"Volexity's analysis of logs, disk images, and memory led to the discovery of a threat actor Volexity tracks as UTA0533," explains the Volexity report.
UTA0533 and the zero-day exploit chain
According to Volexity's report, a previously unknown actor Volexity calls UTA0533 began exploiting two previously undisclosed vulnerabilities in SonicWall SMA1000 Secure Mobile Access appliances as early as June 22, 2026. The flaws are tracked as CVE-2026-15409, a critical server-side request forgery (SSRF), and CVE-2026-15410, a high-severity command injection vulnerability. Volexity found the attacker used CVE-2026-15409 against the SMA1000 '/wsproxy' endpoint to create unauthenticated WebSocket tunnels that exposed services meant to be reachable only from the appliance itself.
Those tunnels revealed internal services including CouchDB and the appliance management service. Volexity says the attackers queried CouchDB to obtain the appliance's product_uuid, a value required for the second stage of the attack, though the exact method for exploiting CouchDB remains unknown. With the product_uuid in hand, the actor leveraged CVE-2026-15410 through the Appliance Management Console's 'sysCtrl.execRemoveHotfix' RPC method to execute commands as root and seize full control of the appliance.
KNUCKLEBALL, Sou5 and ORANGETAIL: malware tailored to SMA1000
Once they had root, UTA0533 installed a custom dropper Volexity names KNUCKLEBALL, delivered under the filename deploy_new.py. KNUCKLEBALL in turn deployed two Java-based malware families designed for SMA1000 appliances: Sou5 (agent_wp8.jar) and ORANGETAIL (agent_wp9.jar).
Volexity describes Sou5 as functioning like a reverse proxy, enabling attackers to tunnel traffic through the compromised appliance and preserve covert access to internal resources. ORANGETAIL is characterized as a custom Java webshell that accepts encrypted Java payloads sent to the appliance and dynamically executes them inside an HTTP session. The investigation also found that attackers edited the appliance's nginx configuration to expose ORANGETAIL remotely and installed ROOTRUN, a privilege-escalation tool that allows commands to be executed as root.
SonicWall's patching and disclosure
SonicWall publicly warned that threat actors were actively exploiting the two previously undisclosed vulnerabilities and released fixes for affected appliances. The vulnerabilities affect SMA1000 6210, 7210, and 8200v models. SonicWall published patches in versions 12.4.3-03453 and 12.5.0-02835 and urged customers to install the updates immediately. While SonicWall confirmed that the flaws were being exploited as zero-days, the vendor did not disclose detailed methods used by attackers to compromise the devices; Volexity provided the fuller technical chain in its report.
Timeline, scope and operational impact
Volexity reports June 22, 2026 as the earliest observed sign of compromise in its investigation of two affected appliances and says the actor used multiple zero-day exploits and malware specifically authored for SonicWall SMA VPN appliances. The firm judged the campaign to show "significant" technical sophistication. At the same time, Volexity noted the actor was less successful at lateral movement — the campaign was not observed to spread widely into victims' internal networks in the cases they examined.
What this means for security teams and affected enterprises
- Technologists and security teams: prioritize installation of SonicWall's patches (12.4.3-03453 and 12.5.0-02835), hunt for the specific artifacts Volexity identified — deploy_new.py, agent_wp8.jar, agent_wp9.jar, nginx configuration changes and signs of ROOTRUN — and inspect logs for WebSocket connections to the '/wsproxy' endpoint and CouchDB queries for product_uuid.
- Affected enterprises and procurement leaders: confirm whether deployed SMA1000 6210, 7210 or 8200v appliances have been updated, coordinate incident-response support where compromise is suspected (Volexity assisted SonicWall in the investigation), and treat appliance management interfaces and internal-only services exposed via proxying as high-risk attack surfaces.
The recorded chain — SSRF to unauthenticated WebSocket tunnels, information theft from an internal database, and a follow-on command injection that yields root — underscores how appliance management endpoints and internal services can be combined into a complete compromise. Volexity's work provides a detailed forensic picture, but it also notes one gap: the precise method used to exploit CouchDB in the initial stage remains unknown. SonicWall's call to update to the fixed firmware versions is the immediate, concrete step the company and investigators have recommended.
