FIREWALL TURNED FOOT IN THE DOOR:HOW A VENDOR'S STOLEN CREDENTIALS THREATENED A NETWORK

Executive Summary

A recent security incident involving a compromised third-party account highlights how important it is for organizations to closely monitor vendor access and protect sensitive login credentials.

NetCyberOps responded to a series of unusual login attempts sourcing from an external IP address belonging to a SonicWall Firewall. A single account was attempting to login to 23 unique internal systems using administrator credentials—a pattern often seen from threat actors to pivot through the network.

Further investigation revealed the vendor's administrative credentials were leaked to multiple underground websites, confirming that the account was compromised. NetCyberOps helped the client take immediate action—revoking the vendor's access, disabling local logins to firewall devices, and resetting all administrative passwords.

Because the threat was detected early and contained quickly, attackers were blocked before they could gain access to internal systems or sell that access to ransomware groups—a common next step in these kinds of attacks.

Incident Timeline

11:03am

The NetCyberOps team received an incident alert and immediately initiated an investigation. Leveraging Asset Authentication logs within Rapid7 InsightIDR, NetCyberOps analysts identified a pattern of failed network login attempts targeting multiple internal systems.

Initially, NetCyberOps analysts were unable to determine the origin of the login attempts, as the source IP address was not associated with any known asset in SentinelOne. This raised concerns about a potential rogue device operating within the client's environment.

To validate their suspicion, the team activated SentinelOne Ranger, which provided enhanced network visibility and confirmed that the source IP belonged to the client's SonicWall firewall.

11:27am

Armed with this insight, NetCyberOps promptly engaged the client's IT Manager, who retrieved authentication logs from the device. The logs revealed multiple local accounts used to access the firewall, one of which stood out due to its use of a full email address as the username, suggesting possible external vendor access.

Upon identifying that the vendor's account was regularly used to remotely administer the Sonicall device, NetCyberOps analysts turned to Flare.io to investigate the account's exposure.

12:15pm

A search revealed that the vendor's email address had appeared in multiple credential leaks, with the most recent occurrence in April 2025. This discovery raised significant concerns, as it indicated the potential for unauthorized access not only to this client, but possibly to other organizations serviced by the same vendor. While no successful lateral movement had been detected within the network at that stage, NetCyberOps initiated proactive threat hunting to identify any related activity.

Concurrently, the client's IT Manager directed his team to immediately revoke the vendor's access, disable local authentication on all Sonicall devices across the enterprise, and eliminate any login methods that lacked strong authentication controls.

3:05pm

Within a few hours the client's environment had been fully cleared of all unauthorized remote access. The vendor was promptly notified to ensure they could take appropriate measures to secure their own systems and credentials. In parallel, the NetCyberOps team developed and deployed a set of custom threat hunting rules to monitor for any related malicious activity across the client's environment.

Follow Up

Enabling Single Sign-On (SSO) and Multi-Factor Authentication (MFA) for firewall access, and enforcing strong password policies across all administrative accounts.

Turning on full login tracking and limiting management interface access by geography to reduce exposure from untrusted regions.

Regularly auditing privileged vendor accounts and revoking access for any accounts no longer in active use.

Enabling comprehensive authentication logging and applying geo-fencing to restrict management interface access.

Conducting routine audits of all privileged remote access accounts.

Action Items

This incident underscores how even trusted third-party vendors can become high-risk attack vectors when their credentials are compromised. Despite no successful logins, the rapid detection of suspicious activity by NetCyberOps, and swift coordination with the client, prevented what could have been a serious infiltration leading to ransomware or broader system compromise. It highlights the need for strong vendor access controls, continuous credential monitoring, and layered defenses to stop attacks before they start.

Incident Timeline

CURIOUS WHAT IT TAKES TO GET SECURE?