Loading malware…
suo5 is an open-source HTTP tunneling proxy used in intrusions as a server-side proxy webshell and internal-network pivoting tool. It pairs an operator-side SOCKS5 proxy with code deployed on a compromised web server, encapsulating TCP traffic within HTTP or HTTPS connections. This allows operators to reach systems and subnets accessible from the compromised server but not directly reachable from the internet. Server-side implementations support .NET and Java, with experimental PHP support.
The tool uses HTTP/1.1 chunked transfer encoding to maintain connections and transport encapsulated traffic. Its .NET implementation operates in half-duplex mode because of HTTP request-processing limitations. Client access can be gated by configurable HTTP header values. The client uses the Go uTLS library to randomize TLS ClientHello characteristics, complicating network fingerprinting.
suo5 has been deployed on Microsoft Exchange servers following Ivanti Cloud Services Appliance compromises and has been used by the Houken intrusion set. It has also been deployed as an in-memory servlet filter on compromised PaperCut servers alongside Godzilla webshells. In SonicWall SMA 1000 intrusions attributed to UTA0533, a modified Java version was injected into a legitimate appliance JVM by the KNUCKLEBALL loader alongside the ORANGETAIL webshell. These deployments provide covert forwarding and support post-exploitation access and internal pivoting; credential theft and command execution performed by accompanying tools are not inherent suo5 capabilities.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
4 CVEs Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.
CVE-2026-82078 – An authenticated remote code execution vulnerability due to PaperCut NG / MF’s external user-lookup database connector, which allows an attacker with configuration access (via CVE-2026-81578) to load and execute Java bytecode via a crafted JDBC connection URL, achieving code execution. | suo5 is another public and open-source HTTP tunneling proxy. It provides an attacker with the ability to route traffic from the internet through PaperCut towards the internal network.
CVE-2026-81578 – An authentication bypass vulnerability due to PaperCut NG / MF’s use of the Apache Tapestry web framework, allowing an unauthenticated, external attacker to forge a URL that invokes sensitive administrative functionality (like ConfigEditor). | suo5 is another public and open-source HTTP tunneling proxy. It provides an attacker with the ability to route traffic from the internet through PaperCut towards the internal network.
“CVE-2026-15410 — CVSS 7.2. A path-traversal flaw in the remove_hotfix workflow of ctrl-service, abused to escalate from a low-privilege service account to root.” Investigators reportedly recovered an encoded exploit at /tmp/hypdate.b64 on compromised appliances.
“CVE-2026-15409 — CVSS 10.0. A pre-authentication /wsproxy bypass allowing an unauthenticated external attacker to open a WebSocket tunnel to services intended to be accessible only from localhost.” The report states that UTA0533 chained this vulnerability with CVE-2026-15410 beginning June 22, 2026, before disclosure.
4 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
Suo5 is a modified version of the open-source HTTP forwarding proxy designed to provide covert tunneling through the compromised appliance.
while the second type is Suo5, which supports tunneling functionality.
19 distinct techniques documented for this family, organized by ATT&CK tactic.
SonicWall has disclosed two vulnerabilities affecting SMA 1000 Series secure remote access appliances... which can be chained by an unauthenticated remote attacker to achieve root-level remote code execution. SonicWall has confirmed both vulnerabilities were actively exploited in the wild as zero-days before a patch existed.
This malware injected Java payloads into a legitimate SonicWall process and achieved persistence by modifying a startup script.
KNUCKLEBALL is the primary malware loader responsible for deploying the remaining implants. Instead of dropping standalone malware, it injects malicious Java agents directly into the legitimate SonicWall JVM using the Java Attach API.
Godzilla ASPX, r57, suo5... several webshell and tunnel relays running Godzilla ASPX, suo5, r57, reGeorg, and Neo-reGeorg.
Persistence artefacts /etc/init.d/workplace /var/lib/unit/conf.json Modified files used for persistence and route hijacking
altered startup and routing settings helped implants survive restarts
The latter injected two hidden Java components directly into a legitimate running SonicWall process, to keep the malware in memory.
The attacks are suspected to involve the exploitation of CVE-2026-15409 and CVE-2026-15410, which could be chained to facilitate arbitrary command execution and take over susceptible devices.
Persistence artefacts /etc/init.d/workplace /var/lib/unit/conf.json Modified files used for persistence and route hijacking
altered startup and routing settings helped implants survive restarts
The attacker exploits CVE-2026-15410, a path-traversal flaw in the removehotfix process, causing a staged script to execute with full root privileges.
The latter injected two hidden Java components directly into a legitimate running SonicWall process, to keep the malware in memory.
This malware injected Java payloads into a legitimate SonicWall process and achieved persistence by modifying a startup script.
KNUCKLEBALL is the primary malware loader responsible for deploying the remaining implants. Instead of dropping standalone malware, it injects malicious Java agents directly into the legitimate SonicWall JVM using the Java Attach API.
With root access, the threat actor could access stored or cached credentials, capture network traffic, and potentially intercept credentials processed by the appliances.
With root access, the threat actor could access stored or cached credentials, capture network traffic, and potentially intercept credentials processed by the appliances.
With root access, the threat actor could access stored or cached credentials, capture network traffic, and potentially intercept credentials processed by the appliances.
port-forwarding/proxy tunneling tool used to relay traffic through compromised hosts
CVE-2026-15409 carries a CVSS 10.0 score and involves a pre-authentication /wsproxy bypass that allows an unauthenticated external request to establish a WebSocket tunnel to localhost-only services on the appliance.
Using a tool like proxychains, the attacker can then communicate with any system accessible by the Exchange Server. This enables him to get a foothold inside the internal network of the victim.
Godzilla webshell and suo5 SOCKS tunnel established.
GlassFish : scripts Node.js déployant des WAR shells ... via SOCKS5 proxy local (127.0.0.1:1111)
Multi-hop Proxy proxychains-ng across 80+ proxies.
They planted an HTTP proxy tunnel going by the name of suo5... The suo5.aspx webshell was dropped on the Exchange Server... a SOCKS5 proxy must be set up and the suo5 binary communicates with the server-side code to transmit TCP data encapsulated in the HTTP(S) communication.
After the front-end accepts the request, a WebSocket tunnel is created. The attacker directs the tunnel to internal services bound to localhost, bypassing the network-layer isolation that normally protects them.
37 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Other indicator types observed in public reporting.
23 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A tunneling and proxying tool used to relay traffic through compromised systems and support covert access or exfiltration.
SOCKS tunneling tool used to proxy attacker traffic through the compromised environment.
Open-source HTTP tunneling tool weaponized in this intrusion to turn a compromised PaperCut server into a proxy for accessing the internal network. Attackers deployed it alongside Godzilla through the PaperCut vulnerability chain, registering it as an in-memory Jetty servlet filter. It intercepted requests carrying specific HTTP Referer values and persisted until the PaperCut service restarted. Its deployment suggested an intention to move beyond the server, although subsequent internal lateral movement was not demonstrated in the captured activity.
Open-source HTTP proxy launched during the attacks as part of post-exploitation activity.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.