SonicWall Confirms State-Sponsored Hackers Behind September Cloud Backup Breach

SonicWall has formally implicated state-sponsored threat actors behind the September security breach that exposed firewall configuration backup files. According to SonicWall, the malicious activity was isolated to the unauthorized access of cloud backup files from a specific cloud environment using an API call and is not related to ongoing Akira ransomware attacks on firewalls and other edge devices.

The disclosure follows a month after the company previously said an unauthorized party accessed firewall configuration backup files for all customers who had used the cloud backup service, and that in September the threat actors accessed the cloud-stored backup files for less than 5% of its customers.

SonicWall, which engaged Google-owned Mandiant to investigate the breach, said it did not affect its products or firmware or any other systems, and it has adopted remedial actions to harden its network and cloud infrastructure while continuing to improve security. Customers are advised to log in to MySonicWall[.]com to check their devices and reset credentials for any impacted services; the company has released an Online Analysis Tool and a Credentials Reset Tool to aid remediation.