exposure of these configuration files represents a significant risk, as they can provide attackers with the information needed to bypass network defenses. The incident underscores the importance of robust encryption for sensitive configuration data and the need for rapid response to cloud service breaches. SonicWall continues to work with partners and customers to ensure all affected systems are secured and to prevent further exploitation of the stolen data.
Jun 29, 2026SonicWall confirmed that a cybercriminal accessed its MySonicWall.com portal via brute-force attacks, exposing backup firewall configuration files for less than 5% of its install base. The exposed files, while containing encrypted passwords, also included sensitive configuration data that could aid attackers in exploiting affected firewalls. SonicWall has disabled the backup feature, notified impacted customers, and advised credential resets and increased monitoring.
Jun 29, 2026
SonicWall confirmed that a security breach in September resulted in unauthorized access to firewall configuration backup files stored in certain MySonicWall accounts. The company, with support from Mandiant, determined that the attack was carried out by a state-sponsored threat actor and was limited to a specific cloud environment accessed via an API call. The breach did not impact SonicWall products, firmware, source code, or customer networks, but exposed sensitive information such as access credentials and tokens, prompting SonicWall to advise customers to reset passwords and shared secrets for various services and interfaces. Following the incident, SonicWall notified all customers using its cloud backup service for firewall configurations and provided assessment tools to help identify affected devices. The company emphasized that the breach was unrelated to Akira ransomware or other ongoing attacks and has since implemented additional security measures based on Mandiant's recommendations. Law enforcement and external cybersecurity experts were engaged throughout the investigation, and SonicWall continues to strengthen its systems to prevent future incidents involving nation-state actors.
Jun 29, 2026