--- schema: 1 kind: vulnerability title: > CVE-2026-15409 — SonicWall SMA1000: unauthenticated SSRF (CVSS 10.0) chained to post-auth code injection, actively exploited headline: > SonicWall confirms active exploitation of an unauthenticated SMA1000 SSRF chained to code injection for full appliance takeover summary: > SonicWall's PSIRT confirms active exploitation of two SMA1000 flaws (SNWLID-2026-0008), both added to CISA KEV on 2026-07-14: CVE-2026-15409 (CVSS 10.0), an unauthenticated server-side request forgery in the SMA1000 Work Place interface, and CVE-2026-15410 (CVSS 7.2), a post-authentication OS-command code injection in the Appliance Management Console. Any organization running an internet-facing SMA1000 (6210/7210/8200v) must apply the platform hotfix now. discovered_at: "2026-07-14T20:19:53Z" updated_at: "2026-09-12T04:09:19Z" event_date: 2026-07-14 run_id: 2026-07-14T2009Z-intel priority: high immediate_action: null tags: - vulnerabilities - actively-exploited - zero-day - pre-auth - rce - cisa-kev - patch-available - auth-bypass - ransomware - organized-crime regions: - global - europe sectors: - public-sector - finance - energy - healthcare - telco entities: - "actor:uta0533" - "tool:sonicwall-sma-uta0533-toolset" - "actor:inc-ransom" techniques: - T1190 - T1059 - T1133 - T1068 - T1055 - T1505.003 - T1037.004 - T1090.003 - T1040 - T1601.002 - T1539 - T1111 - T1657 - T1486 - T1003.002 - T1003.004 - T1003.006 - T1550.002 - T1105 affected_products: - SonicWall SMA1000 - SonicWall Secure Mobile Access (SMA) 1000 cves: - id: CVE-2026-15409 cvss: "10.0" epss: null type: ssrf vector: zero-click auth: pre-auth status: - exploited - cisa-kev - patch-available affected: > SMA 1000 (6210, 7210, 8200v and CMS, all hypervisors) 12.4.3-03245, 12.4.3-03387, 12.4.3-03434; 12.5.0-02283, 12.5.0-02624, 12.5.0-02800 fixed: "12.4.3-03453 and higher; 12.5.0-02835 and higher" - id: CVE-2026-15410 cvss: "7.2" epss: null type: rce vector: zero-click auth: admin-required status: - exploited - cisa-kev - patch-available affected: Same SMA 1000 build list as CVE-2026-15409 fixed: "12.4.3-03453 and higher; 12.5.0-02835 and higher" sources: - url: "https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2026-0008" publisher: SonicWall PSIRT date: 2026-07-14 role: primary - url: "https://www.volexity.com/blog/2026/07/17/proxying-to-compromise-sonicwall-secure-mobile-access-0-day-exploitation/" publisher: Volexity date: 2026-07-17 role: primary - url: "https://www.rapid7.com/blog/post/etr-rapid7-mdr-team-discovers-new-sonicwall-sma1000-zero-days-being-actively-exploited-cve-2026-15409-cve-2026-15410/" publisher: Rapid7 date: 2026-07-16 role: corroborating - url: "https://thehackernews.com/2026/08/inc-ransomware-emerges-as-dominant.html" publisher: The Hacker News date: 2026-08-03 role: primary - url: "https://www.resecurity.com/blog/article/from-wsproxy-to-root-inc-ransomware-and-sonicwall-sma-exploit-chain" publisher: Resecurity date: 2026-08-01 role: primary - url: "https://www.securityweek.com/recent-sonicwall-vulnerabilities-exploited-in-ransomware-attacks/" publisher: SecurityWeek date: 2026-08-03 role: corroborating - url: "https://www.darkreading.com/vulnerabilities-threats/inc-ransomware-exploits-sonicwall-sma-zero-days" publisher: Dark Reading date: 2026-07-17 role: corroborating - url: "https://www.sonicwall.com/support/notices/product-notice-sma-1000-series-affected-by-multiple-vulnerabilities/kA1VN000001nv6D0AQ" publisher: SonicWall date: 2026-07-14 role: corroborating - url: "https://securityaffairs.com/198864/hacking/uk-council-attack-linked-to-mass-exploitation-of-sonicwall-flaw.html" publisher: Security Affairs date: 2026-09-11 role: corroborating - url: "https://radar.offseq.com/threat/open-directory-exposes-a-full-sonicwall-sma1000-credential-theft-campaign-250-targets-5-domains-fully-d4ce0567ed92186b" publisher: OffSeq Threat Radar date: 2026-09-10 role: corroborating closed_sources: [] evidence: - quote: SonicWall PSIRT has investigated multiple cases indicating the active exploitation of the vulnerabilities described in this advisory. Customers are strongly urged to upgrade to the hotfix release as soon as possible to remediate these vulnerabilities. publisher: SonicWall PSIRT - quote: A Server-side request forgery (SSRF) vulnerability has been identified in the SMA1000 Appliance Work Place interface. A remote unauthenticated attacker could potentially cause the appliance to make requests to unintended location. publisher: