SonicWall SMA Zero-Days Exploited by UTA0533 for Root Access Before Patch
An unattributed threat actor tracked as UTA0533 exploited two previously unknown vulnerabilities in SonicWall Secure Mobile Access (SMA) 1000-series VPN appliances as zero-days beginning June 22, 2026, gaining root-level control over affected devices weeks before public disclosure. Researchers Sean Koessel and Steven Adair at Volexity uncovered the campaign during an incident response engagement earlier this month at an unnamed organization, finding that the attacker deployed custom malware engineered specifically for the SonicWall appliance architecture. The flaws, CVE-2026-15409 (CVSS 10.0) and CVE-2026-15410 (CVSS 7.2), can be chained to achieve arbitrary command execution and full device takeover. SonicWall issued patches this week; administrators should prioritize deploying them immediately and verify appliance integrity using a port scanner to confirm no unauthorized listeners are exposed.
On the first compromised appliance, UTA0533 wrote a setuid ELF binary named "/usr/bin/xzfind" (dubbed ROOTRUN) that allows unprivileged users to execute arbitrary commands as root, alongside a Python loader script "deploy_new.py" (KNUCKLEBALL) that injects two embedded JAR archives into a legitimate SonicWall process. Those archives contain Suo5, an open-source HTTP proxy, and ORANGETAIL, a Behinder-derived Java web shell reachable via "/workplace/error.jsp" and "/workplace/dialogs/errorDialog.jsp". Persistence was established by tampering with "/etc/init.d/workplace" and the NGINX Unit configuration at "/var/lib/unit/conf.json" to expose the malicious routes externally. Defenders reviewing similar appliances should audit their SSL/TLS configuration and inspect NGINX Unit route definitions for unauthorized additions.
The second appliance showed a narrower footprint: the same NGINX Unit modifications, plus a "lib.sh" script in "/var/tmp" that launches tcpdump to capture unencrypted LDAP traffic for credential harvesting. A reboot on July 2, 2026 erased most memory-resident artifacts, complicating forensics. Volexity also recovered "/tmp/hypdate.b64" from the first appliance, a base64-encoded exploit for CVE-2026-15410 owned by the database service account, illustrating how the attacker chained the two bugs to escalate from limited service rights to root. The targeting of LDAP credentials underscores the value of encrypting internal directory traffic and rotating potentially exposed passwords through a breach exposure check to identify compromised accounts before follow-on lateral movement.
UTA0533's tradecraft—purpose-built malware, patient pre-disclosure dwell time, and abuse of trusted management interfaces—aligns with state-sponsored APT behavior rather than opportunistic cybercrime. Organizations running SMA 1000-series appliances should treat any unpatched device as actively compromised: hunt for the IOCs above, review firewall and VPN logs for anomalous workplace URI requests, and confirm externally exposed interfaces match SonicWall hardening guidance until patches are fully deployed across the fleet.