UK Council Cyberattack Tied to Mass Exploitation of Critical SonicWall Vulnerability
Hackers leveraged a maximum-severity SSRF flaw to steal Active Directory credentials across multiple sectors.
1Critical Vulnerability Discovered
On July 14, 2026, SonicWall disclosed CVE-2026-15409, a maximum-severity SSRF flaw scoring 10.0 on the CVSS scale. The vulnerability affects SMA1000 appliances' WorkPlace portal WebSocket proxy, allowing unauthenticated attackers to access local Erlang services via port 1050. Security firm Hunt.io later linked this flaw to a coordinated attack campaign targeting over 250 organizations globally, including the UK's King's Lynn and West Norfolk Borough Council.
2Attack Methodology Revealed
Attackers automated exploitation to complete all steps within seconds. They used hardcoded firmware cookies to connect to CouchDB services, then executed OS commands with couchdb privileges. The campaign deployed a modified Impacket secretsdump tool directly on compromised appliances to harvest credentials from internal Windows systems. This technique bypassed EDR monitoring by blending malicious traffic with legitimate appliance behavior.
3Global Impact Assessment
The campaign compromised 168 appliances, exposing credentials for 534 Active Directory accounts across 160 domains. Five organizations suffered complete Active Directory database theft via DCSync replication. Confirmed victims spanned France, India, Italy, and the US, with targets in UK, Canada, Germany and Asia. Sectors affected included government, healthcare, finance, education, and managed IT providers.
4Technical Exploit Details
Attackers used ldap_extract.py to decrypt LDAP passwords from policy files using a fixed AES key present in all vulnerable firmware. When LDAP credentials lacked DCSync rights, they leveraged stolen LSA secrets containing domain controller NTLM hashes. The attackers created NTDS database files in /tmp and retrieved them by executing commands through the SSRF flaw.
5Detection Challenges
The attack evaded standard monitoring because SonicWall appliances performing credential dumping didn't trigger Windows EDR alerts or appear in event logs. Security teams typically have less visibility into appliance OS activity compared to managed hosts. The malicious traffic mimicked normal appliance behavior, making detection exceptionally difficult without specialized network monitoring.
6Rapid Weaponization Timeline
Rapid7 published a PoC on July 15. By July 16, attackers had adapted it into a 50-thread mass scanner. Active exploitation began before SonicWall's advisory, with mass campaigns launching within 72 hours of initial discovery. This compressed timeline highlights the growing speed of cyber threat proliferation following vulnerability disclosures.
7Attacker Infrastructure Exposed
Hunt.io discovered the attacker's open directory at 95.181.173[.]36 on July 17, containing complete toolchain: scan scripts, exploit code, credential parsers, and campaign output files. Analysis revealed targeting lists with nearly 200,000 SonicWall system addresses. While scripts contained Chinese comments, researchers deemed this insufficient for definitive attribution.
8Sector-Wide Implications
The opportunistic targeting demonstrates how single vulnerabilities can enable cross-sector breaches. The incident underscores critical risks in network perimeter devices and the need for enhanced appliance monitoring. Organizations must assume internet-facing devices will be compromised and implement additional credential protection measures like regular rotation and MFA.