Hackers Steal SonicWall Firewall Configurations

Firewall maker SonicWall is telling customers to reset credentials after hackers stole firewall configuration backup files stored in its cloud service.

See Also: OnDemand Webinar | Trends, Threats and Expert Takeaways: 2025 Global IR Report Insights

The company said Wednesday that hackers launched a series of brute-force attacks against servers storing backup files. They managed to steal the configuration data of roughly 5% of the install base, SonicWall disclosed.

“While credentials within the files were encrypted, the files also included information that could make it easier for attackers to potentially exploit the related firewall,” the company said.

SonicWall said hackers don’t appear to have published online any of the stolen data – likely because the data is being held for “potential further use by threat actors.”

“These files may supply threat actors with critical information, such as credentials or tokens, as well as all the services and configurations of the firewall,” security firm Rapid7 warned.

Rapid7 just days ago uncovered a campaign tied to Akira ransomware exploiting CVE-2024-40766, an authentication vulnerability impacting SonicWall SonicOS management access and VPN instances. Certain default LDAP configurations can overprovision access to the VPN, enabling users who shouldn’t have access to the VPN to obtain it anyhow, regardless of Active Directory configurations, Rapid7 said. Researchers there also say hackers have accessed the Virtual Office Portal on SonicWall VPNs, enabling them to set up multifactor authentication or one-time passwords for account holders.

“Evidence collected during Rapid7’s investigations suggests that the Akira group is potentially utilizing a combination of all three of these security risks to gain unauthorized access and conduct ransomware operations,” the security firm said.

SonicWall said the latest compromise is not ransomware-related. The company directed customers to log into MySonicWall.com to check if their firewall serial numbers are listed as impacted. In such cases, the company said customers should rotate all one-time passwords and MFA tokens.

The campaign is the latest instance of SonicWall appliance compromise as cybercrime groups target the edge devices to gain initial access to corporate networks.

Google in July warned of a hacking campaign by a group it tracks as UNC6148, which deployed a previously unseen rootkit called Overstep to gain backdoor access to fully patched SonicWall appliances (see: Hackers Using Malicious SonicWall VPN for Credential Theft).

In another hacking campaign, hackers spread fake versions of SonicWall VPN to deliver a credential-stealing Trojan (see: Hackers Using Malicious SonicWall VPN for Credential Theft).