SonicWall PSIRT - quote: "Sean Koessel and Steven Adair of Volexity - helped advance SonicWall's PSIRT investigation, leading to the identification of an additional IOC." publisher: SonicWall PSIRT - quote: No valid SMA session cookie was required during this process. publisher: Volexity - quote: SonicWall PSIRT has investigated multiple cases indicating the active exploitation of the vulnerabilities described in this advisory. publisher: SonicWall PSIRT (SNWLID-2026-0008) - quote: "the threat actors quickly shifted to lateral movement, pivoting from the compromised appliance directly into the internal corporate network" publisher: Rapid7 - quote: "More recently, INC Ransomware has emerged as the dominant threat actor actively weaponizing this vulnerability chain." publisher: The Hacker News - quote: We observed the threat actor maintaining persistence and rolling the newly applied patch back to a vulnerable state to maintain access. A comprehensive forensic review of the firewall is required to ensure complete eviction. publisher: Dark Reading - quote: "Setuid binaries, Python injectors, modified init scripts, and NGINX Unit configuration changes can survive reboots and may persist after a superficial firmware upgrade if not remediated. A patched appliance that still contains ROOTRUN or KNUCKLEBALL remains compromised." publisher: Resecurity - quote: "many of the new victims received emails, as well as phone calls from unknown organizations claiming to assist with ransomware issues" publisher: Resecurity - quote: "The new victims listed on INC Ransomware's DLS between July 17, 2026 and August 1, 2026 include private sector and government organizations from Australia, the US, UAE, Colombia, Switzerland, and other countries." publisher: Resecurity - quote: "Across the wider campaign, compromised appliances were used as footholds into internal networks. The operator deployed a standalone Linux build of Impacket's secretsdump directly onto selected SonicWall appliances, enabling remote credential theft from internal Windows systems." publisher: "Hunt.io (quoted by Security Affairs)" - quote: "The appliances associated with confirmed SAM and LSA theft were distributed across infrastructure in France, India, Italy and the United States." publisher: "Hunt.io (quoted by Security Affairs)" - quote: "By 16 July 2026, two days after SonicWall disclosed CVE-2026-15409, a threat actor was using modified, multithreaded tooling to identify vulnerable SMA 1000 appliances, extract and decrypt LDAP credentials, and automate follow-on credential theft against internal Active Directory environments." publisher: "Hunt.io (quoted by Security Affairs)" verification: single-source sourcing_note: > Primary and sole citeable source is SonicWall's own PSIRT advisory for its own product (an acceptable single-source basis under the vendor-advisory carve-out). CISA independently listed both CVEs on its Known Exploited Vulnerabilities catalog on 2026-07-14 (confirmed against the KEV feed via the bridge fetcher) — an independent government confirmation of the exploitation status recorded in the CVE status field; the KEV catalog root is not itself a citeable per-item source, so it is noted here rather than linked. The advisory was published 2026-07-14; no independent press write-up of SNWLID-2026-0008 existed in-window. Volexity's involvement (a firm with a state-nexus edge-device track record) indicates the exploitation was encountered in the field, consistent with targeted rather than mass abuse; no actor attribution has been published. confidence: high references: [] deep_dive: false deep_dive_category: null org_triage: null classification: reliability: A credibility: 2 watchlist_hit: false actions: - "Upgrade every internet-facing SonicWall SMA1000 (6210/7210/8200v) to platform-hotfix 12.4.3-03453 or 12.5.0-02835 now — active exploitation is vendor-confirmed and both CVEs are KEV-listed; SMA100-series and firewall-hosted SSL-VPN are not affected, so scope the emergency change to SMA1000 only." - "Treat any SonicWall SMA 1000 that was internet-exposed and unpatched before the hotfix as compromised, not merely vulnerable: re-image rather than patch in place, then reset all account passwords and TOTP seeds — UTA0533 established on-appliance persistence and captured cleartext LDAP credentials, so stolen secrets and implants survive the patch." - "On every SMA 1000 you remediated for CVE-2026-15409/-15410, re-verify the installed firmware version now (Rapid7 