14 mincritical
Proxying to Compromise: SonicWall Secure Mobile Access 0-day Exploitation
Volexity discovered threat actor UTA0533 exploiting two zero-day vulnerabilities in SonicWall SMA 1000 series VPN appliances to achieve root-level remote code execution. CVE-2026-15409 enables pre-auth SSRF via /wsproxy to tunnel to localhost services, while CVE-2026-15410 enables command injection via path traversal in the sysCtrl.execRemoveHotfix endpoint. The actor deployed custom malware including KNUCKLEBALL (Java agent injector), ORANGETAIL (webshell), and ROOTRUN (privilege escalation binary), then used tcpdump to capture LDAP credentials and attempted lateral movement from over 200 IP addresses.
Sens:■ Immediate
Showing defanged values
- ip108[.]205[.]8[.]173Non-VPN source IP used by UTA0533 for exploitation and webshell access against SonicWall SMA appliances
- ip147[.]45[.]51[.]19Non-VPN source IP used by UTA0533 for exploitation and webshell access against SonicWall SMA appliances
- ip150[.]241[.]210[.]53Non-VPN source IP used by UTA0533 for exploitation and webshell access against SonicWall SMA appliances
- ip202[.]8[.]105[.]201Non-VPN source IP used by UTA0533 for exploitation and webshell access against SonicWall SMA appliances
- ip217[.]77[.]15[.]99Non-VPN source IP used by UTA0533 for exploitation and webshell access against SonicWall SMA appliances
- ip42[.]200[.]172[.]14Non-VPN source IP used by UTA0533 for exploitation
- ip81[.]19[.]140[.]217Non-VPN source IP used by UTA0533 for exploitation
- ip89[.]117[.]20[.]1Non-VPN source IP used by UTA0533 for exploitation and webshell access against SonicWall SMA appliances
- md554d21399b8b52b48a0fef68450593e45MD5 of agent_wp8.jar (Suo5)
- md55cb00bbfe818ee3e85fb99ab1db1af7cMD5 of ROOTRUN/xzfind setuid binary
- md55f3a55201c511c9ff9be4c16c41028a2MD5 of agent_wp9.jar (ORANGETAIL)
- md5b6df166291f80ee89032d769c99714f3MD5 of KNUCKLEBALL/deploy_new.py
- sha104d4a9fbb32e967200eb98be014ca914a03bfa6bSHA1 of ROOTRUN/xzfind setuid binary
- sha15e5b716f2385c818ec61198be1a2a07a4560eac5SHA1 of agent_wp9.jar (ORANGETAIL)
- sha1b4ee1f50fbb49f0ff5fde3d026343bc23ee08d51SHA1 of KNUCKLEBALL/deploy_new.py
- sha1c2b0ae0a1f42a139abe4dd612676066ec1426394SHA1 of agent_wp8.jar (Suo5)
- sha2561e1e68bbb899450a57274a8b12082ed4e2040a2aae77014f20431689d2b4edeeSHA256 of agent_wp8.jar - Suo5 HTTP proxy-forwarding tool injected as Java agent into com/aventail/jsp/workplace/error_jsp class
- sha25681a9af3846bad3a1107164ff7cf0a08e020b31a3b32fd17866e17d4c1565f7f2SHA256 of ROOTRUN/xzfind - setuid ELF binary dropped to /usr/bin/xzfind for privilege escalation to root
- sha2568c470301dcb7278f73e622f1950073567b34011c64b60cdfbb0f89803923a5a3SHA256 of KNUCKLEBALL/deploy_new.py - Python script that injects Suo5 and ORANGETAIL Java agents into the workplace process and modifies nginx config for persistence
- sha256ea9154e374e4f77bc2cf54282e23543573980342a85bc888cb23f20b8bbba081SHA256 of agent_wp9.jar - ORANGETAIL webshell injected as Java agent into com/aventail/jsp/workplace/dialogs/errorDialog_jsp class
Detection / Hunteropenrouter
What Happened
A sophisticated hacker group called UTA0533 found and exploited previously unknown security flaws in SonicWall's Secure Mobile Access (SMA) VPN devices, which are used by organizations to let employees securely connect to internal networks from remote locations. The attackers used two separate vulnerabilities together: one to bypass authentication and reach internal services on the device, and another to run malicious code with full administrative privileges. Once inside, they installed hidden backdoor programs that let them control the device remotely, intercepted network traffic to steal usernames and passwords, and attempted to move deeper into the victim's network. Organizations using affected SonicWall SMA 1000 series devices (models 6210, 7210, or 8200v) should immediately update to the latest firmware versions (12.4.3-03453 or 12.5.0-02835) and check their devices for signs of compromise described in the report.
