SonicWall Appliance Zero-Day Exploitation and Webshells

Source

---
analysis: A standard detection rule might alert on /wsproxy, but this hunt correlates
  the successful bypass (status 101) with behavioral couchdb shell execution and rare
  API persistence, providing a full narrative that a single alert cannot achieve.
blind_spots:
- id: limited-edge-telemetry
  question: Which specific internal services were accessed through the WebSocket tunnel?
  requires: appliance-native logging for /var/log/aventail
  risk: Standard HTTP telemetry records the tunnel creation but not the traffic within
    the tunnel, potentially missing the specific internal targeting.
  stage: pre-authentication-proxy-bypass
- id: nginx-config-persistence
  question: When were the malicious rewrite rules added to the firmware configuration?
  requires: hb_file_activity covering nginx configuration paths
  risk: If the EDR does not monitor the appliance's specific configuration directories,
    the establishment of the persistent webshell path may go unnoticed.
  stage: persistence-via-webshell-and-nginx
coverage:
- stage: pre-authentication-proxy-bypass
  status: covered
  steps:
  - wsproxy-bypass-search
- stage: privilege-escalation-and-rce
  status: covered
  steps:
  - couchdb-rce-search
- stage: persistence-via-webshell-and-nginx
  status: covered
  steps:
  - webshell-prevalence-search
- stage: credential-sniffing-and-lateral-movement
  status: covered
  steps:
  - fingerprint-search
  - lateral-movement-auth
guardrails:
  claims: no_unsupported
  evidence: citation_required
  missing_data: not_benign
  telemetry: untrusted
hunt:
  applicability: campaign-specific
  handoff: keep-as-periodic-hunt
  justification: SonicWall SMA zero-day exploitation represents a critical perimeter
    breach. Identifying the UTA0533 tradecraft is essential to preventing lateral
    movement and credential theft from internal directory services.
  methodology: model-assisted
  trigger: intel-report
hypothesis: An adversary has exploited a pre-authentication proxy bypass and CVE-2026-15410
  to execute commands on a SonicWall SMA appliance, established persistence via Nginx
  rewrites, and moved laterally using specific browser fingerprints.
labels:
- hunt
- attack.t1190
- attack.t1090.003
- attack.t1505.003
- attack.t1572
- attack.t1133
name: SonicWall Appliance Zero-Day Exploitation and Webshells
parameters:
  appliance_ips:
    default: []
    description: Internal IPs of the VPN appliances to track outbound movement.
    from:
      kind: article
      observed: '2026-09-09'
      ref: https://www.volexity.com/blog/2026/07/17/proxying-to-compromise-sonicwall-secure-mobile-access-0-day-exploitation/
    type: list[ip]
  lookback_days:
    default: '30'
    description: Days of history to examine.
    from:
      kind: manual
      observed: '2026-06-22'
      ref: incident-window
    type: number
  malicious_ua:
    default: Mozilla/6.0 (Windows NT 11.0; Win64; x64) AppleWebKit/1537.136 (KHTML,
      like Gecko) Chrome/149.0.0.1 Safari/1537.136
    description: Hardcoded User-Agent observed during lateral movement.
    from:
      kind: article
      observed: '2026-07-17'
      ref: Volexity UTA0533
    type: string
  scope_hosts:
    default: []
    description: Narrow the hunt to specific appliance hostnames.
    type: list[host]
  service_accounts:
    default:
    - svc-sonicwall
    - radius-user
    description: Known service accounts used by the appliance for synchronization.