observed the actor rolling an applied patch back to a vulnerable state) and widen the credential rotation beyond account passwords and TOTP seeds to directory-service bind credentials for LDAP/RADIUS/Active Directory and every certificate and API key configured on the appliance." updates: - at: "2026-07-18T04:35:00Z" run_id: 2026-07-18T0409Z-intel type: update summary: > Volexity has reconstructed the intrusion behind the actively-exploited SonicWall SMA 1000 zero-days (CVE-2026-15409 SSRF, CVE-2026-15410 path-traversal command injection), attributing it to an actor it tracks as UTA0533 with the earliest compromise on 2026-06-22. The chain: an unauthenticated /wsproxy request tunnels to a localhost-only service for initial code execution, a hotfix-rollback path traversal escalates to root, then the actor injects a proxy (Suo5) and a Java webshell (ORANGETAIL) into the appliance's legitimate workplace process, persists via an init script, captures cleartext LDAP credentials with tcpdump, and pivots into the internal network. Stolen credentials survive patching — the hotfix alone does not remediate a pre-patch compromise. fields: - actions - affected_products - cves - entities - evidence - regions - sources - tags - techniques - body merged_from: 2026-07-18/sonicwall-sma1000-uta0533-exploitation-kill-chain - at: "2026-08-04T06:10:00Z" run_id: 2026-08-04T0411Z-intel type: update summary: > Update to this pipeline's 2026-07-18 SonicWall SMA 1000 kill-chain entry. Rapid7's director of vulnerability intelligence told The Hacker News on 2026-08-03 that INC Ransom "has emerged as the dominant threat actor actively weaponizing this vulnerability chain" — a characterisation, not a new link, since Rapid7 first attributed the activity to INC on 2026-07-17. Two facts change defender behaviour. Rapid7 observed the actor rolling a newly applied patch back to a vulnerable state to keep access, so patch state has to be re-verified after remediation and an up-to-date version string is not evidence of eviction. And at the extortion stage victims are receiving unsolicited email and telephone contact from parties offering to help with their ransomware problem. Resecurity also widens the required credential-rotation scope well beyond passwords and MFA seeds. fields: - actions - cves - entities - evidence - sources - tags - techniques - body merged_from: 2026-08-04/inc-ransom-sonicwall-sma1000-patch-rollback-fake-ir-outreach - at: "2026-09-12T04:09:19Z" run_id: 2026-09-12T0409Z-intel type: update summary: > Hunt.io names a first confirmed victim of the wider mass-exploitation wave against this same CVE — the Borough Council of King's Lynn and West Norfolk (UK local government) — and reconstructs a technique distinct from UTA0533's earlier targeted intrusion: operators ran a standalone Linux build of Impacket's secretsdump directly on compromised SonicWall appliances against internal Windows hosts, reaching full DCSync replication in 5 of 250 targeted environments. This is reported as a materially broader, opportunistic wave, not attributed to UTA0533 or INC Ransom. fields: [techniques, sources, evidence, actions, sourcing_note, body] migrated_from: null --- SonicWall's PSIRT advisory SNWLID-2026-0008 (first published 2026-07-14) states it has investigated "multiple cases indicating the active exploitation" of two new SMA1000 flaws ([SonicWall PSIRT, 2026-07-14](https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2026-0008)); both CVEs carry a same-day CISA KEV listing (recorded in this entry's CVE status, confirmed against the KEV feed). **CVE-2026-15409** (CVSS 10.0, CWE-918) is a server-side request forgery in the SMA1000 Work Place interface that lets a remote, unauthenticated attacker force the appliance to issue requests to an attacker-chosen location; the scope-changed CVSS vector (S:C) indicates the SSRF reaches beyond the vulnerable component's own security boundary. **CVE-2026-15410** (CVSS 7.2, CWE-94) is a post-authentication code-injection flaw in the SMA1000 Appliance Management Console (AMC) that lets an authenticated administrator-level session run arbitrary OS commands — read together with the pre-auth SSRF, the pair forms a chain from zero access toward root-equivalent appliance control. The affected firmware is SMA1000 6210/7210/8200v on 12.4.3-03245/03387/03434 and 12.5.0-02283/02624/02800; the fix is platform-hotfix 12.4.3-03453 or 12.5.0-02835, and SonicWall explicitly states neither flaw affects SSL-VPN running on SonicWall