⌁ CyberSecurityBoardThreat Intel · CVEs · Products
Malware

Suo5: Open-Source HTTP Proxy Used in Post-Exploitation

July 19, 2026

Suo5 is an open-source HTTP proxy tool used by attackers to establish covert communication channels after exploiting SonicWall SMA 1000 vulnerabilities. It is often launched via the KNUCKLEBALL script.

Discovered from: INC Ransomware Exploits SonicWall SMA 1000 Zero-Days in Widespread Attacks