So good. The lesson isn’t really about SonicWall, though many will breeze past and see it just as that. It’s easy to blame the brand and feel safe on Cisco or Palo Alto. At this point, I can’t name a vendor that hasn’t had some embarrassing bug. For this one, it was a hardcoded Erlang cookie and a static AES key. And on top of that, it’s just as easy to say “we’re on Entra” or “we’re on Okta” and forget that most still have some hooks back to Active Directory.
What I find interesting is the chain. SonicWall disclosed this on July 14, and mass scanning started on the 16th. The attacker pulled the stored LDAP service account credentials, then used old, public tools to DCSync seven domain controllers across five environments.
None of the steps were really new or novel but the danger was in how they chained together and how fast it moved. Exploits show up within days or even hours, while we keep adding integrations and carving up infra like swiss cheese, and each one leaves another credential sitting somewhere nobody is watching.
I think a lot of orgs are headed for a hard look at their infrastructure. That means fewer standing credentials, service accounts with only the rights they need, and real visibility into the boxes at the edge. Patching faster won’t get us out of this. Rebuilding the foundation will.