firewalls or the SMA100 series ([SonicWall PSIRT, 2026-07-14](https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2026-0008)). **Defender takeaway:** this is the SSL-VPN edge-appliance exploitation pattern that turns into a foothold fast — patch now and, because exploitation is already live, treat an unpatched exposed SMA1000 as a compromise-assessment candidate rather than a clean patch. **Triage:** the pre-auth SSRF surfaces in the appliance's own request telemetry as outbound requests from the Work Place interface to unexpected internal or external hosts (a legitimate Work Place session does not initiate arbitrary outbound fetches); the code-injection stage surfaces in the control-service log as configuration or hotfix-state manipulation from an admin session — SonicWall's own detection guidance points at hotfix-rollback entries carrying path-traversal-style names as the anomaly, so rollback activity that does not match a change-managed maintenance window is the discriminator. Per policy no IOCs are reproduced here; consult the vendor advisory for the indicator set. ## Update — 2026-07-18T04:35:00Z The original entry recorded SonicWall's confirmation that CVE-2026-15409/-15410 were being exploited as zero-days and directed emergency patching. Volexity has now published the reconstructed intrusion, attributed it to an actor it tracks as **UTA0533**, and shown that patching alone is insufficient — the delta below is the full kill chain, the on-appliance implants, and the compromise-response guidance the terse advisory did not carry ([Volexity, 2026-07-17](https://www.volexity.com/blog/2026/07/17/proxying-to-compromise-sonicwall-secure-mobile-access-0-day-exploitation/)). Volexity was engaged after suspect authentication and lateral movement were seen originating *from* SonicWall SMA 1000 appliances (models 6210/7210/8200v); the earliest sign of compromise was 2026-06-22, weeks before SonicWall's 2026-07-14 disclosure ([Volexity, 2026-07-17](https://www.volexity.com/blog/2026/07/17/proxying-to-compromise-sonicwall-secure-mobile-access-0-day-exploitation/)). SonicWall's PSIRT confirms it "has investigated multiple cases indicating the active exploitation of the vulnerabilities described in this advisory" ([SonicWall SNWLID-2026-0008, 2026-07-14](https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2026-0008)), and Rapid7's MDR team independently found the same two zero-days under attack ([Rapid7, 2026-07-16](https://www.rapid7.com/blog/post/etr-rapid7-mdr-team-discovers-new-sonicwall-sma1000-zero-days-being-actively-exploited-cve-2026-15409-cve-2026-15410/)). **Initial access (T1190, T1133).** CVE-2026-15409 is a pre-authentication server-side request forgery in the SMA 1000 `/wsproxy` endpoint. A crafted WebSocket-upgrade request establishes a tunnel from the unauthenticated external attacker straight to services that are supposed to be reachable only on the appliance's own loopback — Volexity confirms "no valid SMA session cookie was required during this process" ([Volexity, 2026-07-17](https://www.volexity.com/blog/2026/07/17/proxying-to-compromise-sonicwall-secure-mobile-access-0-day-exploitation/)). Through the tunnel the actor reached the appliance's bundled CouchDB/Erlang services and a localhost-only control service; the shipped CouchDB carries hardcoded `admin:admin` credentials, and the control service's authentication password is derivable from a device UUID, so the SSRF turns both into part of the external attack surface. **Privilege escalation (T1068).** CVE-2026-15410 is a path traversal in the hotfix-rollback workflow: the `sysCtrl.execRemoveHotfix` operation builds a rollback path from caller-controlled input and hands it to `/usr/local/bin/remove_hotfix`, which then executes it. A rollback name containing directory-traversal sequences resolves outside the intended rollback directory and runs an attacker-staged script as root. **Persistence and implants (T1055, T1505.003, T1090.003, T1037.004).** With root, UTA0533 dropped a setuid helper and a Python loader Volexity calls **KNUCKLEBALL**, which injects two JAR archives into the appliance's legitimate `workplace` process: the open-source **Suo5** HTTP proxy-forwarder and a Behinder-like Java webshell Volexity calls **ORANGETAIL**. Persistence was established by adding a call to the loader inside the appliance's `workplace` init script, and the NGINX Unit configuration was rewritten to add routes that proxy attacker-chosen (arbitrary) request paths to the injected webshell and proxy — so hunting for a fixed URL is the wrong shape; the behaviour is unexpected route entries in the appliance's own reverse-proxy configuration. **Credential access and lateral movement (T1040, T1059).