Operation KNUCKLEBALL: UTA0533 Exploits Critical SonicWall Zero-Days for Root Access

Executive Summary Operation KNUCKLEBALL represents a sophisticated exploitation campaign targeting the edge of the corporate network. Security researchers at Rapid7 identified active exploitation of two zero-day vulnerabilities in the SonicWall Secure Mobile Access (SMA) 1000 series appliances. The vulnerability chain allows an unauthenticated attacker to bypass security boundaries and achieve full root-level control over the device. This activity has been attributed to a newly tracked group, UTA0533, which demonstrates high technical proficiency in targeting network infrastructure. ## Threat Analysis The threat analysis reveals that UTA0533 is primarily focused on long-term persistent access. By compromising the VPN gateway, the actor gains a unique vantage point to intercept decrypted network traffic, harvest user credentials, and facilitate lateral movement into the internal network. This campaign is particularly concerning because the SMA 1000 series is commonly used by large enterprises and government organizations to facilitate remote work, making it a high-value target for state-sponsored espionage or sophisticated cybercriminal activity. ## Technical Details Technical details indicate the attack begins with CVE-2026-15409, a critical Server-Side Request Forgery (SSRF) vulnerability with a CVSS score of 10.0. This flaw allows an attacker to open a WebSocket-based tunnel to internal localhost-only services. Once this bridge is established, the attacker exploits CVE-2026-15410, a command injection vulnerability in the Appliance Management Console (AMC). Specifically, the injection occurs within the 'remove_hotfix' workflow on port 8188. Success results in root shell access. Following exploitation, UTA0533 deploys 'KNUCKLEBALL', a custom loader that resides in memory to evade detection. KNUCKLEBALL is then used to inject 'Suo5', a common proxy tool, and 'ORANGETAIL', a bespoke webshell that enables persistent remote management and LDAP credential sniffing. ## Attribution Assessment Attribution for UTA0533 remains ongoing. While the tools used, such as the Suo5 proxy, have been seen in previous campaigns by various actors, the custom KNUCKLEBALL and ORANGETAIL components are unique to this cluster. The speed at which the zero-days were weaponized suggests a well-resourced actor with significant experience in reverse-engineering proprietary hardware firmware. Current assessments lean toward a nation-state nexus, although a definitive link to a known APT has not yet been established. ## Implications The implications of this campaign are severe. As these devices sit at the network perimeter, compromise effectively nullifies the traditional trust boundary. Organizations using affected appliances (SMA 6210, 7210, and 8200v) are at immediate risk of full-scale data breach. The use of memory-resident loaders and custom webshells significantly complicates incident response and forensic analysis, as traditional file system scans may fail to detect the intrusion. ## Recommendations Recommendations for immediate mitigation include upgrading to patched firmware versions 12.4.3-03453 or 12.5.0-02835. CISA has added these vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog. Beyond patching, organizations should conduct thorough forensic reviews of their SMA logs, looking for unauthorized connections to port 8188 and evidence of WebSocket tunnels. It is also recommended to reset all credentials that may have traversed the VPN appliance and to enforce hardware-based MFA for all administrative interfaces.