INC Ransomware Exploits SonicWall SMA 1000 Zero-Days in Widespread Attacks
INC Ransomware has emerged as the dominant threat actor exploiting recently disclosed vulnerabilities in SonicWall Secure Mobile Access (SMA) 1000 series VPN…
Tag: SonicWall
UTA0533: Threat Cluster Behind Pre-Disclosure Exploitation of SonicWall Flaws
UTA0533 is a threat cluster tracked by Volexity that exploited SonicWall SMA 1000 vulnerabilities starting June 22, 2026, before patches were available.…
KNUCKLEBALL: Python Script Used in SonicWall Exploitation
KNUCKLEBALL is a Python script deployed by threat actors to launch Suo5, an open-source HTTP proxy, and a Behinder-like web shell named…
Suo5: Open-Source HTTP Proxy Used in Post-Exploitation
Suo5 is an open-source HTTP proxy tool used by attackers to establish covert communication channels after exploiting SonicWall SMA 1000 vulnerabilities. It…
ORANGETAIL: Custom Java Web Shell Deployed in SonicWall Attacks
ORANGETAIL is a Behinder-like custom Java web shell used by threat actors to maintain persistent access on compromised SonicWall SMA 1000 appliances.…
ROOTRUN: Setuid Binary for Privilege Escalation
An ELF executable written by UTA0533 to allow unprivileged users to execute commands as root on SonicWall SMA appliances.
SonicWall SMA 1000 Series VPN Appliances
Secure Mobile Access VPN appliances targeted by UTA0533 using zero-day vulnerabilities CVE-2026-15409 and CVE-2026-15410.
SonicWall SMA Zero-Days Exploited Before Disclosure to Gain Root Access
A previously undocumented threat actor, tracked as UTA0533 by Volexity, exploited two zero-day vulnerabilities in SonicWall Secure Mobile Access (SMA) 1000 series…
Two SonicWall SMA 1000 Zero-Days Exploited, One Could Enable Admin Commands
SonicWall has warned of active exploitation of two zero-day vulnerabilities impacting Secure Mobile Access (SMA) 1000 series appliances, one of which could…
SonicWall: Vendor of SMA 1000 Appliances Affected by Critical Flaws
SonicWall is a cybersecurity company that produces the SMA 1000 series VPN appliances. It released patches for CVE-2026-15409 and CVE-2026-15410 in mid-July…