** The actor ran `tcpdump` from a script staged in the appliance's temp directory to capture unencrypted LDAP traffic (TCP 389), harvesting directory credentials off the wire ([Volexity, 2026-07-17](https://www.volexity.com/blog/2026/07/17/proxying-to-compromise-sonicwall-secure-mobile-access-0-day-exploitation/)). Rapid7's engagement observed the actor then "quickly shifted to lateral movement, pivoting from the compromised appliance directly into the internal corporate network" ([Rapid7, 2026-07-16](https://www.rapid7.com/blog/post/etr-rapid7-mdr-team-discovers-new-sonicwall-sma1000-zero-days-being-actively-exploited-cve-2026-15409-cve-2026-15410/)). How far that onward movement reached differs across the two IR firms' cases: Volexity concludes that in the appliances *it* investigated, "available evidence suggests the threat actor was less successful moving laterally or gaining access to other systems" ([Volexity, 2026-07-17](https://www.volexity.com/blog/2026/07/17/proxying-to-compromise-sonicwall-secure-mobile-access-0-day-exploitation/)) — so treat a foothold on the appliance as a demonstrated launch point for internal movement, but not evidence that deep lateral movement always succeeds. **Defender takeaway:** Patching to the hotfix (12.4.3-03453 / 12.5.0-02835) closes the two CVEs but does nothing about credentials already captured or implants already planted, so any appliance that was exposed and unpatched must be handled as an assume-compromise: SonicWall and both IR firms recommend re-imaging on any indicator, and resetting all account passwords and TOTP seeds. Detection concepts, telemetry-class first: in the appliance's web/access logs, unauthenticated `/wsproxy` WebSocket-upgrade requests that return a 101 protocol-upgrade status with no valid session cookie and target an internal (loopback-facing) service port; in the control-service log, hotfix-rollback operations carrying path-traversal sequences in the rollback name; on the network, LDAP binds and other authentication originating *from* the SMA appliance's own address, and any egress or lateral connection from an appliance that should only ever terminate inbound VPN sessions. **Triage:** an SMA 1000 legitimately proxies authenticated user sessions inbound — the discriminators are a `/wsproxy` upgrade with no session cookie reaching a loopback service, and the appliance itself *initiating* authentication or connections into the internal network, which a remote-access gateway has no benign reason to do. ## Update — 2026-08-04T06:10:00Z The earlier entry reconstructed UTA0533's appliance-to-network kill chain against SonicWall SMA 1000 and told readers to treat an exposed, unpatched appliance as compromised rather than merely vulnerable. That direction stands. Four things have moved since, and two of them change what "remediated" means. **Who is on the chain.** Rapid7's director of vulnerability intelligence, Douglas McKee, told The Hacker News that "More recently, INC Ransomware has emerged as the dominant threat actor actively weaponizing this vulnerability chain", and that the technical correlation with the pre-disclosure cluster "indicates that a single threat actor or coordinated group is responsible for discovering and exploiting this zero-day vulnerability" ([The Hacker News, 2026-08-03](https://thehackernews.com/2026/08/inc-ransomware-emerges-as-dominant.html)). Two limits belong with that quote. Rapid7 attributed this activity to INC Ransom on 2026-07-17, hours before this pipeline's 2026-07-18 entry, which did not carry it ([Dark Reading, 2026-07-17](https://www.darkreading.com/vulnerabilities-threats/inc-ransomware-exploits-sonicwall-sma-zero-days)) — so the actor link is seventeen days old and the new element is only the *dominance* characterisation. And the overlap claim is Rapid7's alone: Volexity, which named the UTA0533 cluster, has published no INC link, so the wider framing that both firms made that connection is not supported. **A patch you applied is not necessarily a patch that is running.