CARDS
Attackers chained unauthenticated CVE-2026-15409 with CVE-2026-15410 to move from WebSocket proxy access to root-level execution on SonicWall SMA1000 appliances. Rapid7's public technical post confirms active exploitation, credential/session/TOTP theft, and lateral movement. Dark Reading reports that Rapid7 tied the activity to INC Ransom and that one case progressed to ransomware. Volexity independently tracks observed activity as UTA0533.
Last updated Jul 23, 2026, 3:27 PM EDT
Actor Mapping
Targeting
Tradecraft
Tools / Observables
Campaign Chronology
22-Jun-2026
Volexity identified the earliest compromise artifact on the first investigated SMA1000 appliance. Root-enabling tooling and the KNUCKLEBALL loader were written shortly afterward.[4]
28-Jun-2026
Appliance logs recorded unauthenticated /wsproxy WebSocket connections to localhost services on ports 1050 and 8188, followed by root-level hotfix-removal activity.[4]
30-Jun-2026
Volexity found additional exploitation files, including a local privilege-escalation payload later associated with CVE-2026-15410.[4]
02-Jul-2026
Artifacts showed tcpdump being used to capture unencrypted LDAP traffic. A reboot likely removed some memory-resident evidence, but malicious configuration changes remained.[4]
Early Jul 2026
Volexity was engaged after suspicious authentication and lateral-movement attempts were observed from the SMA appliances; two appliances in one customer environment were confirmed compromised.[4]
14-Jul-2026
15–16 Jul 2026
17-Jul-2026
20-Jul-2026
BleepingComputer summarized the KNUCKLEBALL, Suo5, ORANGETAIL, ROOTRUN, credential-capture, and attempted-pivot findings while retaining Volexity's UTA0533 label.[7]
Victimology
Publicly named organizations
None identified
As of July 23, no organization has been publicly named as a victim of CVE-2026-15409 and CVE-2026-15410 exploitation. This means identity is undisclosed—not that no organizations were affected.[1][3][4][5][6][7][8][9][10]
Volexity customer investigation
One unnamed organization
Volexity confirmed two compromised SMA1000 appliances in one customer environment. The customer permitted publication, but its identity, sector, and country were not disclosed.[4]
Rapid7 incident-response cases
Multiple unnamed organizations
Rapid7 publicly described targeted exploitation across customer environments. Dark Reading reported that exfiltration and encryption were prevented in most cases, while one active case reached ransomware deployment. No victim was named.[3][5]
Other named SonicWall incidents
Excluded from this victim list
Publicly named organizations from older or different SonicWall, SMA 100, firewall, cloud-backup, Akira, Abyss, or UNC6148 incidents are not treated as victims of this SMA1000 two-CVE campaign without an explicit source connection.[5]
“No publicly named victim” is a disclosure statement, not an assessment that the campaign caused no harm.
Cross-Source Assessment
Agreement
Broad agreement that both CVEs were exploited as zero-days before public disclosure and require emergency remediation.[1][2][3][4][6][8][9][10]
Boundary / disagreement
The public sources do not establish a complete incident count or exposure population.
Agreement
Rapid7 and Volexity independently describe the unauthenticated WebSocket/localhost access path and escalation to root; major news coverage consistently reports the two-stage chain.[3][4][6][7][8][9][10]
Boundary / disagreement
Some initial July 14 coverage noted that chaining details were not yet public; later primary research supplied those mechanics.
Agreement
Primary reporting agrees on credential access and attempted movement into internal networks; Volexity adds custom SMA-specific malware and packet capture, while Rapid7 adds session/TOTP theft and domain-controller authentication.[3][4][7][8]
Boundary / disagreement
Observed behaviors vary by investigated case and should not be assumed present in every exposed appliance.
Agreement
Vendor, researcher, government, and news reporting consistently call for immediate fixed releases plus IOC review; confirmed compromise can require reimage or redeployment and authentication-material resets.[1][2][3][6][8]
Boundary / disagreement
A clean version number does not prove that a previously exposed appliance was never compromised.
Agreement
Sources describe multiple cases and anonymized customer environments but do not publish organization names for this campaign.[1][3][4][5]
Boundary / disagreement
Two compromised appliances in Volexity's investigation represent one disclosed customer environment, not two named victims.
Agreement
There is no cross-source consensus that INC and UTA0533 are the same actor or that every intrusion led to ransomware.[3][4][5][7]
Boundary / disagreement
Dark Reading reports Rapid7's INC association and one ransomware deployment; Rapid7's public technical post does not name INC, and Volexity separately tracks UTA0533.
Source Reconciliation
Campaign rows are retained as source-backed context. Actor mappings do not automatically merge actor records; SOCRadar, MITRE, Mandiant, CrowdStrike, Microsoft, and other future sources can disagree on boundaries, aliases, or campaign ownership.
Evidence Controls
IntelliOS
Citations
