Proxying to Compromise: SonicWall Secure Mobile Access 0-day Exploitation

1. Executive summary

Volexity has published findings on a sophisticated intrusion campaign targeting SonicWall Secure Mobile Access (SMA) 1000 series VPN appliances, attributing the activity to a threat actor tracked as UTA0533. The actor chained multiple zero-day vulnerabilities, including CVE-2026-15409 (CVSS 10.0, Critical) and CVE-2026-15410, to achieve unauthenticated remote code execution and deploy custom malware. The campaign, observed from June 22, 2026, impacted EMEA financial services clients by compromising edge VPN appliances to intercept unencrypted LDAP credentials and pivot into internal networks. SonicWall has released firmware versions 12.4.3-03453 and 12.5.0-02835 to address the flaws.

2. Regulatory framing

3. Technical analysis & attack chain

Attribution to UTA0533 is unconfirmed; the actor has no MITRE ATT&CK profile in the verified reference data. The attack chain, reconstructed from Volexity's forensic investigation, proceeded as follows:

1. Pre-authentication SSRF (CVE-2026-15409): The attacker sent a crafted GET request to /wsproxy with a bmID value starting with -3389, a serviceType of SSH, and the host parameter set to 0.0.0.0. The User-Agent was set to SMA Connect Agent. This bypassed authentication and forced the appliance to establish a WebSocket tunnel (HTTP 101 response) to localhost-only services.
2. Internal service access: Via the SSRF, the attacker reached 127.0.0.1:1050 (CouchDB Erlang distribution) and 127.0.0.1:8188 (SMA control service / XML-RPC over TLS).
3. Credential access / Control service authentication bypass: The control service on port 8188 uses Basic authentication derived from the appliance's hardware identifier at /sys/class/dmi/id/product_uuid. The UUID has dashes removed and is Base64-encoded to form the password. On physical appliances, this UUID was often a default value, allowing trivial bypass. (Note: Volexity states this specific bypass was not used in the observed incident; the attacker instead abused a separate vulnerability to read the UUID).
4. CouchDB exploitation: The attacker exploited the localhost CouchDB instance, which ships with hardcoded credentials admin:admin. A file named 1234.sh was written to /tmp and owned by the couchdb user.
5. Command injection and privilege escalation (CVE-2026-15410): The attacker invoked the sysCtrl.execRemoveHotfix method on the control service. This method calls /usr/local/bin/remove_hotfix, which constructs a rollback path using caller-controlled input without sufficient directory constraint. Path traversal using ../../../../../tmp/1234.sh resulted in the execution of /tmp/1234.sh --unattended as root.
6. Persistence and webshell deployment: The attacker dropped deploy_new.py, which injected two Base64-encoded JAR files (/tmp/agent_wp8.jar and /tmp/agent_wp9.jar) into the workplace.startup.CommandStartup Java process using the Java Attach API (/tmp/.attach_pid<PID> and /tmp/.java_pid<PID>). The script modified nginx configuration via a local Unix socket to add routes for /__api__/login (rewriting to /workplace/error.jsp) and /__api__/logout (rewriting to /workplace/dialogs/errorDialog.jsp), proxying both to http://127.0.0.1:8085.
7. Webshell functionality (ORANGETAIL): The agent_wp8.jar targeted the com/aventail/jsp/workplace/error_jsp class and injected a modified version of the suo5.jsp HTTP forwarding proxy. The agent_wp9.jar targeted com/aventail/jsp/workplace/dialogs/errorDialog_jsp and injected a custom webshell similar to Behinder. Both payloads gated access behind a specific user-agent: Mozilla/6.0 (Windows NT 11.0; Win64; x64) AppleWebKit/1537.136 (KHTML, like Gecko) Chrome/149.0.0.1 Safari/1537.136. The webshell accepts data via the find parameter in an HTTP POST, decrypted using AES-128-ECB with a hardcoded key.
8. Credential interception and lateral movement: The attacker used tcpdump on the compromised appliance to sniff local traffic and extract usernames and passwords from unencrypted LDAP. The actor used the Suo5 proxy and ORANGETAIL to pivot into the customer network, attempting authentication to various internal systems.