Key Takeaways
- Threat actor UTA0533 chained two zero-day vulnerabilities (CVE-2026-15409 SSRF and CVE-2026-15410 command injection) to achieve root-level remote code execution on SonicWall SMA 1000 series VPN appliances.
- KNUCKLEBALL malware (deploy_new.py) injects two Java agents into the legitimate workplace process: Suo5 HTTP proxy and ORANGETAIL webshell, both gated behind a fake user-agent string.
- Persistence was established via a setuid binary (ROOTRUN/xzfind) and modification of the /etc/init.d/workplace startup script to launch KNUCKLEBALL on boot.
- UTA0533 used tcpdump to capture unencrypted LDAP traffic from compromised appliances for credential harvesting, and attempted lateral movement using over 200 source IP addresses including VPN exit nodes.
- Patches are available in SonicWall SMA versions 12.4.3-03453 and 12.5.0-02835; organizations running unpatched 1000 series appliances (models 6210, 7210, 8200v) should treat this as critical.
Affected Systems
- SonicWall SMA 1000 series model 6210
- SonicWall SMA 1000 series model 7210
- SonicWall SMA 1000 series model 8200v
- SonicWall SMA firmware versions prior to 12.4.3-03453 and 12.5.0-02835
Vulnerabilities (CVEs)
copy:
| CVE | Product | Severity | Description |
|---|---|---|---|
| CVE-2026-15409 | SonicWall SMA 1000 series appliances | Critical | Pre-authentication SSRF via /wsproxy bypass allows unauthenticated external requests to establish WebSocket tunnels to localhost-only services on the appliance using a crafted bmID parameter. |
| CVE-2026-15410 | SonicWall SMA 1000 series appliances | Critical | Command injection and path traversal via sysCtrl.execRemoveHotfix allows execution of arbitrary scripts as root through insufficient input validation in the hotfix rollback path. |
Attack Chain
- Initial Access: Unauthenticated SSRF via /wsproxy bypass (CVE-2026-15409) using User-Agent 'SMA Connect Agent' and bmID parameter starting with '-3389' to establish WebSocket tunnel to localhost services
- Exploitation: WebSocket tunnel to CouchDB on port 1050 using hardcoded credentials (admin:admin) to read/write files as couchdb user
- Privilege Escalation: Staged script (/tmp/1234.sh) reads /sys/class/dmi/id/product_uuid, then path traversal via sysCtrl.execRemoveHotfix (CVE-2026-15410) executes the script as root
- Persistence: ROOTRUN (xzfind) setuid binary dropped to /usr/bin/xzfind; KNUCKLEBALL (deploy_new.py) added to /etc/init.d/workplace startup script
- C2/Backdoor: KNUCKLEBALL injects Suo5 proxy and ORANGETAIL webshell as Java agents into workplace process; nginx config modified to route /api/login and /api/logout to implants at 127.0.0.1:8085
- Credential Access: tcpdump deployed to capture unencrypted LDAP traffic (TCP 389) for credential harvesting; lateral movement attempted from compromised appliance
Detection Availability
- YARA Rules: Yes
- Sigma Rules: No
- Snort/Suricata Rules: No
- KQL Queries: No
- Splunk SPL Queries: No
- EQL Queries: No
- Other Detection Logic: No
- Platforms: Volexity GitHub repository
Volexity has released YARA signatures to detect the KNUCKLEBALL, ORANGETAIL, ROOTRUN, and Suo5 malware families described in the blog. These are available on Volexity's GitHub repository linked in the article.