    type: list[string]
  target_cve:
    default: CVE-2026-15410
    description: CVE identifier for the SMA AMC Code Injection.
    from:
      kind: article
      observed: '2026-07-17'
      ref: Volexity UTA0533
    type: string
provenance:
  authors:
  - name: Huntbase hunt generation
    org: huntbase.io
  generated:
    by: huntbase-hunt-generation
    from: https://www.volexity.com/blog/2026/07/17/proxying-to-compromise-sonicwall-secure-mobile-access-0-day-exploitation/
    gates:
    - dry-run
    - lint
    model: hb_google/gemini-3-flash-preview
rationale: Initial focus should be on all SonicWall SMA 1000 series appliances identified
  by vulnerability scanners. Map the resource_uid from findings to hostnames before
  running telemetry queries.
references:
- name: 'Proxying to Compromise: SonicWall SMA 0-day Exploitation'
  url: https://www.volexity.com/blog/2026/07/17/proxying-to-compromise-sonicwall-secure-mobile-access-0-day-exploitation/
related:
- hunt: edge-device-persistence-forensics
  reason: This hunt focuses on current telemetry; a full forensic investigation of
    disk images is needed for deep recovery.
  relation: out-of-scope-alternative
scenario:
  stages:
  - name: Pre-authentication WebSocket Proxying
    observables:
    - GET /wsproxy?bmID=-3389
    - 'User-Agent: SMA Connect Agent'
    - HTTP 101 Switching Protocols
    - Destination ports 1050, 1051, 8188 on 127.0.0.1
    slug: pre-authentication-proxy-bypass
    tactic: initial-access
    techniques:
    - T1190
    - T1090.003
  - name: CVE-2026-15410 Command Injection
    observables:
    - /tmp/1234.sh
    - couchdb user executing shell scripts
    - /usr/local/bin/remove_hotfix ../../../../../tmp/1234.sh
    - running hotfix removal in ctrl-service.log
    slug: privilege-escalation-and-rce
    tactic: execution
    techniques:
    - T1190
  - name: Webshell and Nginx Persistence
    observables:
    - python3 /usr/lib/python3.11/site-packages/deploy_new.py
    - POST /__api__/login
    - POST /__api__/logout
    - Nginx configuration rewrites to malicious endpoints
    slug: persistence-via-webshell-and-nginx
    tactic: persistence
    techniques:
    - T1505.003
  - name: LDAP Sniffing and Lateral Movement
    observables:
    - nohup tcpdump -i any port 389
    - 'User-Agent: Chrome/149.0.0.1'
    - Authentication attempts from VPN appliance IP
    - Lateral movement to internal directory servers
    slug: credential-sniffing-and-lateral-movement
    tactic: credential-access
    techniques:
    - T1133
    - T1572
  summary: UTA0533 compromised SonicWall SMA 1000 appliances by exploiting a zero-day
    pre-authentication bypass to tunnel traffic to internal services like CouchDB
    and a management control service. They achieved root-level code execution via
    command injection, established persistence through modified nginx configurations
    and Python-based webshells, and performed credential sniffing of LDAP traffic
    to move laterally.
severity: critical
targets:
  analyst:
    name: Tier-2 analyst
    role: analyst
  endpoint:
    category: endpoint
    name: Endpoint telemetry (hb_ surfaces)
    telemetry:
    - endpoint
  hunter:
    agent: true
    name: Hunt agent
  identity:
    category: identity
    name: Identity / sign-in telemetry
    telemetry:
    - identity
  web:
    category: siem
    name: Web server / proxy logs
    telemetry:
    - network
tlp: clear
type: investigation
---