Single-sourced confidence caveat: The technical mechanism for the CouchDB exploitation step remains unknown to Volexity. The attack chain relies on single-sourced forensic analysis from Volexity's blog; verify IOCs before enforcement.

4. Mitigation & containment

P1 — Within 24 hours

• Isolate and inspect: Immediately identify all SonicWall SMA 1000 series appliances (models 6210, 7210, 8200v). If compromise indicators (see §5) are present, isolate the appliance from the network.
• Patch: Upgrade appliances to firmware version 12.4.3-03453 or 12.5.0-02835.
• Credential rotation: If compromise is confirmed, re-image (hardware) or re-deploy (virtual) the appliance. Change all user and administrator passwords and reset TOTP tokens.

P2 — Within 72 hours

• Log review: Search /var/log/aventail/extraweb_access.log for GET /wsproxy requests containing bmID=-3389 and host=0.0.0.0 returning status 101.
• Hunt for webshells: Search for HTTP POST requests to /__api__/login and /__api__/logout in access logs. Check for the presence of /tmp/1234.sh, /tmp/agent_wp8.jar, /tmp/agent_wp9.jar, and deploy_new.py.
• Block traffic: Implement firewall rules to block outbound connections from SMA appliances to known VPN exit nodes (ExpressVPN, MullvadVPN) if not required for business operations.

P3 — Within 7 days

• Harden configuration: Verify that default CouchDB credentials (admin:admin) are changed if administrative access is required, and restrict localhost service exposure.
• Network segmentation: Ensure LDAP traffic to the SMA appliances is encrypted (LDAPS) to prevent credential sniffing via tcpdump.

5. Indicators of compromise

filepath  /tmp/1234.sh
filepath  /tmp/agent_wp8.jar
filepath  /tmp/agent_wp9.jar
filepath  /tmp/agent_wp8.log
filepath  /tmp/agent_wp9.log
filepath  /tmp/.attach_pid<PID>
filepath  /tmp/.java_pid<PID>
filepath  /sys/class/dmi/id/product_uuid
md5  5cb00bbfe818ee3e85fb99ab1db1af7c
sha1  04d4a9fbb32e967200eb98be014ca914a03bfa6b
sha256  81a9af3846bad3a1107164ff7cf0a08e020b31a3b32fd17866e17d4c1565f7f2
md5  b6df166291f80ee89032d769c99714f3
sha1  b4ee1f50fbb49f0ff5fde3d026343bc23ee08d51
sha256  8c470301dcb7278f73e622f1950073567b34011c64b60cdfbb0f89803923a5a3
md5  54d21399b8b52b48a0fef68450593e45
sha1  c2b0ae0a1f42a139abe4dd612676066ec1426394
sha256  1e1e68bbb899450a57274a8b12082ed4e2040a2aae77014f20431689d2b4edee
md5  5f3a55201c511c9ff9be4c16c41028a2
sha1  5e5b716f2385c818ec61198be1a2a07a4560eac5
sha256  ea9154e374e4f77bc2cf54282e23543573980342a85bc888cb23f20b8bbba081
ua  Mozilla/6.0 (Windows NT 11.0; Win64; x64) AppleWebKit/1537.136 (KHTML, like Gecko) Chrome/149.0.0.1 Safari/1537.136

