Hackers are conducting brute force attacks against the MySonicWall.com portal in order to access the company’s cloud backup service for firewalls, SonicWall and federal authorities warned in advisories released Monday.
SonicWall said its investigation found that hackers gained access to 5% of backup firewall preference files. The company warned that while credentials inside the files were encrypted, the files contained other information that could help attackers exploit the firewall, according to the advisory.
SonicWall also released a video explaining the scope of the incident.
In an advisory on Monday, the Cybersecurity and Infrastructure Security Agency urged customers to log into their accounts to determine whether their devices are at risk.
SonicWall last week began an investigation related to the exposure of firewall configuration backup files, according to researchers at Arctic Wolf.
SonicWall terminated an “unauthorized backup point” and began working with multiple cybersecurity firms and law enforcement agencies to figure out the extent of the damage.
Researchers urged users to reset their stored credentials.
Firewall configuration files contain sensitive information, including user, group DNS and log settings. Researchers said that nation-state hackers and ransomware groups previously have exploited such information to conduct subsequent attacks.
