Two recently disclosed SonicWall SMA1000 vulnerabilities were exploited in zero-day attacks for weeks, allowing threat actors to install custom malware on vulnerable VPN appliances.
Last week, SonicWall warned that threat actors were actively exploiting two previously undisclosed vulnerabilities in an exploit chain that affected SMA1000 Secure Mobile Access appliances.
The flaws, tracked as CVE-2026-15409, a critical server-side request forgery (SSRF) vulnerability, and CVE-2026-15410, a high-severity command injection flaw, affect SMA1000 6210, 7210, and 8200v appliances.
SonicWall released patches in versions 12.4.3-03453 and 12.5.0-02835, urging customers to install the updates immediately.
While SonicWall confirmed that the flaws were exploited as zero-days, they did not disclose details on how the attackers were compromising the devices.
In a new report, incident response firm Volexity, which assisted SonicWall in investigating the attacks, detailed the full exploitation chain and how threat actors installed the custom malware on compromised SMA1000 appliances.
Volexity details zero-day attack chain
According to Volexity, a previously unknown threat actor it tracks as UTA0533 began exploiting the vulnerabilities as early as June 22, weeks before SonicWall publicly disclosed the flaws.
“Volexity’s analysis of logs, disk images, and memory led to the discovery of a threat actor Volexity tracks as UTA0533,” explains the Volexity report.
“This threat actor was observed using multiple zero-day exploits, malware designed specifically for SonicWall SMA VPN appliances, as well as other attacker tradecraft. Volexity notes that June 22, 2026, was the earliest sign of compromise observed in the investigation.”
In an investigation of two compromised appliances, Volexity found that the attackers first exploited CVE-2026-15409 to abuse the SMA1000’s ‘/wsproxy’ endpoint, allowing them to establish unauthenticated WebSocket tunnels to services that should only have been accessible from the appliance itself.
This exposed internal applications, including CouchDB and the VPN device’s management service.
Using this access, the attackers queried CouchDB to obtain the appliance’s ‘product_uuid’, a value required to complete the second stage of the attack. Volexity says the exact method used to exploit CouchDB remains unknown.
After obtaining the appliance’s product_uuid, the attackers exploited the CVE-2026-15410 command injection vulnerability through the Appliance Management Console’s ‘sysCtrl.execRemoveHotfix’ RPC method, allowing them to execute commands as root and take full control of the appliance.
With root access, UTA0533 installed a custom malware dropper that Volexity calls KNUCKLEBALL under the file name ‘deploy_new.py’.
KNUCKLEBALL is used to deploy two Java-based malware families named Sou5 (agent_wp8.jar) and ORANGETAIL (agent_wp9.jar), designed for SonicWall SMA1000 appliances.
Exploit attack chain that ultimately deploys custom SonicWall malware
Source: Volexity
According to Volexity, Sou5 functions as a reverse proxy, allowing attackers to tunnel traffic through the compromised appliance and maintain covert access to internal resources.
ORANGETAIL is a custom Java webshell that allows attackers to send encrypted Java payloads to the compromised appliance and dynamically execute them within an HTTP session.
The researchers also found that the attackers modified the appliance’s nginx configuration to expose the ORANGETAIL webshell remotely and installed ROOTRUN, a privilege-escalation tool that allows commands to be executed as root.
Volexity says that while the campaign and malware showed “significant” technical sophistication, the threat actor was less successful at spreading into victims’ internal networks.
Security teams log 54% of successful attacks and alert on just 14%. The rest move through your environment unseen.
The Picus whitepaper shows how breach and attack simulation tests your SIEM and EDR rules so threats stop slipping by detection.
Get the whitepaper