6. Detection

rule ORANGETAIL_Webshell_Agent {
    meta:
        author = "Adverse Trace"
        date = "2026-07-18"
        reference = "https://www.volexity.com/blog/2026/07/17/proxying-to-compromise-sonicwall-secure-mobile-access-0-day-exploitation/"
        description = "Detects the ORANGETAIL Java webshell agent JARs injected into SonicWall SMA appliances"
    strings:
        $gating_ua = "Mozilla/6.0 (Windows NT 11.0; Win64; x64) AppleWebKit/1537.136 (KHTML, like Gecko) Chrome/149.0.0.1 Safari/1537.136" ascii
        $target_class1 = "com/aventail/jsp/workplace/error_jsp" ascii
        $target_class2 = "com/aventail/jsp/workplace/dialogs/errorDialog_jsp" ascii
        $param_find = "find" ascii
        $session_key = "IG3L" ascii
        $attach_api1 = "/tmp/.attach_pid" ascii
        $attach_api2 = "/tmp/.java_pid" ascii
        $log_null1 = "/tmp/agent_wp8.log"
        $log_null2 = "/tmp/agent_wp9.log"
        $jar_temp1 = "/tmp/agent_wp8.jar"
        $jar_temp2 = "/tmp/agent_wp9.jar"
    condition:
        3 of them
}

rule SonicWall_PrivEsc_Rootrun {
    meta:
        author = "Adverse Trace"
        date = "2026-07-18"
        reference = "https://www.volexity.com/blog/2026/07/17/proxying-to-compromise-sonicwall-secure-mobile-access-0-day-exploitation/"
        description = "Detects the xzfind/rootrun privilege escalation utility dropped on SonicWall SMA"
    strings:
        $usage = "Usage: rootrun rootrun <command>" ascii
        $name = "rootrun" ascii
    condition:
        uint16(0) == 0x457f and 1 of them
}

title: SonicWall SMA ORANGETAIL Webshell Access
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects POST requests to ORANGETAIL webshell paths established via nginx rewrites on compromised SonicWall SMA appliances
author: Adverse Trace
date: 2026/07/18
references:

    - https://www.volexity.com/blog/2026/07/17/proxying-to-compromise-sonicwall-secure-mobile-access-0-day-exploitation/
logsource:
    product: sonicwall
    service: sma_web
detection:
    selection:
        c-uri:

            - '/__api__/login'
            - '/__api__/logout'
        http_method: 'POST'
    condition: selection
falsepositives:

    - Legitimate API traffic (unlikely given standard SonicWall API paths differ)
level: high

7. Sources

• Volexity — Proxying to Compromise: SonicWall Secure Mobile Access 0-day Exploitation — https://www.volexity.com/blog/2026/07/17/proxying-to-compromise-sonicwall-secure-mobile-access-0-day-exploitation/ — 2026-07-17
• Help Net Security — SonicWall SMA appliances targeted in zero-day attacks (CVE-2026-15409, CVE-2026-15410) — https://www.helpnetsecurity.com/2026/07/14/sonicwall-sma-attacks-via-cve-2026-15409-cve-2026-15410/ — 2026-07-14
• BleepingComputer — SonicWall warns of SMA1000 flaws exploited in zero-day attacks, patch now — https://www.bleepingcomputer.com/news/security/sonicwall-warns-of-sma1000-flaws-exploited-in-zero-day-attacks-patch-now/ — 2026-07-14
• The Hacker News — Two SonicWall SMA 1000 Zero-Days Exploited, One Could Enable Admin Commands — https://thehackernews.com/2026/07/two-sonicwall-sma-1000-zero-days.html — 2026-07-14

8. Adverse Trace position

This is a critical severity exposure for any EMEA financial services client operating SonicWall SMA 1000 series physical appliances. The combination of CVE-2026-15409 (CVSS 10.0) and CVE-2026-15410 provides an unauthenticated path to root, enabling credential interception at the network edge. Attribution to UTA0533 remains unconfirmed due to the absence of a MITRE ATT&CK profile, but the tradecraft observed—specifically the ORANGETAIL webshell and Java instrumentation injection—is highly targeted. Clients must immediately patch to versions 12.4.3-03453 or 12.5.0-02835 and hunt for the specified log indicators. Adverse Trace will continue to monitor for the release of the Rapid7 PoC and any expansion of the IP infrastructure used by the threat actor.

Read the original source →

Published via PulseTrace — Adverse Trace threat intelligence.