# SonicWall Appliance Zero-Day Exploitation and Webshells

The adversary exploits SonicWall SMA 1000 series appliances using a zero-day chain to gain initial access and establish persistent webshells. The hunt identifies UTA0533 intrusion patterns by scoping vulnerable devices and searching for successful /wsproxy bypasses and CouchDB-based shell execution. A follow-on phase detects persistent access through rare API endpoints and tracks lateral movement attempts originating from the appliance. This phased approach ensures that the hunt prioritizes follow-on indicators for hosts showing signs of initial exploitation.

## identify-vulnerable-appliances
<!-- Identify vulnerable SMA appliances -->
Locate appliances in the estate currently reporting the target CVE to define the hunt scope.

```sqlite target=endpoint role=scoping params=(target_cve=target_cve)
~~~yaml
expected: A list of resource_uid identifiers. The analyst must map these cloud ARNs
  or provider IDs back to device_hostname values using the hb_devices table before
  proceeding to subsequent steps.
reads:
- resource_uid
- device_uid
- affected_package_version
- severity
- first_seen
- cve_uid
- status
silence: not_evidence_of_absence
source: hb_vulnerability_finding
verified: dry-run
verified_at: '2026-09-20'
~~~
SELECT resource_uid, device_uid, affected_package_version, severity, first_seen FROM hb_vulnerability_finding WHERE cve_uid = '{{target_cve}}' AND status != 'suppressed'
```

## early-exploitation-parallel
<!-- Search for initial access and RCE -->
parallel:
- → wsproxy-bypass-search
- → couchdb-rce-search
join: → exploitation-analysis

## wsproxy-bypass-search
<!-- WebSocket proxy bypass attempts -->
Detect successful external attempts to tunnel through /wsproxy to internal management ports.

```sqlite target=web role=detection-candidate params=(lookback_days=lookback_days)
~~~yaml
expected: Requests to /wsproxy returning status 101, confirming a successful protocol
  upgrade for a proxy bypass as described in the report.
reads:
- device_hostname
- src_endpoint_ip
- url_full
- status_code
- time
- url_path
- url_query
- user_agent
silence: not_evidence_of_absence
source: hb_http_activity
verified: dry-run
verified_at: '2026-09-20'
~~~
SELECT device_hostname, src_endpoint_ip, url_full, status_code, time FROM hb_http_activity WHERE url_path = '/wsproxy' AND status_code = 101 AND (url_query LIKE '%bmID=-3389%' OR user_agent = 'SMA Connect Agent') AND time >= datetime('now', '-{{lookback_days}} days')
```

## couchdb-rce-search
<!-- CouchDB behavioral RCE search -->
Identify anomalous shell activity spawned by the couchdb user account, regardless of the filename used.

```sqlite target=endpoint role=enrichment params=(lookback_days=lookback_days, scope_hosts=scope_hosts)
~~~yaml
expected: Any row showing the couchdb service account spawning a command shell or
  an interpreter, which indicates successful command injection.
reads:
- device_hostname
- user_name
- process_name
- process_cmd_line
- time
silence: not_evidence_of_absence
source: hb_process_activity
verified: dry-run
verified_at: '2026-09-20'
~~~
SELECT device_hostname, user_name, process_name, process_cmd_line, time FROM hb_process_activity WHERE (LOWER(user_name) = 'couchdb' AND (LOWER(process_name) IN ('sh', 'bash', 'dash', 'python', 'python3', 'php') OR LOWER(process_cmd_line) LIKE '%/tmp/%')) OR LOWER(process_cmd_line) LIKE '%remove_hotfix%' AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days')
```

## exploitation-analysis
<!-- Evaluate exploitation success -->
```agent target=hunter
cite: required
context:
- wsproxy-bypass-search
- couchdb-rce-search
max_iterations: 3
objective: Confirm if any appliance in scope exhibits both the successful /wsproxy
  bypass (101 status) and post-exploit command execution from the couchdb user.
success_criteria: A list of compromised hosts with specific evidence of both bypass
  and behavioral shell execution.
tools:
- endpoint
- identity
- web
```

## follow-on-activity-parallel
<!-- Hunt for persistence and lateral movement -->
parallel:
- → webshell-prevalence-search
- → fingerprint-search
- → lateral-movement-auth
join: → intrusion-depth-analysis

## webshell-prevalence-search
<!-- Rare API path persistence -->
Identify undocumented /__api__/ persistence endpoints by stack-counting them across the fleet to find outliers.

```sqlite target=web role=baseline params=(lookback_days=lookback_days)
~~~yaml
baseline:
  compare: first_seen
  window: '{{lookback_days}}d'
expected: Documented login/logout paths seen on only one or two appliances, indicating
  custom Nginx rewrites for webshell access.
prevalence:
  by: device_hostname
  key:
  - url_path
  rare_below: 3
reads:
- url_path
- device_hostname
- time
silence: not_evidence_of_absence
source: hb_http_activity
verified: dry-run
verified_at: '2026-09-20'
~~~
SELECT url_path, COUNT(DISTINCT device_hostname) AS host_count, MIN(time) AS first_seen, MAX(time) AS last_seen FROM hb_http_activity WHERE url_path LIKE '/__api__/%' AND time >= datetime('now', '-{{lookback_days}} days') GROUP BY url_path HAVING host_count < 3 ORDER BY host_count ASC
```

