In early July 2026, cybersecurity firm Volexity investigated an intrusion involving SonicWall’s Secure Mobile Access (SMA) VPN appliances. The investigation revealed that a threat actor, identified as UTA0533, exploited multiple zero-day vulnerabilities to compromise these devices, deploy custom malware, capture network traffic, and attempt lateral movement within victim networks.
Evidence indicates that exploitation began as early as June 22, 2026. SonicWall disclosed the vulnerabilities on July 14, 2026, affecting SMA 1000 series models (6210, 7210, and 8200v), and addressed them with hotfixes 12.4.3-03453 and 12.5.0-02835.
The attack chain involved CVE-2026-15409, a Server-Side Request Forgery (SSRF) flaw that allowed unauthenticated attackers to abuse the /wsproxy endpoint to establish WebSocket tunnels to localhost services, and CVE-2026-15410, a command injection vulnerability used to gain code execution. This exploitation granted access to internal services, such as CouchDB on port 1050 and the SMA control service on port 8188. The attackers leveraged these exposed internal services to upload files and gather information necessary to access privileged functions.
CVE-2026-15410 enabled path traversal in the execRemoveHotfix function, allowing a file placed in /tmp to execute with root privileges. Log entries referencing “remove_hotfix” and paths like “../../../../../tmp/1234.sh” are strong indicators of exploitation.
On one compromised appliance, UTA0533 installed a setuid root execution tool named xzfind, internally referred to as ROOTRUN. The group also deployed a Python-based implant called KNUCKLEBALL, saved as deploy_new.py. This malware injected Java payloads into a legitimate SonicWall process and achieved persistence by modifying a startup script. The injected payloads included Suo5, an HTTP proxy-forwarding tool, and ORANGETAIL, a custom Java webshell resembling Behinder.
The attackers altered the NGINX Unit configuration to redirect requests from /api/login and /api/logout to the hidden implants. The backdoors required an unusual and invalid browser user-agent string to function, helping them avoid casual detection.
Post-compromise activities included the use of tcpdump to capture unencrypted LDAP traffic. The attackers appeared to be seeking usernames and passwords while attempting to pivot from the VPN appliances to internal systems.
Organizations are advised to immediately apply SonicWall’s fixes, review /var/log/aventail/ logs for suspicious /wsproxy activity, inspect /tmp and /var/tmp for unexpected files, and check /var/lib/unit/conf.json for unauthorized routes pointing to 127.0.0.1:8085. Volexity has also published YARA rules to detect ROOTRUN, KNUCKLEBALL, and related payloads.
This incident underscores the critical importance of promptly addressing zero-day vulnerabilities, especially in devices that serve as gateways to organizational networks. The sophisticated nature of the attack highlights the need for continuous monitoring and proactive security measures to defend against evolving threats.
