Do Son 
Exploitation Chain | Image: Volexity
At a glance
| Actor / group | UTA0533 (Volexity tracking cluster); no nation or identity confirmed |
| Activity type | Zero-day exploit chain against internet-facing VPN appliances |
| Targets / victims | Organizations running SonicWall SMA 1000 appliances (physical models 6210, 7210, 8200v) |
| Scale | At least two appliances confirmed compromised in one case; exploitation from 200+ IPs; wider activity confirmed |
| Status | Patched July 14, 2026; added to CISA KEV; no arrests |
| Source | Volexity; corroborated by SonicWall, Rapid7, and Tenable |
TL;DR
Volexity found a threat actor rooting VPN appliances with a SonicWall SMA zero-day chain. The attacker planted custom malware and tried to spread inside the victim network. SonicWall, CISA, and other vendors have now confirmed active exploitation.
What happened
The exploit chain
Two flaws did the damage. CVE-2026-15409 is a critical SSRF bug in the SMA Work Place interface. It lets an unauthenticated attacker open a tunnel to services meant for localhost only. CVE-2026-15410 is a command-injection flaw in the management console. Chained together, they yield remote code execution as root. First, the attacker reached an internal CouchDB instance shipped with default credentials. From there, they read a hardware ID and abused a hotfix-removal helper. A path-traversal trick then ran their script as root. Volexity says the actor “combined multiple zero-day vulnerabilities to compromise SonicWall SMA VPN appliances.”
What the malware did
After gaining root, the attacker deployed a toolkit. A loader called KNUCKLEBALL injected two Java payloads into a trusted SonicWall process. One was Suo5, an open-source proxy tool. The other was ORANGETAIL, a custom webshell modeled on Behinder. A setuid binary named ROOTRUN handled privilege escalation. The malware hid behind a fake browser user-agent and rewritten web routes. ORANGETAIL only answered requests that carried that specific user-agent. Otherwise, the page returned a normal-looking 404 error. Suo5, meanwhile, let the actor proxy traffic deeper into the network. As a result, the webshell blended into normal appliance traffic.
Who is behind it
Volexity tracks the operator as UTA0533. So far, no vendor has named a country or group. The attacker routed traffic through ExpressVPN and Mullvad exit nodes across more than 200 IP addresses. Notably, several attacker hostnames leaked during lateral movement, including a Kali Linux machine. That detail hints at hands-on-keyboard intrusion rather than automated scanning. Still, attribution stays at the tracking-cluster level, with no confirmed identity. Rapid7’s response team spotted the exploitation before SonicWall’s public disclosure. Volexity’s own case began in early July, and the earliest sign of compromise dated back to June 22, 2026.
Impact and scale
These appliances sit at the network edge by design. A root compromise is therefore serious. With root access, the attacker could read cached credentials and sniff traffic. Volexity saw the actor capture unencrypted LDAP logins with tcpdump. The intruder then tried to pivot to other systems. However, that lateral movement looked less successful. SonicWall confirmed it “investigated multiple cases indicating the active exploitation.” CISA added both flaws to its Known Exploited Vulnerabilities list. It also ordered federal agencies to patch by July 17, 2026. You can read Volexity’s full analysis of the SonicWall SMA zero-day intrusion for the technical chain.
What comes next and how to stay protected
Patching is the first step, not the last. SonicWall fixed both bugs on July 14, 2026. Admins should move to hotfix 12.4.3-03453 or 12.5.0-02835 now. The flaws affect only the SMA 1000 series, not the SMA 100 line or firewall SSL VPN. Even so, SonicWall warns that a patch alone will not clean an already-breached box.
Detection tips
Hunt beyond the patch. Review appliance logs for odd wsproxy WebSocket requests. Watch for the KNUCKLEBALL, Suo5, and ORANGETAIL indicators that Volexity published. Check the nginx config for unexpected proxy routes. Look for strange files in the temporary directories. Also scan for unexpected setuid binaries and unusual outbound connections. Both Volexity and SonicWall offer IOC lists and YARA rules.
Support Our Threat Intelligence
If you find our CVE report and cybersecurity news helpful, consider supporting our work.
Buy Me a Coffee
PayPal
