SonicWall's SMA1000 Secure Mobile Access appliances were targeted in zero-day attacks for several weeks, with threat actors exploiting two vulnerabilities to install custom malware. The company confirmed the exploitation of these previously undisclosed flaws, urging customers to apply patches immediately.
The vulnerabilities, identified as CVE-2026-15409 and CVE-2026-15410, affect SMA1000 6210, 7210, and 8200v models. CVE-2026-15409 is a critical server-side request forgery (SSRF) vulnerability, while CVE-2026-15410 is a high-severity command injection flaw. SonicWall released fixes in versions 12.4.3-03453 and 12.5.0-02835.
Incident response firm Volexity, which assisted SonicWall in the investigation, provided a detailed account of the attack chain. Volexity tracks the threat actor responsible as UTA0533, noting that the earliest signs of compromise were observed on June 22, 2026, weeks before SonicWall's public disclosure.
The attack began with the exploitation of CVE-2026-15409. Threat actors abused the SMA1000's `/wsproxy` endpoint to establish unauthenticated WebSocket tunnels. This allowed them to access internal services, including CouchDB and the VPN device's management service, which are typically only accessible from the appliance itself.
Through this access, the attackers queried CouchDB to retrieve the appliance's `product_uuid`, a value necessary for the subsequent stage of the attack. While the exact method used to exploit CouchDB remains unclear, its compromise was a critical step.
Once the `product_uuid` was obtained, UTA0533 exploited the CVE-2026-15410 command injection vulnerability. This was achieved through the Appliance Management Console's `sysCtrl.execRemoveHotfix` RPC method, granting the attackers root-level command execution on the appliance.
With root access, the threat actors deployed a custom malware dropper named KNUCKLEBALL, saved as `deploy_new.py`. KNUCKLEBALL then installed two Java-based malware families specifically designed for SonicWall SMA1000 appliances: Sou5 (`agent_wp8.jar`) and ORANGETAIL (`agent_wp9.jar`).
Sou5 functions as a reverse proxy, enabling attackers to tunnel traffic through the compromised appliance and maintain covert access to internal network resources. ORANGETAIL is a custom Java webshell that allows for the dynamic execution of encrypted Java payloads within an HTTP session on the compromised device.
Further investigation revealed that the attackers modified the appliance's nginx configuration to remotely expose the ORANGETAIL webshell. They also installed ROOTRUN, a privilege-escalation tool designed to execute commands with root privileges.
Despite the "significant" technical sophistication observed in the campaign and malware, Volexity noted that the threat actor had limited success in spreading further into victims' internal networks beyond the compromised appliances.
