Found 6 bookmarks
Custom sorting
Attack on SonicWall’s cloud portal exposes customers’ firewall configurations
Attack on SonicWall’s cloud portal exposes customers’ firewall configurations
cyberscoop.com By Matt Kapko September 17, 2025 SonicWall said it confirmed an attack on its MySonicWall.com platform that exposed customers’ firewall configuration files. The company confirmed to CyberScoop that an unidentified cybercriminal accessed SonicWall’s customer portal through a series of brute-force attacks. SonicWall said it confirmed an attack on its MySonicWall.com platform that exposed customers’ firewall configuration files — the latest in a steady stream of security weaknesses impacting the besieged vendor and its customers. The company’s security teams began investigating suspicious activity and validated the attack “in the past few days,” Bret Fitzgerald, senior director of global communications at SonicWall, told CyberScoop. “Our investigation determined that less than 5% of our firewall install base had backup firewall preference files stored in the cloud for these devices accessed by threat actors.” While SonicWall customers have been repeatedly bombarded by actively exploited vulnerabilities in SonicWall devices, this attack marks a new pressure point — an attack on a customer-facing system the company controls. This distinction is significant because it indicates systemic security shortcomings exist throughout SonicWall’s product lines, internal infrastructure and practices. “Incidents like this underscore the importance of security vendors — not just SonicWall — to hold themselves to the same or higher standards that they expect of their customers,” Mauricio Sanchez, senior director of enterprise security and networking research at Dell’Oro Group, told CyberScoop. “When the compromise occurs in a vendor-operated system rather than a customer-deployed product, the consequences can be particularly damaging because trust in the vendor’s broader ecosystem is at stake,” he added. SonicWall acknowledged the potential downstream risk for customers is severe. “While the files contained encrypted passwords, they also included information that could make it easier for attackers to potentially exploit firewalls,” Fitzgerald said. “This was not a ransomware or similar event for SonicWall, rather this was a series of account-by-account brute force attacks aimed at gaining access to the preference files stored in backup for potential further use by threat actors,” he added. SonicWall did not identify or name those responsible for the attack, adding that it hasn’t seen evidence of any online leaks of the stolen files. The company said it disabled access to the backup feature, took steps across infrastructure and processes to bolster the security of its systems and initiated an investigation with assistance from an incident response and consulting firm. Sanchez described the breach as a serious issue. “These files often contain detailed network architecture, rules, and policies that could provide attackers with a roadmap to exploit weaknesses more efficiently,” he said. “While resetting credentials is a necessary first step, it does not address the potential long-term risks tied to the information already in adversaries’ hands.” SonicWall said it has notified law enforcement, impacted customers and partners. Customers can check if impacted serial numbers are listed in their MySonicWall account, and those determined to be at risk are advised to reset credentials, contain, remediate and monitor logs for unusual activity. Many vendors allow customers to store configuration data in cloud-managed portals, a practice that introduces inherent risks, Sanchez said. “Vendors must continuously weigh the convenience provided against the potential consequences of compromise, and customers should hold them accountable to strong transparency and remediation practices when incidents occur,” he added. Organizations using SonicWall firewalls have confronted persistent attack sprees for years, as evidenced by the vendor’s 14 appearances on CISA’s known exploited vulnerabilities catalog since late 2021. Nine of those defects are known to be used in ransomware campaigns, according to CISA, including a recent wave of about 40 Akira ransomware attacks. Fitzgerald said SonicWall is committed to full transparency and the company will share updates as its investigation continues.