## fingerprint-search
<!-- Adversary browser fingerprint search -->
Locate the specific User-Agent associated with UTA0533 lateral movement across all web traffic.

```sqlite target=web role=triage params=(lookback_days=lookback_days, malicious_ua=malicious_ua)
~~~yaml
expected: Any traffic carrying the hardcoded UA, particularly originating from an
  appliance or targeting internal web resources.
reads:
- device_hostname
- src_endpoint_ip
- url_full
- time
- user_agent
silence: not_evidence_of_absence
source: hb_http_activity
verified: dry-run
verified_at: '2026-09-20'
~~~
SELECT device_hostname, src_endpoint_ip, url_full, time FROM hb_http_activity WHERE user_agent = '{{malicious_ua}}' AND time >= datetime('now', '-{{lookback_days}} days')
```

## lateral-movement-auth
<!-- Lateral movement from appliance IPs -->
Identify anomalous sign-ins originating from VPN appliances while filtering out legitimate service account noise.

```sqlite target=identity role=triage params=(lookback_days=lookback_days, appliance_ips=appliance_ips, service_accounts=service_accounts)
~~~yaml
expected: Authentication attempts to internal servers originating from the appliance
  IPs that do not match known synchronization service accounts.
reads:
- src_endpoint_ip
- dst_endpoint_name
- actor_user_name
- status
- time
silence: not_evidence_of_absence
source: hb_auth_signin
verified: dry-run
verified_at: '2026-09-20'
~~~
SELECT src_endpoint_ip, dst_endpoint_name, actor_user_name, status, time FROM hb_auth_signin WHERE instr(',' || '{{appliance_ips}}' || ',', ',' || src_endpoint_ip || ',') > 0 AND NOT (instr(',' || '{{service_accounts}}' || ',', ',' || LOWER(actor_user_name) || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days')
```

## intrusion-depth-analysis
<!-- Analyze intrusion depth -->
```agent target=hunter
cite: required
context:
- exploitation-analysis
- webshell-prevalence-search
- fingerprint-search
- lateral-movement-auth
max_iterations: 4
objective: Determine if the adversary progressed from initial appliance exploitation
  to establishing persistence via rare API endpoints and performing lateral authentication.
success_criteria: A final verdict of malicious per host, citing the relationship between
  the bypass, the database shell execution, and the follow-on lateral indicators.
tools:
- endpoint
- identity
- web
```

## route-on-verdict
<!-- Route on intrusion verdict -->
if~: "The intrusion-depth-analysis verdict is malicious for at least one appliance host." (confidence: high, judge=hunter)
then: → isolate-appliance
indeterminate: → remediation-verification
unavailable: → remediation-verification (blind_spot: limited-edge-telemetry)
else: → hunt-close-out

## isolate-appliance
<!-- Isolate compromised appliance -->
```action target=endpoint
~~~yaml
approval: required
~~~
Isolate the compromised SonicWall appliance from the network. Revoke all administrative and service account credentials found within the appliance configuration, particularly LDAP/AD synchronization accounts.
```
→ remediation-verification

## remediation-verification
<!-- Forensic and remediation verification -->
```manual target=analyst
Audit the Nginx configuration for unauthorized rewrite rules mapping to /__api__/. Confirm the deletion of /usr/lib/python3.11/site-packages/deploy_new.py. Verify that firmware version 12.4.3-03453 or 12.5.0-02835 is installed across all SMA appliances.
```
→ hunt-close-out

## hunt-close-out
<!-- Close out hunt -->
```manual target=analyst
Document all observed indicators and compromised hosts. If evidence of lateral movement was found, escalate to the IR team for full internal investigation of the targeted directory services.
```
→ end