Detection Engineering Assessment
copy:
| Dimension | Rating | Rationale |
|---|---|---|
| EDR Visibility | Low | SonicWall SMA appliances are network appliances running a Linux-based OS; traditional EDR agents are typically not installed. Detection relies on appliance logs, SSH-based forensic collection, and network-level monitoring rather than endpoint telemetry. |
| Network Visibility | High | The attack involves external web requests to /wsproxy, WebSocket tunnels, connections to localhost services, and lateral movement attempts from the appliance. Network monitoring, web proxy logs, and the appliance's own access logs (extraweb_access.log, access_servers.log, ctrl-service.log) provide strong visibility. |
| Detection Difficulty | Moderate | The log indicators are well-documented and distinctive (bmID=-3389 prefix, /api/login and /api/logout paths, specific user-agent strings). However, organizations must actively collect and monitor appliance logs, which is not always standard practice. Memory-resident Java agents are difficult to detect without memory forensics. |
Required Log Sources
- SonicWall SMA extraweb_access.log
- SonicWall SMA access_servers.log
- SonicWall SMA ctrl-service.log
- Network firewall logs for lateral movement from SMA appliance
- Web proxy logs for /wsproxy and /api/login|logout requests
- LDAP server logs for unexpected queries from SMA appliance IP
Hunting Hypotheses
copy:
| Hypothesis | Telemetry | ATT&CK Stage | FP Risk |
|---|---|---|---|
| Consider hunting for HTTP requests to /wsproxy with a bmID parameter value starting with '-3389' and a User-Agent of 'SMA Connect Agent' in web proxy or SonicWall SMA access logs, as this indicates exploitation of CVE-2026-15409. | SonicWall SMA extraweb_access.log, web proxy logs, WAF logs | Initial Access | Low - the bmID=-3389 prefix and specific User-Agent combination is highly specific to the exploit; legitimate SMA Connect Agent usage would not use this bmID format. |
| Consider hunting for POST requests to /api/login or /api/logout on SonicWall SMA appliances with large response sizes (200KB+), as these indicate ORANGETAIL webshell activity proxied through nginx. | SonicWall SMA extraweb_access.log, web proxy logs | Command and Control | Low - while /api/ paths may exist legitimately, response sizes exceeding 200KB for login/logout endpoints are highly anomalous. |
| Consider hunting for the user-agent string containing 'Chrome/149.0.0.1' or 'Windows NT 11.0' across all web logs, as these version numbers do not exist in any legitimate browser release and are used by UTA0533 to gate access to implants. | Web proxy logs, WAF logs, any HTTP-accessible service logs | Command and Control | Very Low - Chrome 149 and Windows NT 11.0 do not exist as of the article date. |
| Consider hunting for unexpected outbound connections or lateral movement attempts originating from SonicWall SMA appliance IP addresses, particularly connections to internal LDAP servers on TCP 389 or authentication attempts to other internal systems. | Network firewall logs, internal IDS/IPS, LDAP server logs, authentication logs | Credential Access / Lateral Movement | Medium - SMA appliances may legitimately authenticate users and connect to internal services; focus on unusual destinations, ports, or volume. |
| Consider hunting for modifications to the NGINX Unit configuration file on SonicWall SMA appliances, specifically routes proxying to http://127.0.0.1:8085, which indicates KNUCKLEBALL has modified the configuration for webshell access. | File integrity monitoring on /var/lib/unit/conf.json, SSH-based configuration audits | Persistence | Low - proxying to 127.0.0.1:8085 is not a standard SonicWall SMA configuration. |
Control Gaps
- Traditional EDR solutions would not detect this activity as SonicWall SMA appliances typically do not support endpoint agents
- Network-based IDS may miss the WebSocket tunnel traffic if it appears as legitimate SMA VPN traffic
- Memory-resident Java agents injected via the Java Attach API would not be detected by file-based scanning after the temporary JAR files are deleted
- The use of hardcoded CouchDB credentials (admin:admin) on the appliance represents a pre-existing weakness that may not be flagged by vulnerability scanners
- The fake user-agent string resembles a legitimate browser string closely enough that WAF rules based on user-agent validation alone may not flag it
Key Behavioral Indicators
- HTTP requests to /wsproxy with bmID parameter starting with '-3389' and User-Agent 'SMA Connect Agent'
- HTTP 101 status codes (protocol upgrade to WebSocket) in response to /wsproxy requests from external IPs
- POST requests to /api/login or /api/logout with abnormally large response bodies (200KB+)
- User-agent string containing 'Chrome/149.0.0.1' or 'Windows NT 11.0' (non-existent versions)
- ctrl-service.log entries referencing 'remove_hotfix' with path traversal sequences (../../../../../tmp/)
- Unexpected setuid binaries on the appliance filesystem (run 'find / -perm -4000' and compare against known-good list)
- Modifications to /etc/init.d/workplace startup script
- Unexpected files in /tmp or /var/tmp owned by the couchdb user
- tcpdump process running on the SMA appliance
- NGINX Unit configuration containing routes to http://127.0.0.1:8085
False Positive Assessment
Low - The indicators described are highly specific to the attack chain, including the bmID=-3389 prefix, fake user-agent string with non-existent version numbers, /api/login and /api/logout paths with large response bodies, and path traversal in remove_hotfix log entries. The setuid binary and nginx configuration modifications are also unlikely to occur in normal appliance operation.
