Loading malware…
ROOTRUN is a Linux privilege-escalation backdoor deployed on compromised SonicWall Secure Mobile Access (SMA) 1000 series VPN appliances. Implemented as a malicious setuid ELF executable, it allows an unprivileged local user to execute arbitrary commands with root privileges. It uses setuid() to elevate privileges and executes attacker-supplied commands through Bash, providing a persistent means of regaining privileged execution after an initial compromise.
The threat actor tracked as UTA0533 deployed ROOTRUN during attacks observed from June 22, 2026. The actor first obtained root access by chaining CVE-2026-15409, a pre-authentication server-side request forgery vulnerability exposing appliance-local services, with CVE-2026-15410, a path-traversal and command-execution vulnerability in the hotfix-removal workflow. ROOTRUN was installed after this initial root compromise rather than serving as the initial exploitation mechanism. It appeared alongside the KNUCKLEBALL loader, Suo5 proxy, and ORANGETAIL webshell in the actor's appliance-focused post-exploitation toolkit.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
2 CVEs Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.
In July, threat actors spent weeks exploiting two SMA1000 zero-days, CVE-2026-15409 and CVE-2026-15410, to plant custom malware families called Sou5, OrangeTail, and RootRun on compromised appliances.
In July, threat actors spent weeks exploiting two SMA1000 zero-days, CVE-2026-15409 and CVE-2026-15410, to plant custom malware families called Sou5, OrangeTail, and RootRun on compromised appliances.
1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
The researchers also found that the attackers modified the appliance's nginx configuration to expose the ORANGETAIL webshell remotely and installed ROOTRUN, a privilege-escalation tool that allows commands to be executed as root.
12 distinct techniques documented for this family, organized by ATT&CK tactic.
SonicWall has disclosed two vulnerabilities affecting SMA 1000 Series secure remote access appliances... which can be chained by an unauthenticated remote attacker to achieve root-level remote code execution. SonicWall has confirmed both vulnerabilities were actively exploited in the wild as zero-days before a patch existed.
The attack chain allowed the threat actor to compromise vulnerable SonicWall SMA VPN appliances, access localhost-only services, execute commands, escalate privileges, deploy malware, modify configuration files, and gain root-level access.
Because remove_hotfix runs as root, the attacker’s script executes with full privileges, typically followed by an immediate reboot.
ROOTRUN (setuid binary) Persistence / Privilege Escalation Tool Malicious setuid binary enabling root access
Persistence artefacts /etc/init.d/workplace /var/lib/unit/conf.json Modified files used for persistence and route hijacking
altered startup and routing settings helped implants survive restarts
The second can turn a low-privilege foothold into root control by causing a staged script to run with full system rights.
Persistence artefacts /etc/init.d/workplace /var/lib/unit/conf.json Modified files used for persistence and route hijacking
altered startup and routing settings helped implants survive restarts
A setuid binary named ROOTRUN handled privilege escalation.
On the first appliance, UTA0533 wrote a setuid binary called ROOTRUN to /usr/bin/xzfind, which allows an unprivileged user to run arbitrary commands as root.
The attacker exploits CVE-2026-15410, a path-traversal flaw in the removehotfix process, causing a staged script to execute with full root privileges.
ROOTRUN (setuid binary) Persistence / Privilege Escalation Tool Malicious setuid binary enabling root access
CVE-2026-15409 carries a CVSS 10.0 score and involves a pre-authentication /wsproxy bypass that allows an unauthenticated external request to establish a WebSocket tunnel to localhost-only services on the appliance.
Volexity later revealed that a threat actor tracked as UTA0533 began exploiting the vulnerabilities as early as June 22 (weeks before SonicWall publicly disclosed the flaws) to deploy custom malware known as KNUCKLEBALL, Sou5, ROOTRUN, and ORANGETAIL on vulnerable VPN appliances.
28 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Other indicator types observed in public reporting.
18 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Custom malware deployed on compromised SonicWall SMA1000 appliances during July 2026 zero-day exploitation. The content does not describe its capabilities or connect it to the current October exploitation attempts.
Custom malware installed on vulnerable SonicWall SMA1000 VPN appliances during earlier zero-day attacks. Its capabilities are not described; it is mentioned as historical background, not linked to the current CVE-2026-102255 exploitation attempts.
Custom malware deployed on vulnerable SonicWall SMA1000 VPN appliances following exploitation of CVE-2026-15409 and CVE-2026-15410.
A malicious setuid binary deployed after root compromise to provide privileged execution and persistence on compromised SonicWall SMA appliances.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.