Sonic Wall Urges Password Resets After Cloud Backup Breach Affecting Under 5% of Customers
Summary: SonicWall detected suspicious activity against its cloud backup service for firewalls, and unknown threat actors accessed backup firewall preference files stored in the cloud for less than 5% of its customers. The company said credentials in the files were encrypted but the files also held information that could make it easier to exploit the related firewall, described the activity as a series of brute-force attacks rather than ransomware, and is urging customers to reset credentials and import fresh preference files.
What you should know: The disclosure lands as Akira-affiliated actors keep targeting unpatched SonicWall devices through CVE-2024-40766 (CVSS 9.3), and in one Huntress-documented incident attackers used exposed plaintext recovery codes to bypass MFA, close alerts, and attempt to uninstall EDR agents.
Read the original at The Hacker News ↗
- Topics
- Endpoint & Network Security
- Mentions
- CVE-2024-40766
- Related
- CVE-2024-40766: Sonic Wall SonicOS Improper Access Control Vulnerability Known Exploited Vulnerabilities · Sep 09, 2024