Recommendations
Immediate Mitigation
defender takeaway
- Verify against your organization's incident response runbook and team escalation paths before acting. If you operate SonicWall SMA 1000 series appliances (models 6210, 7210, 8200v), consider immediately applying the hotfix or upgrading to firmware version 12.4.3-03453 or 12.5.0-02835.
- Consider reviewing SonicWall SMA appliance logs (extraweb_access.log, access_servers.log, ctrl-service.log) for indicators of compromise including /wsproxy requests with bmID=-3389, /api/login or /api/logout access, and remove_hotfix path traversal entries.
- If compromise is suspected, consider collecting a full disk image and memory sample from the appliance for forensic analysis, as file-based indicators alone may not capture memory-resident Java agents.
- Consider checking for unexpected setuid binaries by running 'find / -perm -4000' on the appliance and comparing results against the known-good list provided in the article.
- If your EDR or network monitoring supports it, consider blocking the non-VPN source IP addresses listed in the article and monitoring for connections from VPN exit nodes (ExpressVPN, MullvadVPN) to SMA appliances.
Infrastructure Hardening
- Consider implementing network segmentation to restrict what internal services SonicWall SMA appliances can reach, particularly LDAP servers on TCP 389 and other authentication infrastructure.
- Evaluate whether internal LDAP traffic should be encrypted (LDAPS on TCP 636) to prevent credential capture via network sniffing on compromised appliances.
- Consider deploying file integrity monitoring (FIM) on critical SonicWall SMA configuration files including /var/lib/unit/conf.json, /etc/init.d/workplace, and /usr/lib/python3.11/site-packages/.
- If supported by your network architecture, consider placing SonicWall SMA appliances behind a reverse proxy or WAF that can inspect and filter /wsproxy requests and detect anomalous WebSocket upgrades.
- Consider implementing egress filtering on SonicWall SMA appliances to prevent unauthorized outbound connections, particularly tcpdump and other packet capture utilities.
User Protection
- Consider enforcing MFA for all VPN connections through the SonicWall SMA appliance to reduce the impact of credential theft via LDAP sniffing.
- If applicable, evaluate whether VPN session monitoring can detect anomalous session behavior originating from the appliance itself rather than legitimate VPN users.
- Consider rotating credentials for any accounts that may have authenticated through the compromised SMA appliance, particularly service accounts and directory administrator credentials.
Security Awareness
- Consider briefing network and security operations teams on the indicators of compromise described in this report, particularly the log patterns in extraweb_access.log and ctrl-service.log.
- If your organization uses SonicWall SMA appliances, consider incorporating appliance log review into existing monitoring workflows and runbooks.
- Consider educating IT staff on the importance of applying firmware updates to network appliances promptly, as threat actors actively target newly disclosed vulnerabilities in VPN appliances.