#cyberscoop.com#EN#2025#SonicWall#MySonicWall#incident#cloud
·cyberscoop.com·
Attack on SonicWall’s cloud portal exposes customers’ firewall configurations
MySonicWall Cloud Backup File Incident
MySonicWall Cloud Backup File Incident

https://www.sonicwall.com/support/ Updated September 22, 2025 Description SonicWall’s security teams recently detected suspicious activity targeting the cloud backup service for firewalls, which we confirmed as a security incident in the past few days. Our investigation found that threat actors accessed backup firewall preference files stored in the cloud for fewer than 5% of our firewall install base. While credentials within the files were encrypted, the files also included information that could make it easier for attackers to potentially exploit the related firewall. We are not presently aware of these files being leaked online by threat actors. This was not a ransomware or similar event for SonicWall, rather this was a series of brute force attacks aimed at gaining access to the preference files stored in backup for potential further use by threat actors. TIP: Learn more by watching this helpful video guide here Affected Products: SonicWall Firewalls with preference files backed up in MySonicWall.com Due to the sensitivity of the configuration files, we highly encourage customers to take the following steps immediately: Log in to your MySonicWall.com account and verify if cloud backups exist for your registered firewalls: If fields are blank (Figure 1): You are NOT at risk. A screenshot of a computer AI-generated content may be incorrect. Figure 1 – Does Not Contain Backup If fields contain backup details (Figure 2): Please continue reading. Image Figure 2 – Contains Backups Verify whether impacted serial numbers are listed in your account. Upon login, navigate to Product Management | Issue List, the affected serial numbers will be flagged with information such as Friendly Name, Last Download Date and Known Impacted Services. Image If Serial Numbers are shown: the listed firewalls are at risk and should follow the containment and remediation guidelines: Essential Credential Reset NOTE: Impacted Services should be used for general guidance only. The services listed were identified as being enabled and should be immediately reviewed. ALL SERVICES WITH CREDENTIALS THAT WERE ENABLED AT, OR BEFORE, THE TIME OF BACKUP SHOULD BE REVIEWED FOR EACH SERIAL NUMBER LISTED. If you have used the Cloud Backup feature but no Serial Numbers are shown or only some of your registered Serial Numbers: SonicWall will provide additional guidance in coming days to determine if your backup files were impacted. Please check back on this page for this additional information: MySonicWall Cloud Backup File Incident Technical Containment and Mitigation Documentation can be found at: Essential Credential Reset Remediation Playbook NOTE: Use the SonicWall Online Tool to identify services that require remediation. Follow the on-screen instructions to proceed. (UPE Mode is not supported.) We have a dedicated support service team available to help you with any of these changes. If you need any assistance, please login to your MySonicWall account and open a case with our Support team. You can access your account at: https://www.mysonicwall.com/muir/login. Change Log: 2025-9-17 4:40 AM PDT: Initial publish. 2025-9-17 2:45 PM PDT: Minor formatting update. 2025-9-17 8:45 PM PDT: Revised incident disclosure text to clarify scope (%3C5%25%20of%20firewalls),%20encrypted%20credentials,%20no%20known%20leaks,%20and%20brute-force%20(not%20ransomware)%20attack.%0D%0A%20%20%20%202025-9-18%20%205:38%20AM%20PDT:%20Changed%20formatting%20and%20provided%20detailed%20steps%20with%20screenshots.%0D%0A%20%20%20%202025-9-18%20%209:19%20AM%20PDT:%20Updated%20guidance%20steps,%20navigation%20screenshots,%20and%20note%20clarifying%20review%20of%20impacted%20services.%0D%0A%20%20%20%202025-9-18%204:30%20PM%20PDT:%20Updated%20KB%20text%20and%20image%20to%20clarify%20affected%20products,%20provide%20step-by-step%20backup%20verification%20instructions,%20and%20replace%20figures%20showing%20when%20backups%20are%20or%20are%20not%20present.%0D%0A%20%20%20%202025-9-19%201:15%20PM%20PDT:%20No%20updates%20at%20this%20time.%0D%0A%20%20%20%202025-9-20%209:15%20AM%20PDT:%20Added%20a%20Tip%20with%20a%20video%20guide%20and%20a%20Note%20linking%20to%20the%20SonicWall%20online%20tool%20for%20firewall%20configuration%20analysis%20and%20remediation%20guidance.%0D%0A%20%20%20%202025-9-22%208:20%20AM%20PDT:%20No%20updates%20at%20this%20time.%0D%0A%0A%3CDT%3EWe set out to craft the perfect phishing scam. Major AI chatbots were happy to help.

A REUTERS INVESTIGATION By STEVE STECKLOW and POPPY MCPHERSON Filed Sept. 15, 2025, 10:30 a.m. GMT The email seemed innocent enough. It invited senior citizens to learn about the Silver Hearts Foundation, a new charity dedicated to providing the elderly with care and companionship. “We believe every senior deserves dignity and joy in their golden years,” it read. “By clicking here, you’ll discover heartwarming stories of seniors we’ve helped and learn how you can join our mission.” But the charity was fake, and the email’s purpose was to defraud seniors out of large sums of money. Its author: Elon Musk’s artificial-intelligence chatbot, Grok. Grok generated the deception after being asked by Reuters to create a phishing email targeting the elderly. Without prodding, the bot also suggested fine-tuning the pitch to make it more urgent: “Don’t wait! Join our compassionate community today and help transform lives. Click now to act before it’s too late!” The Musk company behind Grok, xAI, didn’t respond to a request for comment. Phishing – tricking people into revealing sensitive information online via scam messages such as the one produced by Grok – is the gateway for many types of online fraud. It’s a global problem, with billions of phishing emails and texts sent every day. And it’s the number-one reported cybercrime in the U.S., according to the Federal Bureau of Investigation. Older people are especially vulnerable: Complaints of phishing by Americans aged 60 and older jumped more than eight-fold last year as they lost at least $4.9 billion to online fraud, FBI data show. Daniel Frank, a retired accountant in