SonicWall 2024 Breach: Firewall Backup Data Compromised in MySonicWall Attack
Executive Summary
In June 2024, SonicWall confirmed that threat actors breached its MySonicWall portal and gained unauthorized access to a set of firewall backup configuration files. The attackers were able to obtain configuration data belonging to less than 5% of customers through this service, which could potentially reveal sensitive network information such as network structures, credentials, and policy configurations. SonicWall indicated that the breach was swiftly detected, affected accounts were notified, and the scope was limited, but details regarding the initial attack vector or threat actor remain undisclosed.
This incident comes at a time of heightened targeting of network infrastructure management portals and supply chain entry points. As attackers increasingly look to exploit enterprise-grade device management platforms, organizations must reinforce segmentation, monitor lateral movements in east-west traffic, and continually validate zero trust architectures across all privileged network and cloud control panels.
Why This Matters Now
The SonicWall breach spotlights urgent risks in the management plane of critical network devices. With attackers targeting device backup files to harvest credentials and map network flows, organizations—especially those with hybrid or multi-cloud deployments—must treat device and backup management portals as high-value assets requiring continuous monitoring, segmentation, and hardened authentication.
Attack Path Analysis
Attackers initially compromised the MySonicWall service, gaining unauthorized access—likely via credential exploitation or a vulnerability. They escalated privileges to access backup firewall configuration files. Next, the threat actors moved laterally within SonicWall's cloud infrastructure to identify and access sensitive backup data across customer environments. Command and control was established via covert communication channels, maintaining access and preparing for data extraction. Exfiltration was then executed, with the attackers transferring unencrypted backup files out of the environment. The impact was the exposure of sensitive firewall configurations, potentially enabling downstream attacks against affected customers.
Kill Chain Progression
Initial Compromise
Description
Threat actors breached MySonicWall's cloud service, possibly exploiting a vulnerability or using compromised credentials to gain access.
Related CVEs
CVE-2024-40766
CVSS 9.3An improper access control vulnerability in SonicWall SonicOS management access allows unauthorized resource access and can cause the firewall to crash.
Affected Products:
SonicWall SonicOS – < 5.9.2.14-12o, < 6.5.4.14-109n, < 7.0.1-5035
Exploit Status:
exploited in the wildCVE-2024-53704
CVSS 7.5An improper authentication vulnerability in SonicWall SonicOS SSLVPN allows remote attackers to bypass authentication.
Affected Products:
SonicWall SonicOS – 7.1.x (7.1.1-7058 and older), 7.1.2-7019, 8.0.0-8035
Exploit Status:
exploited in the wildCVE-2025-40601
CVSS 7.5A stack-based buffer overflow vulnerability in SonicWall SonicOS SSLVPN service allows unauthenticated remote attackers to cause Denial of Service (DoS) attacks, potentially crashing the firewall.
Affected Products:
SonicWall SonicOS – Gen8 and Gen7 firewalls (hardware and virtual)
Exploit Status:
no public exploit
MITRE ATT&CK® Techniques
Valid Accounts
Exploit Public-Facing Application
Data from Information Repositories
Data from Local System
Data Transfer Size Limits
Exfiltration Over C2 Channel
Impair Defenses
Modify Authentication Process
Potential Compliance Exposure
Mapping incident impact across multiple compliance frameworks.
PCI DSS 4.0 – User Authentication for All System Components
Control ID: 8.2.1
NYDFS 23 NYCRR 500 – Cybersecurity Policy
Control ID: 500.03
DORA (Digital Operational Resilience Act) – ICT Risk Management Framework
Control ID: Art. 7.1
CISA ZTMM 2.0 – Implement Strong Authentication and Authorization Methods
Control ID: Identity Pillar – 1.2
NIS2 Directive – Security of Network and Information Systems – Incident Handling
Control ID: Art. 21(2)d
Sector Implications
Industry-specific impact of the vulnerabilities, including operational, regulatory, and cloud security risks.
Computer/Network Security
Direct industry credibility impact as SonicWall breach exposes firewall configurations, undermining customer trust in security vendor capabilities and zero-trust implementations.
Financial Services
Critical exposure as firewall backup breaches compromise PCI compliance requirements, egress security policies, and encrypted traffic protection for sensitive financial transactions.
Health Care / Life Sciences
Severe HIPAA compliance violations risk from exposed firewall configurations revealing network segmentation, encrypted traffic patterns, and protected health information access controls.
Government Administration
National security implications as compromised firewall configurations could expose classified network architectures, threat detection capabilities, and secure hybrid connectivity infrastructure.
Sources
- SonicWall Breached, Firewall Backup Data Exposedhttps://www.darkreading.com/cyberattacks-data-breaches/sonicwall-breached-firewall-backupVerified
- SonicWall Cloud Backup Breached: Firewall Configurations Compromisedhttps://www.acaglobal.com/industry-insights/sonicwall-cloud-backup-breached-firewall-configurations-compromised/Verified
- All SonicWall firewall cloud backups stolen, admins urged to act immediatelyhttps://cybernews.com/security/sonicwall-revises-breach-impact-all-firewall-backups-stolen/Verified
- SonicWall breach: all firewall backups stolenhttps://cybernews.com/security/sonicwall-revises-breach-impact-all-firewall-backups-stolen/Verified
Frequently Asked Questions
Cloud Native Security Fabric Mitigations and ControlsCNSF
Cloud Network Security Framework controls such as zero trust segmentation, east-west traffic security, egress policy enforcement, and encrypted traffic visibility would have limited the attacker’s movement, detected unauthorized activity, and protected sensitive backup data, reducing breach impact significantly.
Control: Cloud Native Security Fabric (CNSF)
Mitigation: Inline policy enforcement and real-time inspection would detect and block unauthorized access attempts.
Control: Zero Trust Segmentation
Mitigation: Microsegmentation and least privilege would block privilege escalation to sensitive assets.
Control: East-West Traffic Security
Mitigation: Inspection and enforcement on internal traffic would detect and block anomalous movement between services.
Control: Threat Detection & Anomaly Response
Mitigation: Anomaly baselining and real-time alerting would flag and respond to C2 activities.
Control: Egress Security & Policy Enforcement
Mitigation: Egress controls block unauthorized outbound transfers and identify exfiltration attempts.
Strong encryption ensures that even if backups are accessed, the data remains unreadable.
Impact at a Glance
Affected Business Functions
- Network Security
- Remote Access
- Data Protection
Estimated downtime: 3 days
Estimated loss: $500,000
Exposure of firewall configuration files, including network configurations, security policies, and encrypted credentials, potentially leading to unauthorized access and targeted attacks.
Recommended Actions
Key Takeaways & Next Steps
- • Implement distributed zero trust segmentation to enforce least privilege and block lateral attacker movements across cloud infrastructure.
- • Enforce egress filtering and real-time monitoring to detect and stop unauthorized exfiltration attempts from sensitive environments.
- • Apply strong encryption (MACsec/IPsec) to protect backup data both in transit and at rest, reducing the impact in the event of compromise.
- • Deploy continuous anomaly detection and incident response capabilities to quickly identify and mitigate unauthorized or suspicious activity.
- • Centralize visibility and policy management across hybrid and multicloud environments to ensure consistent enforcement and rapid threat containment.
