Hunt.io Links UK Council Attack to SonicWall SMA1000 Exploitation Campaign

Sep 10, 2026 · Original article ↗

Summary

Hunt.io reports a campaign exploiting CVE-2026-15409 in SonicWall SMA1000 appliances to steal LDAP credentials and Active Directory secrets. It assesses with moderate confidence that the activity is linked to a cyberattack on a UK council.

Key points

The council detected an attack on 17 July 2026; Hunt.io assesses with moderate confidence that it was linked to the wider campaign.
The unnamed operator exploited CVE-2026-15409, an unauthenticated SSRF flaw in the SMA1000 WorkPlace interface, to reach a local Erlang service and execute commands.
Bulk scanning began on 16 July, two days after SonicWall disclosed the vulnerability; the operator adapted a public Rapid7 proof of concept.
The campaign recovered 534 LDAP configuration records from 168 appliances, covering 160 Active Directory domains and 255 internal LDAP endpoints, and decrypted stored passwords.
A standalone Linux build of Impacket secretsdump was run from compromised appliances to steal credentials from internal Windows systems.
SAM and LSA secrets were extracted from nine Active Directory environments; DCSync succeeded against seven domain controllers across five environments, exposing thousands of account records.
Targeting spanned multiple countries and sectors and appeared opportunistic; the campaign was not attributed to a named group or country.

Article Details

Attack Vectors: The operator used Shodan-derived target lists and multithreaded scanning to identify SonicWall SMA1000 appliances vulnerable to CVE-2026-15409.
A modified public proof of concept exploited the WorkPlace /wsproxy endpoint to reach a locally bound Erlang service and execute commands as the appliance's couchdb account.
The operator extracted LDAP configurations from policy_file.xml, decrypted stored passwords on attacker infrastructure, and used the credentials from compromised appliances to access internal Windows systems.
The operator deployed a standalone Linux build of Impacket's secretsdump on selected appliances to extract SAM and LSA secrets. Recovered domain-controller machine-account hashes were used for pass-the-hash authentication and DCSync.
Defensive Notes: The article identifies /tmp/secretsdump, /tmp/dump_[DC].out, and staged .ntds-related files as artifacts of the appliance-based credential-theft workflow.
Hunt.io notes that organizations typically have less visibility into security-appliance operating systems than into EDR-monitored hosts, potentially making this activity harder to detect.

Indicators of compromise

Type	Indicator	Context
IPV4	`95[.]181[.]173[.]36`	Hosted the exposed campaign directory and served the Linux secretsdump payload.
SHA256	`690f5031deede7d3357d0ca24c89866ae8c60e6c63b3a2c8bba813a6ac10ae5b`	SHA-256 of the standalone secretsdump binary deployed to compromised appliances.
URL	`hxxp[:]//95[.]181[.]173[.]36/secretsdump`	Payload URL used to download the standalone secretsdump binary onto compromised appliances.