Zero-Day Campaign Targeting SonicWall VPN Appliances Uncovered
Unknown hackers exploited vulnerabilities in SonicWall SMA 1000 VPN devices.
1Zero-Day Attack Detected
Unknown hackers exploited two zero-day vulnerabilities in SonicWall SMA 1000 VPN devices to gain root access. The attacks began in June 2026 and were carried out before patches were released.
2Details of the Vulnerabilities
The first vulnerability, CVE-2026-15409, was identified as a Server-side request forgery (SSRF) issue. The second, CVE-2026-15410, was a post-authentication code injection flaw. These vulnerabilities allowed remote execution of root-level commands.
3Identity of the Attacker
The attacker, tracked by Volexity as UTA0533, used malware specifically designed for SonicWall SMA VPN devices. The group appears to have prepared specifically for this target.
4Impact of the Attack
The attackers gained root access, allowing them to access stored or cached credentials. They also had the potential to capture network traffic and intercept credentials, highlighting the high-risk nature of VPN devices.
5Patches and Measures
SonicWall patched both vulnerabilities this week and confirmed active exploitation. The company discovered the vulnerabilities through an internal report and investigated multiple incidents.
6Volexity's Analysis
Volexity analyzed logs and security telemetry from two compromised SonicWall devices. The team collected RAM, selected files, and full disk images. Memory analysis revealed additional evidence of the attackers' activities.
7Key Takeaways
This attack underscores the critical nature of VPN devices as targets. The use of custom malware suggests an increase in targeted attacks. Timely application of security patches is crucial.