Securitybrief.Au

SonicWall Investigates State-Backed Breach of Cloud Backup Service

First seen 2 Dec 2025, 18:33 UTC • Theregister

+3 •34.4

Article Content

Include sub-articles 1 / 1

Browse articles

ThreatCluster

SonicWall reported unauthorized access to backup firewall configuration files in September 2025, attributed to a state-backed threat actor. The company engaged Mandiant for an investigation and communicated with partners and customers about remediation steps. The breach affected the MySonicWall cloud backup service, but no other SonicWall products were compromised.

How this analysis works

Attack Flow

26 entities, 53 inferred relationships (STIX 2.1).

Threat Actor (3)

Storm-1849
Akira
Akira Ransomware

Technique (7)

Brute Force
Data Breach
Ransomware
Password Spraying
T1071 - Command And Control
T1078 - Valid Accounts
T1110 - Brute Force

Campaign (1)

Akira ransomware campaigns

Organization (4)

Cisco
Fortinet
Palo Alto Networks
Sonicwall

Vulnerability (1)

CVE-2024-40766

Malware (1)

Sesameop

Affected Platform (8)

Cisco ASA
MySonicWall
MySonicWall Backup Service
MySonicWall Cloud Backup
MySonicWall.com
SonicOS
SonicWall firewall
Sslvpn

Tool (1)

OpenAI Assistants API

Relationships

Storm-1849 uses Sesameop
Akira uses Sesameop
Akira Ransomware uses Sesameop
Storm-1849 uses OpenAI Assistants API
Akira uses OpenAI Assistants API
Akira Ransomware uses OpenAI Assistants API
Storm-1849 uses Brute Force
Storm-1849 uses Data Breach
Storm-1849 uses Ransomware
Storm-1849 uses Password Spraying
Storm-1849 uses T1071 - Command And Control
Akira uses Brute Force
Akira uses Data Breach
Akira uses Ransomware
Akira uses Password Spraying
Akira uses T1071 - Command And Control
Akira Ransomware uses Brute Force
Akira Ransomware uses Data Breach
Akira Ransomware uses Ransomware
Akira Ransomware uses Password Spraying
Akira Ransomware uses T1071 - Command And Control
Sesameop exploits CVE-2024-40766
OpenAI Assistants API exploits CVE-2024-40766
Akira ransomware campaigns attributed to Storm-1849
Akira ransomware campaigns attributed to Akira
Akira ransomware campaigns attributed to Akira Ransomware
Akira ransomware campaigns uses Sesameop
CVE-2024-40766 targets Cisco ASA
CVE-2024-40766 targets MySonicWall
CVE-2024-40766 targets MySonicWall Backup Service
CVE-2024-40766 targets MySonicWall Cloud Backup
Storm-1849 targets Cisco
Storm-1849 targets Fortinet
Storm-1849 targets Palo Alto Networks
Storm-1849 targets Sonicwall
Akira targets Cisco
Akira targets Fortinet
Akira targets Palo Alto Networks
Akira targets Sonicwall
Akira Ransomware targets Cisco
Akira Ransomware targets Fortinet
Akira Ransomware targets Palo Alto Networks
Akira Ransomware targets Sonicwall
Sesameop targets Cisco
Sesameop targets Fortinet
Sesameop targets Palo Alto Networks
Sesameop targets Sonicwall
Storm-1849 related to T1078 - Valid Accounts
Storm-1849 related to T1110 - Brute Force
Storm-1849 related to MySonicWall.com
Storm-1849 related to SonicOS
Storm-1849 related to SonicWall firewall
Storm-1849 related to Sslvpn

Continue Reading

Critical SonicWall SMA1000 Vulnerabilities Under Active Exploitation Akira Ransomware Group Targets Critical Infrastructure, Extracts $42 Million Persistent Firestarter Malware Targets Cisco Firepower Devices in US Agencies Exploitation of Remote Services in Cyber Attacks CVE-2024-40766 Exploited by Ransomware Groups Targeting SonicWall Firewalls Ransomware Group Targets SonicWall Gen 7 Firewalls via CVE-2024-40766

SonicWall Investigates State-Backed Breach of Cloud Backup Service

Article Content

More articles in this cluster

Attack Flow

Defensive Countermeasures

Extracted Entities

Continue Reading