California, clicked on a link in an AI-generated simulated phishing email in a Reuters study. “AI is a genie out of the bottle,” he says. REUTERS/Daniel Cole The advent of generative AI has made the problem of phishing much worse, the FBI says. Now, a Reuters investigation shows how anyone can use today’s popular AI chatbots to plan and execute a persuasive scam with ease. Reporters tested the willingness of a half-dozen major bots to ignore their built-in safety training and produce phishing emails for conning older people. The reporters also used the chatbots to help plan a simulated scam campaign, including advice on the best time of day to send the emails. And Reuters partnered with Fred Heiding, a Harvard University researcher and an expert in phishing, to test the effectiveness of some of those emails on a pool of about 100 senior-citizen volunteers. Major chatbots do receive training from their makers to avoid conniving in wrongdoing – but it’s often ineffective. Grok warned a reporter that the malicious email it created “should not be used in real-world scenarios.” The bot nonetheless produced the phishing attempt as requested and dialed it up with the “click now” line. Five other popular AI chatbots were tested as well: OpenAI’s ChatGPT, Meta’s Meta AI, Anthropic’s Claude, Google’s Gemini and DeepSeek, a Chinese AI assistant. They mostly refused to produce emails in response to requests that made clear the intent was to defraud seniors. Still, the chatbots’ defenses against nefarious requests were easy to overcome: All went to work crafting deceptions after mild cajoling or being fed simple ruses – that the messages were needed by a researcher studying phishing, or a novelist writing about a scam operation. “You can always bypass these things,” said Heiding. That gullibility, the testing found, makes chatbots potentially valuable partners in crime. Heiding led a study last year which showed that phishing emails generated by ChatGPT can be just as effective in getting recipients (in that case, university students) to click on potentially malicious links as ones penned by humans. That’s a powerful advance for criminals, because unlike people, AI bots can churn out endless varieties of deceptions instantaneously, at little cost, slashing the money and time needed to perpetrate scams. Harvard researcher Fred Heiding designed the phishing study with Reuters. AI bots have weak defenses against being put to nefarious use, he says: “You can always bypass these things.” REUTERS/Shannon Stapleton Heiding collaborated with Reuters to test the effectiveness of nine of the phishing emails generated using five chatbots on U.S. senior citizens. The seniors – 108 in all – consented to participate as unpaid volunteers. No money or banking information, of course, was taken from the participants. Overall, about 11% of the seniors clicked on the emails sent. Five of the nine scam mails tested drew clicks: two generated by Meta AI, two by Grok and one by Claude. None clicked on emails generated by ChatGPT or DeepSeek. The results don’t measure the bots’ relative power to deceive: The study was designed to assess the effectiveness of AI-generated phishing emails in general, not to compare the five bots. (For more on the study’s methods, see related story.) The reporters used the bots to create several dozen emails, and then, much as a criminal group might do, chose nine that seemed likeliest to hoodwink recipients. That may partly explain why so many seniors clicked on them. It's impossible to know the success rate of phishing messages sent by actual criminals. But Proofpoint, a major California-based cybersecurity firm, has studied simulated phishing campaigns conducted by its clients. Proofpoint found that 5.8% of millions of test scam emails sent last year by clients to their employees succeeded in duping the recipients. “This is an industry-wide c...

#sonicwall.com#EN#2025#incident#MySonicWall#cloud#backup
·sonicwall.com·
MySonicWall Cloud Backup File Incident
Microsoft warns of high-severity flaw in hybrid Exchange deployments
Microsoft warns of high-severity flaw in hybrid Exchange deployments
bleepingcomputer.com - Microsoft has warned customers to mitigate a high-severity vulnerability in Exchange Server hybrid deployments that could allow attackers to escalate privileges in Exchange Online cloud environments undetected. Exchange hybrid configurations connect on-premises Exchange servers to Exchange Online (part of Microsoft 365), allowing for seamless integration of email and calendar features between on-premises and cloud mailboxes, including shared calendars, global address lists, and mail flow. However, in hybrid Exchange deployments, on-prem Exchange Server and Exchange Online also share the same service principal, which is a shared identity used for authentication between the two By abusing this shared identity, attackers who control the on-prem Exchange can potentially forge or manipulate trusted tokens or API calls that the cloud side will accept as legitimate, as it implicitly trusts the on-premises server. Additionally, actions originating from on-premises Exchange don't always generate logs associated with malicious behavior in Microsoft 365; therefore, traditional cloud-based auditing (such as Microsoft Purview or M365 audit logs) may not capture security breaches if they originated on-premises. "In an Exchange hybrid deployment, an attacker who first gains administrative access to an on-premises Exchange server could potentially escalate privileges within the organization's connected cloud environment without leaving easily detectable and auditable trace," Microsoft said on Wednesday in a security advisory describing a high-severity privilege escalation vulnerability now tracked as CVE-2025-53786. The vulnerability affects Exchange Server 2016 and Exchange Server 2019, as well as Microsoft Exchange Server Subscription Edition, the latest version, which replaces the traditional perpetual license model with a subscription-based one. While Microsoft has yet to observe in-the-wild exploitation, the company has tagged it as "Exploitation More Likely" because its analysis revealed that exploit code could be developed to consistently exploit this vulnerability, increasing its attractiveness to attackers.
