sonicwall2 articles
SonicWall Zero-Days Sat Unpatched for Weeks While Hackers Quietly Planted Custom Malware
Two SonicWall zero-day vulnerabilities (CVE-2026-15409 and CVE-2026-15410) in SMA1000 appliances were exploited by a threat actor tracked as UTA0533 for several weeks before patches were released in July, with attacks beginning as early as June 22. The attackers deployed custom malware called KnuckleBall, which injected a Java webshell and an open-source proxy into legitimate processes, granting root access to credentials and network traffic. While SonicWall has since issued hotfixes and CISA has added the flaws to its Known Exploited Vulnerabilities catalog, the group's identity and motivation remain unclear, though the attack's sophistication suggests possible state-sponsored activity.
Unknown Threat Actor Chained SonicWall Zero-Days to Root Before Anyone Knew They Existed
A previously unknown threat actor (UTA0533) exploited two zero-day vulnerabilities — CVE-2026-15409 and CVE-2026-15410 — in SonicWall SMA 1000 series VPN appliances before patches were publicly released, chaining them together to achieve root-level access on compromised devices. The attacker deployed custom malware, including a web shell and HTTP proxy tool, modified startup scripts for persistence, and used packet capture utilities to steal LDAP credentials. While UTA0533 demonstrated advanced capability in compromising the appliances, evidence suggests they had limited success in moving laterally to other systems on the network.