SonicWall Cloud Backup Breach 2024: Firewall Configurations Exposed in Major Supply Chain Attack
Executive Summary
In mid-2024, SonicWall suffered a significant security breach when an unauthorized party leveraged a brute-force attack against its customer-facing cloud backup platform, gaining access to all firewall configuration backup files stored on the service. The exposed data included sensitive firewall rules, encrypted credentials, and routing configurations for every customer utilizing SonicWall’s cloud backup, not just the initially cited 5% of their install base. While the credentials were encrypted, experts warned that weak passwords could be crackable, offering attackers expanded access. SonicWall worked with Mandiant to investigate, notified affected customers, hardened its infrastructure, and provided remediation tools.
This incident highlights ongoing risks from cloud-based infrastructure and supply chain attacks, especially targeting security vendors. Attackers are increasingly exploiting weaknesses in API protections and infrastructure configurations, reinforcing the need for robust access controls and continuous monitoring as ransomware and targeted attacks against network security vendors persist.
Why This Matters Now
The SonicWall breach demonstrates urgent vulnerabilities in third-party cloud services and the critical need for modern security controls around sensitive configuration data. With attackers actively seeking and exploiting weak authentication and API protections in trusted platforms, organizations must swiftly reassess their supply chain exposures and ensure they are prepared for the evolving threat landscape.
Attack Path Analysis
The attacker initiated a brute-force attack against a customer-facing SonicWall system, exploiting weak authentication protections to gain access. Upon successful compromise, the attacker escalated privileges to access sensitive cloud backup infrastructure. Internal pivoting allowed the attacker to enumerate and access backup files for all customers leveraging the cloud service. Command and control was likely maintained through covert access to legitimate infrastructure interfaces. The attacker then exfiltrated a significant volume of firewall configuration files, including encrypted credentials and rules. The impact includes widespread exposure of sensitive configurations, enabling further attacks and posing long-term risks to affected organizations.
Kill Chain Progression
Initial Compromise
Description
Attacker performed a brute-force attack on a publicly exposed cloud portal, bypassing insufficient rate limiting and authentication controls to attain initial access.
Related CVEs
CVE-2023-44221
CVSS 7.2A post-authentication command injection vulnerability in SonicWall's Secure Mobile Access (SMA) 100 series allows remote authenticated attackers with administrative privileges to execute arbitrary commands as the 'nobody' user.
Affected Products:
SonicWall Secure Mobile Access (SMA) 100 series – SMA 200, SMA 210, SMA 400, SMA 410, SMA 500v
Exploit Status:
exploited in the wildCVE-2024-40766
CVSS 9.6An improper access control vulnerability in SonicWall SonicOS allows unauthorized attackers to access resources, potentially leading to firewall crashes.
Affected Products:
SonicWall SonicOS – Gen 5, Gen 6, Gen 7 (up to 7.0.1-5035)
Exploit Status:
exploited in the wildCVE-2025-40601
CVSS 7.5A stack-based buffer overflow vulnerability in SonicWall SonicOS SSLVPN service allows unauthenticated remote attackers to perform Denial of Service (DoS) attacks, potentially crashing the firewall.
Affected Products:
SonicWall SonicOS – Gen 8, Gen 7
Exploit Status:
no public exploit
MITRE ATT&CK® Techniques
Brute Force
Valid Accounts
Exploit Public-Facing Application
Credentials from Password Stores: Credentials in Configuration Files
Data Manipulation: Stored Data Manipulation
Data from Local System
Automated Exfiltration
Potential Compliance Exposure
Mapping incident impact across multiple compliance frameworks.
PCI DSS 4.0 – Strong Authentication for All Access
Control ID: 8.3.1
NYDFS 23 NYCRR 500 – Access Privileges
Control ID: Section 500.07
DORA (Digital Operational Resilience Act) – ICT Risk Management Framework
Control ID: Article 9
CISA Zero Trust Maturity Model 2.0 – Multi-factor Authentication Enforcement
Control ID: Identity Pillar - Authentication & Access
NIS2 Directive – Technical and Organizational Measures for Security
Control ID: Article 21.2(a)
Sector Implications
Industry-specific impact of the vulnerabilities, including operational, regulatory, and cloud security risks.
Financial Services
SonicWall supply chain attack exposes firewall configurations containing encrypted credentials and routing data, compromising PCI compliance and zero trust network security implementations.
Health Care / Life Sciences
Brute-force attack on SonicWall cloud portal threatens HIPAA compliance through exposed firewall rules and encrypted credentials, enabling lateral movement within healthcare networks.
Government Administration
All SonicWall customer firewall configurations accessed via cloud backup service, exposing sensitive government network architectures and creating targeted attack opportunities for threat actors.
Computer/Network Security
Supply chain compromise of security vendor infrastructure undermines customer trust while exposing network segmentation policies and encrypted traffic configurations across cybersecurity implementations.
Sources
- SonicWall admits attacker accessed all customer firewall configurations stored on cloud portalhttps://cyberscoop.com/sonicwall-customer-firewall-configurations-exposed/Verified
- SonicWall Cloud Backup Breached: Firewall Configurations Compromisedhttps://www.acaglobal.com/industry-insights/sonicwall-cloud-backup-breached-firewall-configurations-compromised/Verified
- SonicWall confirms all of its cloud backup customers were affected by data breachhttps://www.techradar.com/pro/security/sonicwall-confirms-every-cloud-backup-customer-was-hit-by-data-breachVerified
- CISA Confirms Exploitation of SonicWall Vulnerabilitieshttps://www.infosecurity-magazine.com/news/cisa-exploitation-sonicwall/Verified
Frequently Asked Questions
Cloud Native Security Fabric Mitigations and ControlsCNSF
Zero Trust controls including segmentation, centralized visibility, policy-driven egress enforcement, and traffic anomaly detection would have limited the attacker's ability to move laterally, exfiltrate data, and remain undetected. Microsegmentation and robust monitoring could have constrained blast radius even after initial compromise.
Control: Cloud Native Security Fabric (CNSF)
Mitigation: Automated detection and response to brute-force attempts.
Control: Zero Trust Segmentation
Mitigation: Access boundary enforcement prevents privilege accumulation.
Control: East-West Traffic Security
Mitigation: Lateral movement isolation and visibility.
Control: Threat Detection & Anomaly Response
Mitigation: Anomalous behavior alerting and investigation triggers.
Control: Egress Security & Policy Enforcement
Mitigation: Outbound data transfer prevention or alerting.
Comprehensive incident scoping and blast radius assessment.
Impact at a Glance
Affected Business Functions
- Network Security Management
- VPN Services
- Firewall Configuration
Estimated downtime: 7 days
Estimated loss: $500,000
Unauthorized access to firewall configuration backups exposed sensitive information, including network topology, access rules, and encrypted credentials. This exposure increases the risk of targeted cyberattacks and potential unauthorized access to network resources.
Recommended Actions
Key Takeaways & Next Steps
- • Implement Zero Trust segmentation to strictly limit access between tenant environments and sensitive backups.
- • Enforce inline detection and real-time response to credential brute-force and anomalous authentication activity on public portals.
- • Adopt robust egress policy controls to identify and block unauthorized outbound data transfers from critical storage locations.
- • Strengthen east-west traffic security and monitoring to rapidly detect lateral movement attempts within the cloud environment.
- • Enhance centralized visibility and incident response workflows to quickly assess exposure and orchestrate remediation across multicloud assets.