#bleepingcomputer.com#EN#2025#CISA#Cloud#CVE-2025-53786#Elevation-of-Privileges#Microsoft#Microsoft-Exchange#Privilege-Escalation
·bleepingcomputer.com·
Microsoft warns of high-severity flaw in hybrid Exchange deployments
10K Records Allegedly from Mac Cloud Provider’s Customers Exposed Online
10K Records Allegedly from Mac Cloud Provider’s Customers Exposed Online
SafetyDetectives’ Cybersecurity Team stumbled upon a clear web forum post where a threat actor publicized a database that allegedly belongs to VirtualMacOSX.com. The data purportedly belongs to 10,000 of its customers. In a recent discovery, SafetyDetectives’ Cybersecurity Team stumbled upon a clear web forum post where a threat actor publicized a database that allegedly belongs to VirtualMacOSX.com. The data purportedly belongs to 10,000 of its customers. What Is VirtualMacOSX.com? According to its website, VirtualMacOSX serves 102 countries and has offered “Apple Macintosh cloud based computing since 2012. With the greatest range of cloud based Apple products and services available anywhere on the Web.” Where Was The Data Found? The data was found in a forum post available on the clear surface web. This well-known forum operates message boards dedicated to database downloads, leaks, cracks, and more. What Was Leaked? The author of the post included a 34-line sample of the database, the full database was set to be freely accessible to anyone with an account on the forum willing to either reply or like the post. Our Cybersecurity Team analyzed a segment of the dataset to validate its authenticity. Although the data appeared genuine and we saw indicatives in invoices sent to VirtualMacOSX, we could not definitively confirm that the data belonged to VirtualMacOSX’s customers as, due to ethical considerations, we refrained from testing the exposed credentials. The entire dataset consisted of 176,000 lines split across three separate .txt files named ‘tblcontacts,’ ‘tbltickets,’ and ‘tblclients.’ The sensitive information allegedly belonging to VirtualMacOSX’s customers included: User ID Full name Company name Email Full physical address Phone number Password Password reset key We also saw customers’ financial data such as: Bank name Bank type Bank code Bank account And User’s Support tickets containing: User ID IP Address Full name Email Full Message This type of data is critical as it might be employed by potential wrongdoers to plan and perform various types of attacks on the impacted clients.
#safetydetectives#EN#2025#Mac#Cloud#Provider#data-leak#VirtualMacOSX.com
·safetydetectives.com·
10K Records Allegedly from Mac Cloud Provider’s Customers Exposed Online
New Russia-affiliated actor Void Blizzard targets critical sectors for espionage
New Russia-affiliated actor Void Blizzard targets critical sectors for espionage
Microsoft Threat Intelligence has discovered a cluster of worldwide cloud abuse activity conducted by a threat actor we track as Void Blizzard, who we assess with high confidence is Russia-affiliated and has been active since at least April 2024. Void Blizzard’s cyberespionage operations tend to be highly targeted at specific organizations of interest to Russia, including in government, defense, transportation, media, non-governmental organizations (NGOs), and healthcare sectors primarily in Europe and North America.
#microsoft#EN#2025#Void#Blizzard#espionage#Russia#cloud#abuse
·microsoft.com·
New Russia-affiliated actor Void Blizzard targets critical sectors for espionage
Objet: Secteur du cloud - État de la menace informatique
Objet: Secteur du cloud - État de la menace informatique
Le Cloud computing, devenu incontournable pour les secteurs public et privé, favorise la transformation numérique mais offre également de nouvelles opportunités d’attaques et problématiques de sécurité pour les organisations qui l’utilisent. L'ANSSI observe une augmentation des attaques contre les environnements cloud. Ces campagnes d'attaques, menées à des fins lucratives, d'espionnage et de déstabilisation, affectent les fournisseurs de services cloud (Cloud Service Provider, CSP), en partie ciblés pour les accès qu’ils peuvent offrir vers leurs clients. Elles ciblent également les environnements de clients de services cloud, dont l'hybridation des systèmes d'information générée par l'usage du cloud, augmente la surface d'attaque.
#cert.ssi.gouv.fr#FR#2025#cloud#rapport#attaques
·cert.ssi.gouv.fr·
Objet: Secteur du cloud - État de la menace informatique