Dateline: July 20, 2026
Patched but Not Safe: What SonicWall SMA Users Need to Do Now
The front door was already open. On June 22, attackers were inside SonicWall VPN boxes weeks before anyone knew a hole existed. By July 14, SonicWall confirmed the break-ins were real and tied to the Inc ransomware crew. The device meant to guard the network had become the way in.
What Happened?
SonicWall published an advisory on July 14 for two flaws in its SMA 1000 Series appliances. The first is CVE-2026-15409, a server side request forgery bug rated a perfect 10.0. The second is CVE-2026-15410, a command injection bug in the appliance console.
Used together, the two bugs let an attacker with no login reach services hidden inside the box, then run commands as root. Root is the highest level of control on the device.
Rapid7 spotted the attacks in the wild before SonicWall went public. A threat actor linked to the Inc ransomware group was chaining the flaws to get in.
Volexity ran a separate investigation and tracks the actor as UTA0533. The team found the attacker tunneled through a proxy feature, abused a built in CouchDB database with default admin login, and read a hardware ID to unlock a control service. From there they dropped custom malware called KNUCKLEBALL, which loaded a proxy tool and a hidden web shell into memory.
CISA added both flaws to its Known Exploited Vulnerabilities list and gave federal agencies until July 17 to patch.
What’s the Impact?
A VPN gateway sits at the edge of your network. Everyone trusts it. That trust is exactly what made this attack so damaging.
Once inside, the attackers pulled high value credentials, active session data, and the seed values behind multi factor authentication. That last part matters. Steal the MFA seed and the second factor stops protecting you.
Rapid7 then saw the box log into core domain controllers with no active VPN tunnel. The appliance had become a quiet backdoor into the heart of the network. Volexity also watched the attacker sniff plain LDAP traffic to grab usernames and passwords.
SonicWall says the SMA line is built for large firms, government agencies, and managed security providers. The victims tend to hold data worth stealing.
Patching alone will not save you here. If an attacker already grabbed your credentials and MFA seeds, a firmware update does not undo that.
How to Avoid This
Update to the fixed firmware right away, versions 12.4.3-03453 or 12.5.0-02835. Then treat the box as if it was already hit. Review logs, re image hardware or redeploy virtual appliances, reset every user and admin password, and reset TOTP tokens.
Hunt before you fully trust the patch. Look for odd connections leaving the appliance and check for lateral movement into the network.
Inc Ransomware / UTA0533 Indicators of Compromise
SonicWall SMA 1000 zero days: CVE-2026-15409 and CVE-2026-15410. Check these against your appliance and network before you trust a patch.
| Where to Look | What to Flag |
|---|---|
| extraweb_access.log | GET /wsproxy with bmID starting -3389, status 101 |
| extraweb_access.log | POST /__api__/login or /__api__/logout returning HTTP 200 |
| ctrl-service.log | hotfix removal running for ../../../../../tmp/ paths |
| String |
|---|
| Mozilla/6.0 (Windows NT 11.0; Win64; x64) AppleWebKit/1537.136 (KHTML, like Gecko) Chrome/149.0.0.1 Safari/1537.136 |
| File / Name | Hash |
|---|---|
| xzfind (ROOTRUN) | 81a9af3846bad3a1107164ff7cf0a08e020b31a3b32fd17866e17d4c1565f7f2 |
| deploy_new.py (KNUCKLEBALL) | 8c470301dcb7278f73e622f1950073567b34011c64b60cdfbb0f89803923a5a3 |
| agent_wp8.jar (Suo5) | 1e1e68bbb899450a57274a8b12082ed4e2040a2aae77014f20431689d2b4edee |
| agent_wp9.jar (ORANGETAIL) | ea9154e374e4f77bc2cf54282e23543573980342a85bc888cb23f20b8bbba081 |
| Item | Detail |
|---|---|
| Unexpected files | /tmp and /var/tmp |
| Rogue nginx routes | /var/lib/unit/conf.json pointing to http://127.0.0.1:8085 |
| Setuid binaries | find / -perm -4000 |
| IP | IP |
|---|---|
| 108.205.8.173 | 202.8.105.201 |
| 147.45.51.19 | 217.77.15.99 |
| 150.241.210.53 | 42.200.172.14 |
| 81.19.140.217 | 89.117.20.1 |
| Hostname | Hostname |
|---|---|
| DESKTOP-5P0TSCP | DESKTOP-KRLUI3J |
| DESKTOP-IC3C80F | KALI |
Source: Volexity incident response report, July 17, 2026. Over 200 attacker IPs were seen in total, several tied to ExpressVPN and MullvadVPN. Only the non VPN samples Volexity listed are shown here.
When Your VPN Becomes the Backdoor
A patched appliance still hides a compromised one if you never look inside. That gap between fixing the flaw and finding the intruder is where Inc ransomware lives. Secure.com helps you close that gap:
- Spot the odd logins from an edge device that a firmware update cannot catch, like the VPN-less domain controller access Rapid7 flagged.
- Match live activity against known IOCs so a proxy tunnel or web shell does not sit quiet for weeks.
- Flag stolen credential and MFA seed abuse fast, before it turns into lateral movement.
- Cut through alert noise so your team hunts the real intrusion, not the false alarms.
- Give a small team the reach to review appliance logs the way a full incident response crew would.
