Volexity investigated the compromise of SonicWall Secure Mobile Access (SMA) VPN appliances by UTA0533, which chained multiple zero-day exploits to gain root access, deploy KNUCKLEBALL, ROOTRUN, Suo5, and ORANGETAIL, and pivot inside victim networks. The intrusion leveraged CVE-2026-15409 and CVE-2026-15410, exposed localhost-only services through /wsproxy, and used captured LDAP traffic and modified nginx routes to support post-exploitation activity. #SonicWall #SMA #UTA0533 #KNUCKLEBALL #ORANGETAIL #Suo5 #ROOTRUN #CVE-2026-15409 #CVE-2026-15410
Keypoints
- Volexity found that UTA0533 compromised SonicWall SMA 1000 series appliances using a chain of zero-day vulnerabilities.
- The earliest observed compromise date was June 22, 2026, with suspicious authentication and lateral movement later detected from the appliances.
- CVE-2026-15409 enabled a pre-authentication /wsproxy bypass that exposed localhost-only services such as CouchDB and the SMA control service.
- CVE-2026-15410 allowed path traversal and execution through sysCtrl.execRemoveHotfix, ultimately enabling root command execution.
- The attacker deployed KNUCKLEBALL, which injected the Suo5 proxy and ORANGETAIL webshell into a legitimate SonicWall process.
- Persistence was established by modifying startup files and nginx routes, while additional activity included sniffing LDAP traffic with tcpdump and attempting lateral movement.
- Volexity identified multiple IOCs, including modified configuration files, dropped scripts, setuid binaries, and attacker source IP addresses.
MITRE Techniques
- [T1190 ] Exploit Public-Facing Application – The threat actor used zero-day flaws in SonicWall SMA appliances to gain entry and reach internal services (‘chained multiple zero-day exploits in the devices’).
- [T1134.002 ] Access Token and Impersonation – The attacker abused appliance services and privilege contexts to operate as root after execution (‘execute arbitrary commands as root’).
- [T1059.004 ] Command and Scripting Interpreter: Unix Shell – A staged shell script was executed to perform privileged actions and launch tools (‘/tmp/1234.sh’ and ‘executed the staged file’).
- [T1055 ] Process Injection – KNUCKLEBALL injected embedded JAR payloads into a legitimate SonicWall process (‘injected into a legitimate SonicWall process’).
- [T1105 ] Ingress Tool Transfer – The attacker placed scripts and payloads on the appliance for later execution (‘a file was written to /usr/bin/xzfind’ and ‘deploy_new.py’).
- [T1021 ] Remote Services – The attacker used appliance access and web shells to interact with internal services and pivot further (‘use both Suo5 and ORANGETAIL’ and ‘attempting to pivot further into the customer network’).
- [T1090.001 ] Proxy: Internal Proxy – Suo5 was used as an HTTP forwarding proxy to relay traffic through the appliance (‘open-source HTTP proxy-forwarding tool Suo5’).
- [T1106 ] Native API – The malware used the Java Attach API to inject agents into a JVM (‘uses the Java Attach API … to inject the dropped agent files’).
- [T1005 ] Data from Local System – The attacker read local system files such as the hardware UUID to support exploitation (‘read /sys/class/dmi/id/product_uuid file’).
- [T1041 ] Exfiltration Over C2 Channel – ORANGETAIL and related tooling used encrypted POST-based exchanges to send and receive data (‘The data is decrypted and dynamically loaded’ and responses are encrypted and encoded).
- [T1040 ] Network Sniffing – The attacker captured unencrypted LDAP traffic using tcpdump (‘use tcpdump to capture unencrypted LDAP traffic’).
- [T1070.004 ] File Deletion – The implant deleted temporary JAR files after use (‘After injection, both JAR files are deleted’).
- [T1543.002 ] Create or Modify System Process: Systemd Service – Persistence was established by adding Python execution to the workplace startup script (‘added to the legitimate /etc/init.d/workplace startup script’).
- [T1027 ] Obfuscated Files or Information – ORANGETAIL and related payloads used encrypted and encoded data, plus string construction techniques (‘AES-128-ECB-encrypted’ and ‘built char-by-char’).
Indicators of Compromise
- [IP addresses ] Attacker source addresses observed during exploitation and webshell access – 108.205.8.173, 147.45.51.19, and other 6 IPs
- [Hostnames ] Threat actor hostnames leaked during lateral movement – DESKTOP-5P0TSCP, KALI, and 2 more hostnames
- [File paths ] Dropped files, modified configs, and temporary artifacts – /usr/bin/xzfind, /usr/lib/python3.11/site-packages/deploy_new.py, and other paths such as /var/lib/unit/conf.json
- [File names ] Malicious or suspicious scripts and payloads – 1234.sh, lib.sh, txt
- [Hashes ] Identified malware sample hashes for ROOTRUN, KNUCKLEBALL, and the JAR payloads – MD5 5cb00bbfe818ee3e85fb99ab1db1af7c, SHA256 8c470301dcb7278f73e622f1950073567b34011c64b60cdfbb0f89803923a5a3, and 3 more hashes
- [URIs ] Suspicious web paths used for access and rewriting – /wsproxy, /__api__/login, /__api__/logout
- [User-Agent string ] Gating string required to access the implants – Mozilla/6.0 (Windows NT 11.0; Win64; x64) AppleWebKit/1537.136 (KHTML, like Gecko) Chrome/149.0.0.1 Safari/1537.136
- [Ports ] Internal services exposed through /wsproxy – 1050, 8188, and 1051