** This is the finding with the most operational consequence, and no prior entry here has carried it. Rapid7's director of incident response, Brett Deroche, describes containment succeeding in most engagements but not all: "We observed the threat actor maintaining persistence and rolling the newly applied patch back to a vulnerable state to maintain access. A comprehensive forensic review of the firewall is required to ensure complete eviction." A root-level attacker resident on the appliance can undo remediation, which means the standard verification — check the version, close the ticket — reports success on a box that is still owned. Resecurity's DFIR work reaches the same conclusion from the artifact side: "Setuid binaries, Python injectors, modified init scripts, and NGINX Unit configuration changes can survive reboots and may persist after a superficial firmware upgrade if not remediated. A patched appliance that still contains ROOTRUN or KNUCKLEBALL remains compromised" ([Resecurity, 2026-08-01](https://www.resecurity.com/blog/article/from-wsproxy-to-root-inc-ransomware-and-sonicwall-sma-exploit-chain)). **The rotation scope is wider than passwords and MFA seeds.** Rapid7 reports that the attacks used the appliance foothold to extract high-value credentials, active session databases and TOTP multi-factor-authentication seed configurations ([The Hacker News, 2026-08-03](https://thehackernews.com/2026/08/inc-ransomware-emerges-as-dominant.html)) — stolen session state and MFA seeds keep working after a password reset, which is why the rotation list matters more than it looks. The earlier entry told readers to reset account passwords and TOTP seeds. Resecurity's list of what the appliance processed or stored, and therefore what has to be replaced, extends to SMA administrator passwords, directory-service bind credentials for LDAP, RADIUS and Active Directory, user passwords for every account that authenticated during the exposure window, certificates and API keys configured on the appliance, and TOTP tokens and seeds. Bind credentials are the item most often missed, and they are the ones that grant standing directory access independent of the appliance. Where compromise is confirmed, Resecurity's guidance is to factory-reset, reimage on patched firmware and restore configuration from a backup pre-dating the vulnerable branches — a constraint SonicWall states independently in its own product notice, which limits usable backups to those predating 12.4.3-03245 and 12.5.0-02283 ([SonicWall, 2026-07-14](https://www.sonicwall.com/support/notices/product-notice-sma-1000-series-affected-by-multiple-vulnerabilities/kA1VN000001nv6D0AQ)). **A new pressure layer at the extortion stage.** Resecurity, which has run incident response for several victims, reports that "many of the new victims received emails, as well as phone calls from unknown organizations claiming to assist with ransomware issues", using infrastructure registered shortly after the intrusion. Whether this is the same operation or opportunists reading the leak site, the effect is the same: inbound offers of help with a ransomware problem the organisation has not made public are adversary contact, and the people receiving them are often outside the security team. **On victim geography, hold the claim loosely.** Resecurity reports that INC's leak-site listings between 2026-07-17 and 2026-08-01 "include private sector and government organizations from Australia, the US, UAE, Colombia, Switzerland, and other countries", and SecurityWeek relays that INC "has emerged as the most active one" among actors chaining the two CVEs ([SecurityWeek, 2026-08-03](https://www.securityweek.com/recent-sonicwall-vulnerabilities-exploited-in-ransomware-attacks/)). No organisation is named, no victim or authority has confirmed any listing, and Resecurity does not state that any individual listing was reached through this exploit chain — the country list and the chain are separate claims in the same report. Treat it as an unverified criminal claim rather than evidence of a Swiss compromise. **Defender takeaway:** if you remediated an SMA 1000 in July, the job is not closed. Re-verify the running firmware version rather than trusting the change record, complete the rotation across bind credentials, certificates and API keys as well as user passwords and MFA seeds, and — where the appliance was exposed before the hotfix — treat forensic review, not version checking, as the eviction test. **Triage:** the discriminator for the rollback behaviour is a firmware version that moves *backwards*, or an appliance whose reported version stops matching the deployment record, with no change ticket behind it; benign downgrades happen but they