UK Council Attack Linked to Mass Exploitation of SonicWall Flaw
Hunt.io links a UK council attack to mass exploitation of SonicWall SMA1000 flaw CVE-2026-15409 (CVSS 10.0), enabling credential and Active Directory theft.
Hunt.io links, with moderate confidence, the July 17, 2026 attack on the Borough Council of King's Lynn and West Norfolk to mass exploitation of SonicWall SMA1000 appliances via CVE-2026-15409, an unauthenticated SSRF in the WorkPlace portal WebSocket proxy with CVSS 10.0. The operator adapted Rapid7's July 15 PoC into a 50-thread mass scanner within days and stole LDAP credentials for 534 Active Directory accounts across 160 domains, with nine environments losing SAM/LSA secrets and five losing full AD databases via DCSync. CISA added the flaw to its Known Exploited Vulnerabilities catalog and noted use in ransomware campaigns; targeting of ~200,000 Shodan-derived SonicWall addresses spanned government, healthcare, finance, universities, and manufacturing worldwide.
- CVE-2026-15409 is an unauthenticated SSRF in the WorkPlace portal WebSocket proxy, CVSS 10.0.
- Active exploitation was observed before SonicWall's July 14 advisory; mass scanning followed within days.
- Operator deployed a standalone Linux Impacket secretsdump on appliances to evade EDR and SIEM visibility.
- A fixed AES key in ASAPPasswordUtil decrypts LDAP credentials on every vulnerable SMA1000 device.
- LSA secrets of domain controller machine accounts enabled pass-the-hash DCSync in five environments.
- CVEs
- CVE-2026-15409
- ATT&CK
- T1190 Exploit Public-Facing ApplicationT1552.001 Credentials in FilesT1003.006 DCSyncT1550.002 Pass the Hash
- Vendors
- SonicWall
- Products
- SonicWall SMA1000
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-15409 | Unauthenticated SSRF in SonicWall SMA1000 Appliances | 10.0 | 7% | KEVRansomwarePoC | KEV |
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| ipv4 | 95.181.173.36 | tackCapture system crawled the attacker’s open directory at 95.181.173[.]36 on July 17, the same day the council announced its incide |
| sha256 | 690f5031deede7d3357d0ca24c89866ae8c60e6c63b3a2c8bba813a6ac10ae5b | ts. The SHA-256 of the Impacket binary the operator used is 690f5031deede7d3357d0ca24c89866ae8c60e6c63b3a2c8bba813a6ac10ae5b , and the delivery IP was 95.181.173[.]36. The operator ran |
From the original article
5 min read at securityaffairs.com
A critical SonicWall flaw was rapidly weaponized, with a UK Council attack linked to a campaign that exposed credentials and enabled Active Directory theft. On July 17, 2026, the Borough Council of King’s Lynn and West Norfolk announced it had detected a cyberattack affecting council services. Hunt.
By Pierluigi Paganini · securityaffairs.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.