Volexity details SonicWall SMA1000 zero-day chain used to deploy custom malware
Summary
Volexity says UTA0533 exploited two SonicWall SMA1000 zero-days from June 22, 2026, chaining unauthenticated WebSocket tunneling and root command injection to install custom malware. Patches are available.
Key points
- Volexity found evidence of UTA0533 activity as early as June 22, 2026, and investigated two compromised SMA1000 appliances.
- CVE-2026-15409 was used to abuse the /wsproxy endpoint and create unauthenticated WebSocket tunnels to internal services, including CouchDB and the management service.
- Attackers obtained the appliance's product_uuid through CouchDB; Volexity said the precise method used to exploit CouchDB remains unknown.
- CVE-2026-15410 was exploited through the Appliance Management Console's sysCtrl.execRemoveHotfix RPC method to execute commands as root.
- The KNUCKLEBALL dropper deployed Sou5, a reverse proxy, and ORANGETAIL, a webshell for executing encrypted Java payloads.
- Attackers changed the nginx configuration to expose ORANGETAIL remotely and installed ROOTRUN for privilege escalation; Volexity said the actor was less successful at spreading into internal networks.
- SonicWall released patches in versions 12.4.3-03453 and 12.5.0-02835 and urged customers to install them.
Article Details
- Attack Vectors
- UTA0533 exploited CVE-2026-15409 to abuse the SMA1000 /wsproxy endpoint and establish unauthenticated WebSocket tunnels to internal services, including CouchDB and the appliance management service.
- After obtaining the appliance's product_uuid, the attackers exploited CVE-2026-15410 through the Appliance Management Console's sysCtrl.execRemoveHotfix RPC method to execute commands as root.
- With root access, the attackers installed the KNUCKLEBALL dropper, which deployed the Sou5 and ORANGETAIL malware families.
- The attackers modified the appliance's nginx configuration to expose the ORANGETAIL webshell remotely and installed ROOTRUN, a privilege-escalation tool.
- Defensive Notes
- SonicWall released patches in versions 12.4.3-03453 and 12.5.0-02835 and urged customers to install them immediately.
- The reported affected appliances are SMA1000 6210, 7210, and 8200v.
MITRE ATT&CK
T1059 · Command and Scripting InterpreterCVE-2026-15410 allowed the attackers to execute commands as root through the Appliance Management Console's sysCtrl.execRemoveHotfix RPC method.T1090 · ProxySou5 functions as a reverse proxy, letting attackers tunnel traffic through the compromised appliance to internal resources.T1190 · Exploit Public-Facing ApplicationUTA0533 exploited CVE-2026-15409 and CVE-2026-15410 against SonicWall SMA1000 appliances.T1505.003 · Web ShellORANGETAIL is a Java webshell that accepts encrypted Java payloads and executes them within an HTTP session; nginx changes exposed it remotely.T1572 · Protocol TunnelingThe attackers used CVE-2026-15409 to establish unauthenticated WebSocket tunnels from the appliance to internal services.
CVE
Threat Actors
Malware
KNUCKLEBALLThe attack chain used CVE-2026-15409 and CVE-2026-15410 to achieve root access and deploy KNUCKLEBALL, Sou5, ORANGETAIL, and ROOTRUN.OrangeTailThe attack chain used CVE-2026-15409 and CVE-2026-15410 to achieve root access and deploy KNUCKLEBALL, Sou5, ORANGETAIL, and ROOTRUN.Sou5The attack chain used CVE-2026-15409 and CVE-2026-15410 to achieve root access and deploy KNUCKLEBALL, Sou5, ORANGETAIL, and ROOTRUN.
Vendors
SonicWallTwo newly disclosed SonicWall SMA1000 vulnerabilities were exploited as zero-days for weeks, giving UTA0533 a path to install custom malware on VPN appliances.VolexityIn a new report, incident response firm Volexity, which assisted SonicWall in investigating the attacks, detailed the full exploitation chain and how threat actors installed the custom malware on compromised SMA1000
Products
CouchDBThis exposed internal applications, including CouchDB and the VPN device’s management service.NGINXThe campaign also used ROOTRUN and nginx changes to extend remote access and privilege escalation.SMA1000Two newly disclosed SonicWall SMA1000 vulnerabilities were exploited as zero-days for weeks, giving UTA0533 a path to install custom malware on VPN appliances.