Firewall Lockouts: Play Ransomware and SonicWall Exploits

Halcyon reports several incidents where ransomware groups (Play, Akira, Qilin) forcibly took control of SonicWall firewalls—locking out administrators and rendering breakglass accounts useless—leading responders to require ISP-level isolation and physical factory resets (a “paperclip” reset) to recover. The report highlights a debate between exploit of a potential zero-day versus misconfiguration during Gen-6 to Gen-7 migrations, notes widespread probing of internet-facing firewalls, and offers practical mitigation guidance (MFA, access restrictions, offsite backups, planning for ISP isolation).