pwn.watch: Nation-state incident updates

[high] SonicWall: state actor stole firewall config backups of every cloud-backup customer

Wed, 05 Nov 2025 00:00:00 GMT

SonicWall and Mandiant confirmed that a state-sponsored actor used an API call to pull firewall configuration backup files for all customers using MySonicWall cloud backup, after first saying fewer than 5% were affected. The files include credentials and network details, so customers had to reset firewall, VPN, directory and API secrets.

Status: closed · Patch: no-fix-needed

Latest updates:

2025-11: SonicWall says the investigation is complete and attributes it to a state-sponsored actor (source)
2025-10-08: SonicWall and Mandiant confirm all cloud-backup customers' files were accessed (source)
2025-09-17: SonicWall discloses unauthorized access to cloud backup files (initially <5% of customers) (source)

[critical] F5 breached by nation-state actor: BIG-IP source code and undisclosed bugs stolen

Wed, 15 Oct 2025 00:00:00 GMT

F5 disclosed that a sophisticated nation-state actor had long-term access to its BIG-IP development and engineering systems and stole parts of the BIG-IP source code, information on undisclosed vulnerabilities and some customer configuration data. CISA issued Emergency Directive 26-01 ordering agencies to inventory and patch F5 gear. Researchers linked it to China-nexus UNC5221 and BRICKSTORM.

Status: closed · Patch: patched · Fixed in: F5 October 2025 Quarterly Security Notification releases

Latest updates:

2025-10-15: F5 discloses the breach (SEC 8-K) and ships patches (source)
2025-10-15: CISA issues Emergency Directive 26-01 for F5 devices (source)
2025-08-09: F5 learns of the intrusion (source)

[critical] BeyondTrust Remote Support breach reaches US Treasury (CVE-2024-12356)

Mon, 30 Dec 2024 00:00:00 GMT

Attackers stole a BeyondTrust infrastructure API key for its Remote Support SaaS service and used it to reset local passwords and access 17 customer instances. The US Treasury, one of the customers, said a China state-sponsored actor accessed some Departmental Offices workstations and unclassified documents. During the investigation BeyondTrust found a critical command injection in Remote Support and Privileged Remote Access (CVE-2024-12356, CVSS 9.8) and patched it on 2024-12-16. Added to the CISA KEV catalog on 2024-12-19.

Status: closed · Patch: patched · Fixed in: Patches BT24-10-ONPREM1 / BT24-10-ONPREM2 (BeyondTrust); cloud instances patched 2024-12-16

Latest updates:

2024-12-30: Treasury tells Congress of a 'major incident' attributed to a China state-sponsored APT (source)
2024-12-19: CISA added CVE-2024-12356 to the KEV catalog (federal deadline 2024-12-27) (source)
2024-12-17: CVE-2024-12356 published (source)

CVEs: CVE-2024-12356

[critical] Salt Typhoon: Chinese state hackers inside US telecom networks

Wed, 04 Dec 2024 00:00:00 GMT

PRC-affiliated actors (publicly called Salt Typhoon) compromised networks at multiple US telecommunications companies. The FBI and CISA said they stole customer call records, got into the private communications of a limited number of people mainly involved in government or political activity, and copied information subject to US law enforcement wiretap requests. Allied agencies then published hardening guidance for communications infrastructure.

Status: closed · Patch: no-fix-needed

Latest updates:

2024-12-04: CISA, NSA, FBI and Five Eyes partners release hardening guidance for communications infrastructure (source)
2024-11-13: FBI and CISA joint statement on PRC targeting of commercial telecommunications (source)

[high] Midnight Blizzard breaches Microsoft corporate email

Tue, 02 Apr 2024 00:00:00 GMT

Russia's Midnight Blizzard (APT29) password-sprayed a legacy, non-production Microsoft test tenant without MFA, then abused an OAuth app to read email of Microsoft senior leadership and security staff. Microsoft detected the attack on 2024-01-12. Stolen emails included correspondence with US federal agencies, so CISA issued Emergency Directive 24-02 ordering agencies to analyze the exposed emails and reset any compromised credentials.

Status: closed · Patch: no-fix-needed

Latest updates:

2024-04-02: CISA issues Emergency Directive 24-02 for agencies whose email with Microsoft was exposed (source)
2024-01-25: Microsoft publishes guidance for responders on the Midnight Blizzard attack (source)
2024-01-12: Microsoft detects a nation-state attack on its corporate systems (source)