Loading threat actor…
UTA0533 is a previously undocumented and currently unattributed threat cluster associated with pre-disclosure exploitation of SonicWall SMA 1000 series secure remote access appliances in 2026. The actor was observed exploiting a zero-day chain involving CVE-2026-15409 and CVE-2026-15410 as early as June 22, 2026, weeks before public disclosure, to obtain root-level access on targeted appliances. The intrusion chain exposed localhost-only services through the SMA 1000 web interface and then abused privileged appliance functionality to achieve command execution and privilege escalation to root. Post-compromise activity included deployment of appliance-specific malware and persistence mechanisms, notably KNUCKLEBALL, ROOTRUN, ORANGETAIL, and Suo5 or Sou5. KNUCKLEBALL functioned as a Python-based loader that injected Java payloads into legitimate SonicWall processes. ORANGETAIL was a custom Behinder-like Java web shell, while Suo5 provided proxying and tunneling capability. ROOTRUN was used to enable privileged command execution. The actor also modified startup and web-routing configuration to preserve access across reboots and conceal malicious functionality. Observed objectives included credential harvesting, traffic capture, and attempted pivoting from compromised edge appliances into internal enterprise systems. Investigators observed collection of unencrypted LDAP credentials, harvesting of credentials from compromised appliances, deployment of malicious files, and attempts at lateral movement, although available evidence indicates the actor was less successful in broader internal compromise than in appliance exploitation itself. Root access to the appliances would also have enabled access to stored or cached credentials and interception of authentication material processed by the devices. UTA0533 has not been publicly linked at high confidence to a known named intrusion set or a specific country. Reporting noted tactical overlap between this activity and later ransomware exploitation of the same SonicWall vulnerability chain, including overlap with activity later associated with INC Ransomware, but UTA0533 itself remains an unattributed cluster rather than a confirmed nation-state or criminal brand.
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Who, where, and (when attributed) which flag flies behind the operation. Pulled from open-source reporting and Mallory's analyst review.
Sectors the actor has been observed targeting.
29 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
6 malware families attributed to this actor across reporting.
1 additional family tracked in Mallory.
2 CVEs this actor has used in observed campaigns. 2 of them exploited in the wild.
The U.S. Cybersecurity and Infrastructure Security Agency warned that two SonicWall SMA1000 vulnerabilities, CVE-2026-15409 and CVE-2026-15410, are being exploited in ransomware attacks and have been added to its KEV catalog. CVE-2026-15409 is the most serious issue. It is a server-side request forgery vulnerability in the SMA1000 Workplace interface, with a CVSS severity score of 10.0.
The second flaw, CVE-2026-15410, is an improper code-generation issue, also described as code injection, in the SMA1000 Appliance Management Console. It carries a CVSS score of 7.2 and can allow an authenticated administrator to execute arbitrary operating-system commands under certain conditions.
33 indicators attributed to this actor: domains, IPs, hashes, and other artifacts pulled from reporting. View more in app.
15 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Earlier exploitation activity targeting the same SonicWall SMA1000 vulnerability chain was linked to this cluster.
Exploited SonicWall SMA1000 vulnerabilities CVE-2026-15409 and CVE-2026-15410 as early as June 22 to deploy custom malware on vulnerable VPN appliances.
Tracking designation used for the actor observed pre-disclosure exploiting the two SonicWall SMA 1000 vulnerabilities in a chain to obtain root access; the reporting indicates overlap with and likely relation to INC's later dominant exploitation.
Threat cluster attributed with pre-disclosure exploitation of the SonicWall SMA 1000 vulnerabilities; the campaign overlaps technically with later activity associated with INC.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.