SonicWall SSLVPN Targeted After Hackers Breach All Customer Firewall Backups

Cybersecurity researchers say a widespread campaign targeted SonicWall SSL VPN devices, with over 100 accounts compromised since early October and attacks observed starting on 4 October 2025 across 16 customer networks, according to Huntress. The intrusions appear coordinated, with attackers using what seems like valid credentials rather than brute forcing, and all observed activity originated from the IP address 202.155.8[.]73, suggesting a central command structure.

SonicWall’s security advisory noted that unauthorized parties accessed firewall configuration backup files for all customers using the MySonicWall cloud backup service, containing encrypted credentials and configuration data that could be used in targeted attacks.

In response, SonicWall urges customers to verify device status via MySonicWall[.]com and to implement comprehensive measures, including restricting WAN management access, disabling HTTP, HTTPS, SSH and SSL VPN services until credential resets are completed, and enforcing multi-factor authentication for all administrative and remote accounts.

Organizations should reset authentication secrets—local admin accounts, VPN pre-shared keys, LDAP credentials, SNMP settings—and revoke external API keys, DNS credentials and automation secrets, with enhanced logging and gradual reintroduction of services.