TL;DR
- What happened — A SonicWall/MySonicWall incident allowed access to some cloud-stored firewall configuration backups (<5%). These files can accelerate attacker recon (rules, VPNs, objects, sometimes secrets). (SonicWall)
- Immediate actions — Reset MySonicWall credentials, rotate PSKs/API tokens, audit objects/NAT/VPN rules, and restrict SSLVPN/Virtual Office by source IP. (SonicWall)
- Harden for ransomware — Patch legacy SSLVPN issues, enforce MFA, remove stale accounts, and monitor edge authentication for anomalies (Akira operators have targeted SonicWall appliances). (TechRadar)
- Validate — Run external scans on exposed services, check config drift, and schedule targeted attack simulations. (Arctic Wolf)
What happened (and why config files are gold to attackers)
SonicWall disclosed that threat actors accessed backup firewall preference/config files stored in certain MySonicWall accounts. The company says fewer than 5% of its firewall install base was impacted. Even with encrypted credentials, these files can reveal topology, objects, NAT/policy logic, and VPN details—letting attackers pivot or fine-tune phishing and password-spray attempts. (SonicWall)
Security outlets confirm the exposure and advise password resets and secret rotation for affected customers. SonicWall has engaged third-party experts and notified law enforcement. (SecurityWeek)
Immediate actions (today)
Use this incident-response checklist with your network + SecOps teams:
1) Reset & rotate
- Reset MySonicWall passwords for all tenant admins; invalidate old sessions.
- Rotate any PSKs, API tokens, LDAP/RADIUS/SNMP creds, or local admin passwords referenced in backups.
- If SonicWall provided a new preferences file or guidance for impacted devices, apply it and force credential changes. (SonicWall)
2) Tighten remote access immediately
- Restrict SSLVPN/Virtual Office to corporate source IPs or jump/bastion ranges only (Geo/IP allowlists).
- Disable web management from WAN; if required, IP-restrict and use a management VLAN/LAN-side jump host.
- Review address objects, NAT policies, and access rules for accidental exposure or overly broad any/anys. (SonicWall)
3) Rapid audit of changes
- Pull last 30–60 days of audit logs (policy/VPN/object edits, admin logins, failed MFA).
- Compare current running config vs. known-good baseline for drift (unexpected objects, new users, new NATs).
Handy spot checks
# External exposure quick check from a safe scanner host
nmap -sV -Pn -p 80,443,4443,8443,22,3389 <edge-ip-or-fqdn>
nmap --script ssl-enum-ciphers -p 443,4443 <edge-ip-or-fqdn>
- If SSLVPN is live, confirm only expected ports (typically 443/SSLVPN) are open and that TLS settings are modern.
Hardening against follow-on ransomware
Multiple advisories in 2025 highlight SonicWall SSLVPN targeting—including Akira operators leveraging old vulnerabilities or misconfigurations. If you’ve postponed maintenance windows, this is the time to act. (TechRadar)
Priorities
- Patch to current SonicOS/SSLVPN releases and remediate any CVE-flagged pathways referenced in advisories.
- Enforce MFA for all remote access; block weak factors; require phishing-resistant methods where possible.
- Cull stale/local accounts on the firewall; prefer SSO with least privilege.
- Monitor edge auth: set alerts for VPN logins from new countries, impossible-travel, rapid multi-geo attempts, or MFA push fatigue. (TechRadar)
Validation: prove you’re clean (don’t just hope)
1) External attack surface review
Run an outside-in scan to catch exposed portals, weak headers, and old TLS. For a quick health check, use our free tool:
Screenshot — Free Website Vulnerability Scanner homepage
Run a perimeter check on your public hostname(s). Use findings to close risky headers, identify exposed admin portals, and spot outdated TLS suites.
2) Verify remediation with evidence
Export a sample report to document fixes and share with leadership/auditors.
Sample Report by the free scanner to check Website Vulnerability
Before/after comparison: Confirm SSL/TLS and header hardening took effect, and that no unintended services remain exposed.
3) Config-drift & rule intent checks
- Compare today’s config to your golden baseline. Flag any new address objects, NATs, or admin accounts.
- Re-validate rule intent (e.g., temporary any/anys, broad management ACLs) and close exceptions.
4) Targeted attack simulation
Schedule a focused external network pentest against edge controls and VPN paths. If you need help, our team can scope risk assessments and remediation plans aligned to your compliance goals (HIPAA/PCI/SOC 2/ISO 27001/GDPR). (pentesttesting.com)
Copy-paste comms (for ticket or war-room)
- “Rotate everything in scope of the backups (PSKs/API tokens/LDAP/RADIUS/SNMP/local admin).”
- “Lock down SSLVPN/Virtual Office by source IP; disable WAN management or IP-restrict it.”
- “Patch SonicOS/SSLVPN per current advisories; enforce MFA for all remote access.”
- “Run external scan and capture evidence; attach the sample report to this ticket.”
- “Baseline, then diff: compare configs to known-good; document any drift and approvals.”
Helpful references
- SonicWall KB: “MySonicWall Cloud Backup File Incident” (root cause, scope, guidance). (SonicWall)
- The Hacker News: Summary of the breach and customer impact. (The Hacker News)
- TechRadar: Reporting on credential resets and why config backups matter for attackers. (TechRadar)
- Rapid7 / TechRadar: Active ransomware targeting of SonicWall SSLVPN paths; hardening priorities. (Rapid7)
- Arctic Wolf: Practical validation and monitoring advice after SonicWall exposure. (Arctic Wolf)
Internal links (for readers who want help)
- Pentest Testing Corp — Homepage, Blog, Risk Assessment Services, Remediation Services.
- Free tool — Website Vulnerability Scanner.
- Partner site — Cyber Rely (additional resources & case studies).
Need a 30/60/90-day plan that produces auditor-ready evidence?
👉 Start with a risk assessment and a concrete remediation roadmap:
- Risk Assessment Services
- Remediation Services Or email us at query@pentesttesting.com for a same-day scoping call.
This post is for defenders responding to the ongoing **sonicwall breach 2025* disclosures. Always follow vendor guidance and your internal change-control.*
Top comments (0)