UTA0533 Weaponizes KNUCKLEBALL: Inside the SonicWall SMA Zero-Day Exploitation Chain
Summary
A previously undocumented threat actor tracked by Volexity as UTA0533 chained two zero-day vulnerabilities — CVE-2026-15409 (CVSS 10.0, unauthenticated SSRF) and CVE-2026-15410 (CVSS 7.2, path-traversal privilege escalation) — to gain root-level access on internet-facing SonicWall Secure Mobile Access (SMA) 1000 series VPN appliances, weeks before SonicWall publicly disclosed and patched the flaws. The actor deployed a custom Python-based malware loader dubbed KNUCKLEBALL to inject two Java payloads — the open-source Suo5 proxy and a Behinder-like web shell named ORANGETAIL — directly into a legitimate SonicWall process, then established reboot-persistent backdoor access and captured unencrypted LDAP credentials from the compromised network.
Background
On July 14, 2026, SonicWall published an advisory disclosing two vulnerabilities in its SMA1000 series secure remote access appliances: a maximum-severity server-side request forgery (SSRF) flaw and a high-severity post-authentication code injection bug. What made the disclosure especially urgent was SonicWall's own admission that it had "investigated multiple cases indicating active exploitation" of both vulnerabilities in the wild.
Days later, incident response firm Volexity published findings that pushed the timeline back significantly further than anyone expected. Volexity's investigation into a compromised customer environment revealed that a threat actor it now tracks as UTA0533 had been exploiting these same flaws as true zero-days since at least June 22, 2026 — roughly three weeks before SonicWall's patches existed. Rapid7's Managed Detection and Response team separately and independently confirmed active, targeted exploitation of internet-facing SMA1000 appliances prior to the public advisory, reinforcing that this was a coordinated pre-disclosure exploitation campaign rather than isolated opportunistic scanning.
Vulnerability Details
| CVE ID | CVSS Score | EPSS Score | Affected Products | Vulnerability Type | Fixed Version |
|---|---|---|---|---|---|
| CVE-2026-15409 | 10.0 (Critical) | 1.27% | SonicWall SMA1000 Series (6210, 7210, 8200v) — 12.4.3-03245/03387/03434 and 12.5.0-02283/02624/02800 | Server-Side Request Forgery (CWE-918) | 12.4.3-03453 (platform-hotfix) or later; 12.5.0-02835 (platform-hotfix) or later |
| CVE-2026-15410 | 7.2 (High) | 1.49% | SonicWall SMA1000 Series (6210, 7210, 8200v) — 12.4.3-03245/03387/03434 and 12.5.0-02283/02624/02800 | Path-Traversal Code Injection (CWE-94) | 12.4.3-03453 (platform-hotfix) or later; 12.5.0-02835 (platform-hotfix) or later |
Attack Methodology
Phase 1: Initial Access — Unauthenticated SSRF via /wsproxy
The actor sends an unauthenticated request to the /wsproxy endpoint using a User-Agent of SMA Connect Agent and a bmID parameter beginning with -3389. By directing the host parameter at localhost or ::ffff:127.0.0.1, this establishes a WebSocket tunnel into backend services that were never meant to be internet-reachable — most notably an Erlang application on localhost:1050 and ctrl-service on localhost:8188.
Phase 2: Low-Privileged Execution
Because the Erlang RPC cookie needed to talk to localhost:1050 is hardcoded across devices, no authentication is required once the tunnel is open. This collapses network access directly into code execution under the unprivileged couchdb service account, letting the actor read and write files on the appliance.
Phase 3: Privilege Escalation via Path Traversal
With low-privileged execution established, the actor stages a script under /tmp and pivots to the remove_hotfix workflow in ctrl-service, supplying a hotfix parameter that traverses outside its intended directory (CVE-2026-15410). The referenced file is chmoded executable and run as root, typically triggering an immediate appliance reboot — completing the path from zero access to full root control.
Phase 4: Malware Deployment
With root access secured, the actor writes a Python script to /usr/lib/python3.11/site-packages/deploy_new.py — the KNUCKLEBALL loader. KNUCKLEBALL carries two embedded JAR archives and injects both directly into the memory of an already-running, legitimate SonicWall process, avoiding the need to drop a standalone binary that endpoint tooling might flag.
Phase 5: Backdoor Access via Web Shell and Proxy
The injected payloads are ORANGETAIL, a custom Behinder-style Java web shell reachable at /workplace/dialogs/errorDialog.jsp, and Suo5, a publicly available high-performance HTTP proxy reachable at /workplace/error.jsp and previously associated with Chinese APT tradecraft against other VPN appliance platforms. Together they give the actor durable remote command execution and network-pivoting capability disguised as normal appliance web traffic.
Phase 6: Local Privilege Escalation Backup Path
The actor also writes a setuid ELF binary, ROOTRUN, to /usr/bin/xzfind. This allows any unprivileged local user on the appliance to run commands as root — an independent, persistence-friendly fallback to privilege escalation that does not rely on the original CVE-2026-15410 exploit.
Phase 7: Persistence
To survive reboots, KNUCKLEBALL modifies the appliance's legitimate workplace startup script so the malware is automatically re-injected at boot. It also rewrites the NGINX Unit configuration, adding routes that map internet-reachable URIs directly to the Suo5 and ORANGETAIL payloads, effectively hiding a functional C2 access point inside the appliance's own reverse-proxy configuration.
Phase 8: Credential Access and Impact
With root-level access and durable backdoors in place, the actor captures unencrypted LDAP traffic traversing the internal network, obtaining credentials that could enable further access. Volexity's investigation also surfaced several attacker client hostnames exposed during lateral movement attempts, including a Kali Linux machine, though the actor's broader lateral movement was assessed as largely unsuccessful.
