SonicWall Cloud Backup Incident: Mandiant Investigation Complete

For those hearing this for the first time, around the first week of September, SonicWall began noticing unusual behavior in its systems. They noticed excessive API calls to our cloud-based storage.

They immediately launched an investigation, shut down the cloud-based storage, and confirmed unauthorized access to some backup files.

To ensure a thorough investigation, they contacted Mandiant, a leading cybersecurity and incident response firm. They confirmed our findings and acknowledged our concerns. Together, they initiated a full incident response cycle.

Key Findings of Mandiant’s Investigation

According to Mandiant’s investigation:

• This malicious activity was carried out by a state-sponsored threat actor.
• They only accessed cloud backup files, and that too only through API calls within a specific cloud setup.
• No other SonicWall products, firmware, source code, or customer networks were touched.
• This was not connected to the “Akira” ransomware attacks you may have heard about targeting firewalls elsewhere.

SonicWall took the following actions immediately following the incident:

• SonicWall wasted no time, following all of Mandiant’s recommendations, examining every step of the improvement, and launching a major “Secure by Design” initiative. 
• This encompasses everything: product design, cloud operations, development pipeline, you name it. 
• They also invested more resources in their security and incident response teams, strengthened their cloud infrastructure, and made it easier for partners to communicate during difficult times.
• They’re keeping things transparent, holding Q&A sessions for partners, sharing improvement tools, and even making some business concessions to help partners address any issues.

Key Takeaways for Partners

• Limited Scope: It was targeted, cloud-backup specific, and did not impact core product lines.
• Threat Actor Profile: State-Sponsored, indicating high sophistication.
• Remediation Complete: Mandiant’s recommended actions have been implemented.
• Ongoing Commitment: SonicWall continues to invest in security, partner support, and transparency.
• Engagement Opportunity: Use this opportunity to strengthen your advisory role and demonstrate to customers that you provide reliable, flexible solutions.

Incidents like these demonstrate how rapidly threats to network and edge security are evolving. It’s more important than ever to work with vendors who act quickly, tell you exactly what’s happening, and have a plan for what to do next. As a partner, your expertise and being a responsive vendor are not only nice to have, but they also provide real peace of mind to your customers.

Frequently Asked Questions (FAQs)