Loading malware…
ORANGETAIL is a custom, memory-resident Java webshell modeled after Behinder 3.x and tailored to SonicWall SMA 1000 secure remote access appliances. It accepts encrypted Java payloads from attackers and dynamically executes them within an HTTP session, enabling remote command execution and file transfer. Its communications use AES-128-ECB encryption. The webshell responds only to requests containing a specific, nonstandard browser User-Agent string and otherwise returns a normal-looking HTTP 404 response to conceal its presence.
ORANGETAIL is associated with the threat cluster UTA0533, whose exploitation of SonicWall SMA 1000 appliances was observed beginning June 22, 2026. The attackers chained CVE-2026-15409 and CVE-2026-15410 to obtain root-level access before deploying their malware toolkit. The Python-based KNUCKLEBALL loader injected ORANGETAIL and the Suo5 HTTP proxy into a legitimate SonicWall Java process. Attackers modified the appliance's web-routing configuration to expose the implants through inconspicuous routes and altered startup configuration to support redeployment after reboot. ORANGETAIL provided remote code execution, while the separate Suo5 component supplied traffic tunneling. The targeted appliances included physical and virtual SMA 1000 VPN gateways running Linux.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
2 CVEs Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.
The attackers first exploited CVE-2026-15409 to abuse the SMA1000's '/wsproxy' endpoint, allowing them to establish unauthenticated WebSocket tunnels to services that should only have been accessible from the appliance itself.
After obtaining the appliance's product_uuid, the attackers exploited the CVE-2026-15410 command injection vulnerability through the Appliance Management Console's 'sysCtrl.execRemoveHotfix' RPC method, allowing them to execute commands as root and take full control of the appliance.
1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
ORANGETAIL is a custom Java webshell that allows attackers to send encrypted Java payloads to the compromised appliance and dynamically execute them within an HTTP session.
17 distinct techniques documented for this family, organized by ATT&CK tactic.
SonicWall has disclosed two vulnerabilities affecting SMA 1000 Series secure remote access appliances... which can be chained by an unauthenticated remote attacker to achieve root-level remote code execution. SonicWall has confirmed both vulnerabilities were actively exploited in the wild as zero-days before a patch existed.
Execution (T1059.004, Unix Shell): через AMC отправляется payload с code injection (CVE-2026-15410), выполняющий произвольные OS-команды на Linux-based ОС SMA1000.
This malware injected Java payloads into a legitimate SonicWall process and achieved persistence by modifying a startup script.
KNUCKLEBALL is the primary malware loader responsible for deploying the remaining implants. Instead of dropping standalone malware, it injects malicious Java agents directly into the legitimate SonicWall JVM using the Java Attach API.
Gating user-agent Mozilla/6.0 ... User-agent required to activate implanted components
With root access, the operators deployed a durable backdoor, a covert forwarding tool and a memory-based web shell.
Host a persistent, appliance-specific webshell that survives casual inspection... Malware File... ORANGETAIL (webshell) agent_wp9.jar
Persistence artefacts /etc/init.d/workplace /var/lib/unit/conf.json Modified files used for persistence and route hijacking
altered startup and routing settings helped implants survive restarts
The attackers altered the NGINX Unit configuration to redirect requests from /api/login and /api/logout to the hidden implants.
The latter injected two hidden Java components directly into a legitimate running SonicWall process, to keep the malware in memory.
The attacks are suspected to involve the exploitation of CVE-2026-15409 and CVE-2026-15410, which could be chained to facilitate arbitrary command execution and take over susceptible devices.
Persistence artefacts /etc/init.d/workplace /var/lib/unit/conf.json Modified files used for persistence and route hijacking
altered startup and routing settings helped implants survive restarts
The attacker exploits CVE-2026-15410, a path-traversal flaw in the removehotfix process, causing a staged script to execute with full root privileges.
The latter injected two hidden Java components directly into a legitimate running SonicWall process, to keep the malware in memory.
Gating user-agent Mozilla/6.0 ... User-agent required to activate implanted components
This malware injected Java payloads into a legitimate SonicWall process and achieved persistence by modifying a startup script.
KNUCKLEBALL is the primary malware loader responsible for deploying the remaining implants. Instead of dropping standalone malware, it injects malicious Java agents directly into the legitimate SonicWall JVM using the Java Attach API.
The attackers altered the NGINX Unit configuration to redirect requests from /api/login and /api/logout to the hidden implants.
With root access, the threat actor could access stored or cached credentials, capture network traffic, and potentially intercept credentials processed by the appliances.
The attackers altered the NGINX Unit configuration to redirect requests from /api/login and /api/logout to the hidden implants.
With root access, the threat actor could access stored or cached credentials, capture network traffic, and potentially intercept credentials processed by the appliances.
With root access, the threat actor could access stored or cached credentials, capture network traffic, and potentially intercept credentials processed by the appliances.
CVE-2026-15409 carries a CVSS 10.0 score and involves a pre-authentication /wsproxy bypass that allows an unauthenticated external request to establish a WebSocket tunnel to localhost-only services on the appliance.
Volexity later revealed that a threat actor tracked as UTA0533 began exploiting the vulnerabilities as early as June 22 (weeks before SonicWall publicly disclosed the flaws) to deploy custom malware known as KNUCKLEBALL, Sou5, ROOTRUN, and ORANGETAIL on vulnerable VPN appliances.
Gating user-agent Mozilla/6.0 ... User-agent required to activate implanted components
33 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Other indicator types observed in public reporting.
21 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Custom malware deployed on compromised SonicWall SMA1000 appliances during July 2026 zero-day exploitation. The content does not describe its capabilities or connect it to the current October exploitation attempts.
Custom malware installed on vulnerable SonicWall SMA1000 VPN appliances during earlier zero-day attacks. Its capabilities are not described; it is mentioned as historical background, not linked to the current CVE-2026-102255 exploitation attempts.
Custom malware deployed on vulnerable SonicWall SMA1000 VPN appliances following exploitation of CVE-2026-15409 and CVE-2026-15410.
Custom Behinder-like Java web shell used in the SonicWall SMA exploitation campaign.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.