MITRE ATT&CK Mapping
MITRE ATT&CK Mapping10 techniques
Tactic
Initial Access
Tactic
Execution
Tactic
Persistence
Tactic
Privilege Escalation
Tactic
Credential Access
Tactic
Command and Control
Additional IOCs
- Ips:
42[.]200[.]172[.]14- Non-VPN source IP used by UTA0533 for exploitation81[.]19[.]140[.]217- Non-VPN source IP used by UTA0533 for exploitation
- Urls:
/wsproxy?bmID=-3389- SSRF exploit URI path used to establish WebSocket tunnel to localhost services via CVE-2026-15409/__api__/login- Rewritten nginx route proxying to ORANGETAIL webshell at /workplace/error.jsp via http://127.0.0.1:8085/__api__/logout- Rewritten nginx route proxying to ORANGETAIL webshell at /workplace/dialogs/errorDialog.jsp via http://127.0.0.1:8085
- File Hashes:
5cb00bbfe818ee3e85fb99ab1db1af7c(MD5) - MD5 of ROOTRUN/xzfind setuid binary04d4a9fbb32e967200eb98be014ca914a03bfa6b(SHA1) - SHA1 of ROOTRUN/xzfind setuid binaryb6df166291f80ee89032d769c99714f3(MD5) - MD5 of KNUCKLEBALL/deploy_new.pyb4ee1f50fbb49f0ff5fde3d026343bc23ee08d51(SHA1) - SHA1 of KNUCKLEBALL/deploy_new.py54d21399b8b52b48a0fef68450593e45(MD5) - MD5 of agent_wp8.jar (Suo5)c2b0ae0a1f42a139abe4dd612676066ec1426394(SHA1) - SHA1 of agent_wp8.jar (Suo5)5f3a55201c511c9ff9be4c16c41028a2(MD5) - MD5 of agent_wp9.jar (ORANGETAIL)5e5b716f2385c818ec61198be1a2a07a4560eac5(SHA1) - SHA1 of agent_wp9.jar (ORANGETAIL)
- File Paths:
/usr/bin/xzfind- Path where ROOTRUN setuid binary was dropped for privilege escalation/usr/lib/python3.11/site-packages/deploy_new.py- Path where KNUCKLEBALL malware script was written for persistence and Java agent injection/tmp/1234.sh- Script staged by CouchDB user to read product_uuid, executed via path traversal in CVE-2026-15410/tmp/hypdate.b64- Base64-encoded local privilege escalation exploit (CVE-2026-15410) found on disk/tmp/agent_wp8.jar- Temporary path for Suo5 JAR during Java agent injection process, deleted after injection/tmp/agent_wp9.jar- Temporary path for ORANGETAIL JAR during Java agent injection process, deleted after injection/var/lib/unit/conf.json- NGINX Unit configuration modified to add routes proxying /api/login and /api/logout to webshell endpoints/var/tmp/lib.sh- Script to launch tcpdump for capturing unencrypted LDAP traffic on compromised appliance/etc/init.d/workplace- Legitimate startup script modified to add persistence line launching KNUCKLEBALL on boot
- Command Lines:
- Purpose: Network traffic capture for credential harvesting via unencrypted LDAP sniffing | Tools:
tcpdump,nohup| Stage: Credential Access |nohup tcpdump -i any '<ldap filter>' -w /var/tmp/<file> -C 100 -W 10 & - Purpose: Privilege escalation binary execution of arbitrary commands as root | Tools:
xzfind,bash| Stage: Privilege Escalation |xzfind rootrun <command> - Purpose: Java agent injection into workplace process via Java Attach API | Tools:
python3,Java Attach API| Stage: Persistence |load instrument false <path> - Purpose: Detection of unauthorized setuid binaries on SonicWall SMA appliance | Tools:
find| Stage: Detection |find / -perm -4000
- Purpose: Network traffic capture for credential harvesting via unencrypted LDAP sniffing | Tools:
- Other:
Mozilla/6.0 (Windows NT 11.0; Win64; x64) AppleWebKit/1537.136 (KHTML, like Gecko) Chrome/149.0.0.1 Safari/1537.136- Fake user-agent string required to access Suo5 and ORANGETAIL implants; uses non-existent version numbers (Chrome 149, NT 11.0)DESKTOP-5P0TSCP- Threat actor hostname leaked during lateral movement activityDESKTOP-IC3C80F- Threat actor hostname leaked during lateral movement activityDESKTOP-KRLUI3J- Threat actor hostname leaked during lateral movement activityKALI- Threat actor hostname leaked during lateral movement activity, suggests use of Kali LinuxSMA Connect Agent- User-Agent string required for CVE-2026-15409 /wsproxy SSRF bypass
Related
Stay currentSubscribe via RSS