H-ISAC TLP White Threat Bulletin SonicWall MySonicWall Cloud Backup Incident

SonicWall has disclosed a security incident in which threat actors gained unauthorized access to backup firewall preference files stored in its cloud service, MySonicWall.com. Although the credentials within these files were encrypted, they also contained other sensitive configuration data that could significantly facilitate future exploitation of related firewalls.

The incident is not attributed to ransomware activity but rather a series of brute force attacks aimed at gaining access to the preference files. SonicWall has prompted password resets and provided new, updated preference files to help users mitigate the potential impact.

Health-ISAC provides this information to increase situational awareness and encourage users who leverage the cloud backup feature to take immediate action to determine their exposure and mitigate any potential risk.