SonicWall SMA1000 Appliances Server-Side Request Forgery Vulnerability Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security…
SonicWall SMA1000 Appliances OS Command Injection Vulnerability Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security…
INC Ransomware has emerged as the dominant threat actor exploiting recently disclosed vulnerabilities in SonicWall Secure Mobile Access (SMA) 1000 series VPN…
UTA0533 is a threat cluster tracked by Volexity that exploited SonicWall SMA 1000 vulnerabilities starting June 22, 2026, before patches were available.…
KNUCKLEBALL is a Python script deployed by threat actors to launch Suo5, an open-source HTTP proxy, and a Behinder-like web shell named…
Suo5 is an open-source HTTP proxy tool used by attackers to establish covert communication channels after exploiting SonicWall SMA 1000 vulnerabilities. It…
ORANGETAIL is a Behinder-like custom Java web shell used by threat actors to maintain persistent access on compromised SonicWall SMA 1000 appliances.…
An ELF executable written by UTA0533 to allow unprivileged users to execute commands as root on SonicWall SMA appliances.
Secure Mobile Access VPN appliances targeted by UTA0533 using zero-day vulnerabilities CVE-2026-15409 and CVE-2026-15410.
A previously undocumented threat actor, tracked as UTA0533 by Volexity, exploited two zero-day vulnerabilities in SonicWall Secure Mobile Access (SMA) 1000 series…