SonicWall SMA1000: Forensics in a Three-Week Zero-Day Window
30.07.2026 edge-device-forensicszero-dayvpn-applianceincident-response
On July 14, 2026, SonicWall disclosed two vulnerabilities affecting its SMA 1000 series remote access appliances – CVE-2026-15409, a critical SSRF flaw (CVSS 10.0), and CVE-2026-15410, a high-severity command injection bug (CVSS 7.2). What looked like just another advisory turned out to be a full-blown forensic emergency: incident response firm Volexity had already been called in earlier that month after discovering a threat actor had successfully compromised SonicWall Secure Mobile Access (SMA) VPN appliances through a chain of multiple zero-day exploits in the devices. The group, tracked as UTA0533, had been active for weeks before public disclosure — the intrusions began as early as June 22, 2026, well before the flaws became public.
Reconstructing the Attack Chain
The real value of Volexity’s analysis lies in how precisely the full path from unauthenticated access to root was reconstructed. The attackers first exploited CVE-2026-15409 to abuse the SMA1000’s ‘/wsproxy’ endpoint, allowing them to establish unauthenticated WebSocket tunnels to services that should only have been accessible from the appliance itself. This exposed internal applications, including CouchDB and the VPN device’s management service. From there, the attacker staged a file in /tmp via CouchDB access to read a hardware identifier — that UUID is the basis for the Basic authentication password protecting the SMA’s internal ctrl-service, and the file is world-readable, so anyone who can reach the filesystem can derive the password. Only then did CVE-2026-15410 come into play: a path traversal flaw in the ctrl-service’s remove_hotfix workflow allows command execution with elevated privileges.
With root access secured, the attackers deployed custom tooling. On one compromised appliance, UTA0533 installed a setuid root execution tool named xzfind, internally referred to as ROOTRUN, and a Python-based implant called KNUCKLEBALL, saved as deploy_new.py. This malware injected Java payloads into a legitimate SonicWall process and achieved persistence by modifying a startup script. The injected payloads included Suo5, an HTTP proxy-forwarding tool, and ORANGETAIL, a custom Java webshell resembling Behinder. Additionally, the attackers altered the NGINX Unit configuration to redirect requests from /api/login and /api/logout to the hidden implants.
Why Logs Alone Don’t Tell the Whole Story
A key methodological takeaway from Volexity’s report concerns the limits of log-only analysis: Volexity initially worked with logs exported from the SonicWall SMA VPN appliances, which provided the full basis for investigating the intrusion — but using logs alone, without a confirmed system-level compromise or accounting of on-system activity, can make it difficult to connect all of the dots or prove what happened. Only memory forensics completed the picture: initial triage quickly confirmed both devices had been compromised, while memory analysis with Volexity Volcano uncovered additional evidence of the attackers’ activity.
One particularly telling forensic detail concerns persistence stability across reboots: compromise artifacts recovered from a second affected appliance showed fewer traces after a reboot on July 2, 2026, suggesting the attackers’ persistence mechanisms did not fully survive a restart on every target — meaning a clean-looking appliance today does not rule out compromise three weeks ago, especially if it has been rebooted since.
For defenders, this translates into concrete artifacts to hunt for: requests to /api/login or /api/logout with HTTP 200 status in extraweb_access.log, requests to /wsproxy with suspicious host parameters returning HTTP 101, hotfix rollbacks with path traversal names in ctrl-service.log, and unexpected login/logout routes planted in /var/lib/unit/conf.json. If any of these indicators surface, the vendor’s own guidance goes beyond patching: re-imaging physical appliances or redeploying virtual appliances if compromise is identified, followed by a full credential and TOTP token reset.
The campaign illustrates why edge appliances remain the preferred entry point for sophisticated actors: they sit at the boundary between internet and internal network, handle credentials in bulk, and run on opaque, vendor-specific operating systems where standard forensic tooling barely gets traction. Anyone running SMA1000 should not just patch — they should actively hunt for the artifacts described above, and assume the worst on any hit.
← Back to overview