The KNUCKLEBALL Malware Arsenal
Once root access was achieved, UTA0533 deployed a custom malware set purpose-built for the SMA appliance platform — not off-the-shelf tooling.
KNUCKLEBALL — Malware Loader
Written to /usr/lib/python3.11/site-packages/deploy_new.py, KNUCKLEBALL is a Python script
carrying two embedded JAR archives. It injects both payloads directly into the memory space of a legitimate,
already-running SonicWall process, avoiding the need to drop a standalone executable that endpoint tooling
might flag.
ORANGETAIL — Java Web Shell
A custom, Behinder-style Java web shell injected by KNUCKLEBALL. Exposed to the attacker via the
internet-accessible URI /workplace/dialogs/errorDialog.jsp, giving UTA0533 durable
remote command execution disguised as normal appliance web traffic.
Suo5 — Open-Source HTTP Proxy
A publicly available high-performance HTTP proxy tool, injected alongside ORANGETAIL and reachable via
/workplace/error.jsp. Suo5 has previously been observed in Chinese APT tradecraft, including
campaigns exploiting Ivanti CSA appliances.
ROOTRUN — Local Privilege Escalation Binary
Written as /usr/bin/xzfind, ROOTRUN is a setuid ELF binary that allows any
unprivileged local user on the compromised appliance to execute arbitrary commands as root —
a persistence-friendly backup path to privilege escalation independent of the original CVE-2026-15410
exploit chain.
To make the backdoor survive reboots, KNUCKLEBALL modified the appliance's legitimate workplace startup script so the malware would be re-injected automatically at boot. It also rewrote the NGINX Unit configuration file, adding routes that mapped internet-reachable URIs directly to the Suo5 and ORANGETAIL payloads — effectively hiding a fully functional C2 access point inside the appliance's legitimate reverse-proxy configuration.
Indicators of Compromise (IOCs)
Network / C2 Infrastructure
| Indicator |
|---|
45.131.194[.]0/24 |
45.146.54[.]0/24 |
63.135.161[.]0/24 |
173.239.211[.]0/24 |
193.37.32[.]179 |
193.37.32.[.]214 |
216.73.163[.]151 |
216.73.163[.]158 |
Attacker Client / Asset Names Observed in Lateral Movement Attempts
DESKTOP-KRLUI3JDESKTOP-IC3C80FDESKTOP-5P0TSCPKALIlocalhost
MITRE ATT&CK Mapping
| Technique ID | Technique Name | Tactic |
|---|---|---|
| T1190 | Exploit Public-Facing Application | Initial Access |
| T1059.006 | Python | Execution |
| T1068 | Exploitation for Privilege Escalation | Privilege Escalation |
| T1055 | Process Injection | Defense Evasion |
| T1505.003 | Web Shell | Persistence |
| T1040 | Network Sniffing | Credential Access |
| T1090 | Proxy | Command-And-Control |
Visual Attack Flow
Mitigation and Remediation Guidance
These vulnerabilities do not affect SSL VPN functionality on SonicWall firewalls or the SMA 100 Series product line — exposure is limited specifically to SMA1000 series remote access appliances.
- • Upgrade immediately to platform-hotfix 12.4.3-03453 or 12.5.0-02835 (or later).
- • Perform forensic review of all SMA1000 appliances for the file system and log-based IOCs listed above, regardless of whether exploitation is currently suspected.
- • Re-image physical appliances or redeploy virtual appliances if any indicator of compromise is confirmed — do not attempt to clean an infected appliance in place.
- • Rotate all credentials — user and administrator passwords — for accounts that authenticate through or are managed by the affected appliance.
- • Reset TOTP/MFA seed values following any confirmed compromise, since seed material may have been harvested from the appliance.
- • Hunt for anomalous direct-to-domain-controller authentications originating from the appliance's internal IP address without a corresponding active VPN session.
- • Block or monitor ASN 206092 (FNS Holdings Limited) at the network perimeter if there is no legitimate business justification for that traffic.
- • Enforce LDAPS/encrypted LDAP internally to eliminate the credential-sniffing exposure
UTA0533 exploited via
tcpdump
Instantly Fix Risks with Saner Patch Management
Saner patch management is a continuous, automated, and integrated software that instantly fixes risks exploited in the wild. The software supports major operating systems like Windows, Linux, and macOS, as well as 550+ third-party applications.
It also allows you to set up a safe testing area to test patches before deploying them in a primary production environment. Saner patch management additionally supports a patch rollback feature in case of patch failure or a system malfunction.
Experience the fastest and most accurate patching software here
Featured Posts
CVE Research
Operation CameraSwarm: Inside the Toolkit Behind 14,530 Compromised Dahua Cameras
A single operator compromised 14,530+ Dahua cameras across Ukraine and Russia in 35 days, chaining credential brute-force, a CVE-2021-33044/33045 authentication bypass, and P2P relay abuse to plant a persistent backdoor and harvest transferable admin access.
CVE Research
Critical GitLab Flaw Exposes Public Projects to Deletion — Two CVEs Patched, Including High-Severity CSRF
CVE-2026-19478 is a critical code injection vulnerability in GitLab CE/EE that allows an unauthenticated attacker to modify or delete public projects and user data by abusing a GraphQL directive. A second high-severity issue, CVE-2026-19650, involves cross-site request forgery in the GraphQL multiplex query handler. This article examines how the critical vulnerability works, the availability of a public proof-of-concept, the potential impact on self-managed instances, the affected versions, and the security updates released to remediate both issues.