are planned, logged and attributable to an administrator. On the appliance itself the persistence artifacts are the durable signal: an unexpected setuid ELF binary, a loader module in the Python site-packages tree, modifications to the workplace init script, and unexpected proxy routes in the appliance's own NGINX Unit configuration pointing at a loopback backend port. Hunt the route entry rather than a fixed URL, and forward appliance logs off-box, because a root-level attacker edits local ones. Where directory traffic still runs unencrypted, moving LDAP and RADIUS to encrypted transports removes the cleartext-credential harvest this actor performs with on-appliance packet capture. ## Update — 2026-09-12T04:09:19Z Hunt.io's analysis, relayed at length by Security Affairs, links the 17 July 2026 cyberattack on the Borough Council of King's Lynn and West Norfolk (UK local government) — with moderate confidence — to a wider mass-exploitation campaign against CVE-2026-15409, materially broader than the UTA0533-attributed targeted intrusion the earlier updates above describe ([Security Affairs, 2026-09-11](https://securityaffairs.com/198864/hacking/uk-council-attack-linked-to-mass-exploitation-of-sonicwall-flaw.html)). Hunt.io's AttackCapture system crawled an operator's own unauthenticated open directory the same day the council disclosed, recovering the complete toolchain and campaign scope: 250 target appliances, 168 with LDAP configurations exposed (534 Active Directory accounts across 160 domains), 9 environments losing SAM/LSA secrets, and 5 losing their entire domain database via full DCSync replication against 7 domain controllers, with confirmed credential theft in France, India, Italy and the US and a broader target list spanning the UK, Canada, Germany, Sweden, Poland, Hungary, South Korea and Hong Kong. OffSeq's Threat Radar, an AI-generated summary tracker, carries the same campaign statistics in its own posting on the report ([OffSeq Threat Radar, 2026-09-10](https://radar.offseq.com/threat/open-directory-exposes-a-full-sonicwall-sma1000-credential-theft-campaign-250-targets-5-domains-fully-d4ce0567ed92186b)) — a repost rather than independent verification, since it traces to the same Hunt.io findings rather than a separate observation. The technique this wave adds: operators ran a standalone Linux build of Impacket's `secretsdump` directly on the compromised SonicWall appliance itself against internal Windows systems, extracting SAM and LSA secrets and, where the harvested LDAP credentials lacked sufficient privilege to run DCSync directly, falling back to pass-the-hash DCSync replication using machine-account NTLM hashes recovered from those LSA secrets ([Security Affairs, quoting Hunt.io, 2026-09-11](https://securityaffairs.com/198864/hacking/uk-council-attack-linked-to-mass-exploitation-of-sonicwall-flaw.html)). Running the credential-theft tooling from the appliance's own operating system, rather than from a foothold on a monitored Windows or Linux host, is the operative choice: "By 16 July 2026, two days after SonicWall disclosed CVE-2026-15409, a threat actor was using modified, multithreaded tooling to identify vulnerable SMA 1000 appliances, extract and decrypt LDAP credentials, and automate follow-on credential theft against internal Active Directory environments" ([Hunt.io, quoted by Security Affairs, 2026-09-11](https://securityaffairs.com/198864/hacking/uk-council-attack-linked-to-mass-exploitation-of-sonicwall-flaw.html)). Scripts recovered from the directory carried extensive Chinese-language comments, which Hunt.io states is insufficient on its own for attribution; no link to UTA0533 or to INC Ransom is asserted in this reporting — treat it as a separate, broader post-disclosure scanning wave rather than the same operator. **Defender takeaway (delta only):** organizations typically have far less process, file and network visibility into a VPN/firewall appliance's own operating system than into EDR-monitored Windows and Linux hosts — this wave specifically exploited that gap by running its credential-theft tooling on the appliance itself. **Triage:** where forensic capability allows inspecting the appliance's own filesystem and process history (not just its network logs), an unexpected standalone binary or interpreter process on the appliance — distinct from its normal service processes — run against internal LDAP/AD infrastructure is the signature this wave adds to the existing detection guidance above.