SonicWall 2024 Breach: Nation-State Actor Steals Firewall Backups in Supply Chain Attack
Executive Summary
In early 2024, SonicWall, a prominent network security vendor, disclosed that a sophisticated nation-state threat actor had gained unauthorized access to its systems and exfiltrated firewall backup configurations. The breach exploited the MySonicWall cloud portal as an entry vector, allowing attackers to obtain sensitive backup files from certain customers. While SonicWall emphasized that no customer credentials or direct device access occurred, the compromised backup data could potentially aid attackers in mapping internal customer network topologies, exposing configurations, or enabling tailored downstream attacks. The breach was unrelated to the recent Akira ransomware campaign targeting SonicWall appliances.
This incident underscores the increasing targeting of security infrastructure suppliers in supply chain attacks. With nation-state actors focusing on backup and configuration theft, the breach highlights emergent risks to organizations relying on third-party network security providers for confidentiality and resilience.
Why This Matters Now
The compromise of SonicWall's firewall backups spotlights the urgency of strengthening supply chain security as nation-state actors broaden their focus beyond traditional endpoints. As adversaries increasingly pursue the configurations and management portals of security vendors, organizations must assess dependencies and enforce robust controls to prevent downstream exposure from third-party risks.
Attack Path Analysis
The nation-state actor initiated the attack by exploiting a supply chain vulnerability, gaining unauthorized access to SonicWall firewall backup repositories. Upon entry, they escalated their privileges to enumerate and access sensitive backups. The attacker moved laterally to access additional storage or network segments containing further backup files. Establishing a covert C2 channel, they maintained remote access and control. Exfiltration was performed by transferring backup data out of the environment. The impact stage involved potential exposure of sensitive configuration data and possible downstream attacks using stolen information.
Kill Chain Progression
Initial Compromise
Description
Attacker exploited a supply chain or credential weakness to access SonicWall backup repositories.
Related CVEs
CVE-2024-40766
CVSS 9.3An improper access control vulnerability in SonicWall SonicOS management access allows unauthorized resource access and can cause the firewall to crash.
Affected Products:
SonicWall SonicOS – Gen 5: SOHO devices running version 5.9.2.14-12o and older, Gen 6: TZ, NSA, and SM models running versions 6.5.4.14-109n and older, Gen 7: TZ and NSA models running SonicOS build version 7.0.1-5035 and older
Exploit Status:
exploited in the wildCVE-2024-53704
CVSS 8.2An authentication bypass vulnerability in SonicWall SonicOS SSLVPN allows remote attackers to hijack active SSL VPN client sessions.
Affected Products:
SonicWall SonicOS – 7.1.x (7.1.1-7058 and older), 7.1.2-7019, 8.0.0-8035
Exploit Status:
exploited in the wildReferences:
CVE-2025-40601
CVSS 7.5A stack-based buffer overflow in SonicWall SonicOS SSLVPN service allows unauthenticated remote attackers to cause a Denial of Service (DoS) by crashing the firewall.
Affected Products:
SonicWall SonicOS – Gen8 and Gen7 firewalls with SSLVPN interface enabled
Exploit Status:
no public exploit
MITRE ATT&CK® Techniques
Supply Chain Compromise
Valid Accounts
OS Credential Dumping
Data Manipulation: Storage Manipulation
Exfiltration Over C2 Channel
Automated Exfiltration
Account Discovery: Domain Account
Potential Compliance Exposure
Mapping incident impact across multiple compliance frameworks.
PCI DSS 4.0 – Passwords/Passphrases Securely Stored
Control ID: 8.2.2
NYDFS 23 NYCRR 500 – Cybersecurity Policy
Control ID: 500.03
DORA – ICT Risk Management Framework
Control ID: Article 10
CISA ZTMM 2.0 – Identity and Access Controls
Control ID: Identity Pillar: Single Sign-On, MFA, and Privilege Management
NIS2 Directive – Risk Management Measures
Control ID: Article 21
Sector Implications
Industry-specific impact of the vulnerabilities, including operational, regulatory, and cloud security risks.
Computer/Network Security
SonicWall firewall backup theft creates direct supply chain vulnerability affecting security vendors' encrypted traffic capabilities and zero trust segmentation solutions.
Financial Services
Nation-state firewall compromise threatens PCI compliance requirements for egress security, encrypted traffic controls, and multicloud visibility in banking infrastructure.
Health Care / Life Sciences
Supply chain attack on firewall backups jeopardizes HIPAA compliance for encrypted traffic, threat detection capabilities, and secure hybrid connectivity requirements.
Government Administration
MySonicWall breach exposes critical infrastructure to nation-state threats, compromising NIST compliance for east-west traffic security and anomaly detection systems.
Sources
- SonicWall Firewall Backups Stolen by Nation-State Actorhttps://www.darkreading.com/cyberattacks-data-breaches/sonicwall-firewall-backups-nation-state-actorVerified
- CISA Confirms Exploitation of SonicWall Vulnerabilitieshttps://www.infosecurity-magazine.com/news/cisa-exploitation-sonicwall/Verified
- SonicWall tells customers to patch SonicOS flaw allowing hackers to crash firewallshttps://www.techradar.com/pro/security/sonicwall-tells-customers-to-patch-sonicos-flaw-allowing-hackers-to-crash-firewallsVerified
- Product Notice: SSLVPN and SSH Vulnerability in SonicOShttps://www.sonicwall.com/ko-kr/support/notices/product-notice-sslvpn-and-ssh-vulnerability-in-sonicos/250107100311877Verified
Frequently Asked Questions
Cloud Native Security Fabric Mitigations and ControlsCNSF
Zero Trust segmentation, strong egress controls, encrypted traffic, anomaly detection, and microsegmentation could have limited attacker movement, reduced the ability to escalate privileges, detected reconnaissance, and blocked exfiltration of sensitive backups.
Control: Zero Trust Segmentation
Mitigation: Unauthorized inbound access to sensitive network areas is denied by default.
Control: Multicloud Visibility & Control
Mitigation: Privileged access attempts are detected and anomalous behavior is alerted.
Control: East-West Traffic Security
Mitigation: Internal lateral movement between environments is blocked or highly restricted.
Control: Threat Detection & Anomaly Response
Mitigation: Anomalous outbound traffic and C2 patterns are rapidly detected and contained.
Control: Egress Security & Policy Enforcement
Mitigation: Unauthorized exfiltration is blocked and flagged for investigation.
Stolen backup data is unreadable to attackers due to robust encryption in transit.
Impact at a Glance
Affected Business Functions
- Network Security
- Remote Access Services
- Data Protection
Estimated downtime: 3 days
Estimated loss: $500,000
Potential exposure of firewall configuration files, including network rules, VPN settings, and administrative credentials, increasing the risk of targeted cyberattacks.
Recommended Actions
Key Takeaways & Next Steps
- • Enforce Zero Trust Segmentation to isolate backup infrastructures and minimize unauthorized access pathways.
- • Deploy comprehensive east-west and egress traffic controls to prevent lateral movement and data exfiltration across hybrid and multicloud environments.
- • Adopt high-performance encryption for all data in transit, particularly for backup repositories and management traffic.
- • Implement anomaly detection and centralized visibility to rapidly identify and respond to privilege escalation or suspicious outbound activity.
- • Continuously review and enforce least-privilege access controls and storage policies to reduce exploitable attack surfaces in supply chain and third-party integrations.
