MySonicWall: Cloud backup compromise – Threat report

Overview

On 18/09/2025 SonicWall disclosed that their Cloud Backup service for firewalls was compromised. They have not been specific as to which day at this point. Threat actors accessed firewall configuration files stored in their cloud service. SonicWall has disclosed a security incident involving its MySonicWall cloud backup service, where threat actors gained unauthorised access to a subset of firewall configuration backup files.

The exposed files may contain encrypted credentials and detailed configuration data that could help attackers gain unauthorised access into a company’s network. At this stage, there is no evidence of public data leaks, but organisations using SonicWall firewalls should execute SonicWall’s remediation guidance and monitor for suspicious activity.

Full details of their disclosure can be found here: MySonicWall Cloud Backup File Incident

Impact

Successful exploitation of the Cloud Backup Service would pose a significant risk to an
organisation as threat actors can leverage Firewall Configuration Files to view sensitive information and gain unauthorised access into a network.

If you are using a SonicWall device within your organisation you should take immediate action as detailed below. If you would like Zensec to review this for you please call us on 0333 0917040 or email cyber@Zensec.co.uk

Without taking proactive steps, these are the potential risks which a threat actor could
exploit:

• Remote access intrusion – Gaining unauthorised entry into the victim’s network.
• Privilege escalation – Using stolen access to obtain administrative privileges.
• Lateral movement and persistence – Mapping and exploiting internal systems with
  native tools and scripts to maintain control.
• Data theft – Extracting valuable business data, often as a precursor to further attacks.
• Ransomware execution – Deploying ransomware throughout the environment once
  access has been established.

SonicWall Remediation Guidance

SonicWall have recommended the following steps are performed by all SonicWall customers:

• Log in to MySonicWall (MSW), check whether cloud backups are enabled.
• Review if any serial numbers of your firewalls are flagged with the informational
  banner (meaning they are confirmed or believed to be impacted).
• If yes: you need to follow SonicWall’s containment and remediation guidelines as per
  Essential Credential Reset
• Check whether config files have been updated (SonicWall are providing new preference
  files in some cases).