suo5

SonicWall has disclosed two vulnerabilities affecting SMA 1000 Series secure remote access appliances... which can be chained by an unauthenticated remote attacker to achieve root-level remote code execution. SonicWall has confirmed both vulnerabilities were actively exploited in the wild as zero-days before a patch existed.

This malware injected Java payloads into a legitimate SonicWall process and achieved persistence by modifying a startup script.

KNUCKLEBALL is the primary malware loader responsible for deploying the remaining implants. Instead of dropping standalone malware, it injects malicious Java agents directly into the legitimate SonicWall JVM using the Java Attach API.

Godzilla ASPX, r57, suo5... several webshell and tunnel relays running Godzilla ASPX, suo5, r57, reGeorg, and Neo-reGeorg.

Persistence artefacts /etc/init.d/workplace /var/lib/unit/conf.json Modified files used for persistence and route hijacking

altered startup and routing settings helped implants survive restarts

The latter injected two hidden Java components directly into a legitimate running SonicWall process, to keep the malware in memory.

The attacks are suspected to involve the exploitation of CVE-2026-15409 and CVE-2026-15410, which could be chained to facilitate arbitrary command execution and take over susceptible devices.

Persistence artefacts /etc/init.d/workplace /var/lib/unit/conf.json Modified files used for persistence and route hijacking

altered startup and routing settings helped implants survive restarts

The attacker exploits CVE-2026-15410, a path-traversal flaw in the removehotfix process, causing a staged script to execute with full root privileges.

The latter injected two hidden Java components directly into a legitimate running SonicWall process, to keep the malware in memory.

This malware injected Java payloads into a legitimate SonicWall process and achieved persistence by modifying a startup script.

KNUCKLEBALL is the primary malware loader responsible for deploying the remaining implants. Instead of dropping standalone malware, it injects malicious Java agents directly into the legitimate SonicWall JVM using the Java Attach API.

With root access, the threat actor could access stored or cached credentials, capture network traffic, and potentially intercept credentials processed by the appliances.

With root access, the threat actor could access stored or cached credentials, capture network traffic, and potentially intercept credentials processed by the appliances.

With root access, the threat actor could access stored or cached credentials, capture network traffic, and potentially intercept credentials processed by the appliances.

port-forwarding/proxy tunneling tool used to relay traffic through compromised hosts

CVE-2026-15409 carries a CVSS 10.0 score and involves a pre-authentication /wsproxy bypass that allows an unauthenticated external request to establish a WebSocket tunnel to localhost-only services on the appliance.

Using a tool like proxychains, the attacker can then communicate with any system accessible by the Exchange Server. This enables him to get a foothold inside the internal network of the victim.

Godzilla webshell and suo5 SOCKS tunnel established.

GlassFish : scripts Node.js déployant des WAR shells ... via SOCKS5 proxy local (127.0.0.1:1111)

Multi-hop Proxy proxychains-ng across 80+ proxies.

They planted an HTTP proxy tunnel going by the name of suo5... The suo5.aspx webshell was dropped on the Exchange Server... a SOCKS5 proxy must be set up and the suo5 binary communicates with the server-side code to transmit TCP data encapsulated in the HTTP(S) communication.

After the front-end accepts the request, a WebSocket tunnel is created. The attacker directs the tunnel to internal services bound to localhost, bypassing the network-layer isolation that normally protects them.