Loading malware…
KNUCKLEBALL is a Python-based malware loader used by the threat actor UTA0533 on compromised SonicWall Secure Mobile Access (SMA) 1000 VPN appliances. It was observed in a campaign beginning in June 2026 in which attackers chained CVE-2026-15409 and CVE-2026-15410 as zero-days to obtain root-level access before installing appliance-specific malware. Its operating environment is the Linux-based SMA 1000 platform.
KNUCKLEBALL contains two embedded JAR payloads and uses the Java Attach API to inject malicious Java agents into a legitimate running SonicWall JVM. These payloads comprise a modified Suo5 HTTP proxy for covert tunneling and access to internal resources, and ORANGETAIL, a custom memory-resident Java web shell capable of executing attacker-supplied Java payloads. Loading the implants into a legitimate process conceals their execution within the appliance's application environment. KNUCKLEBALL establishes persistence through modification of an appliance startup script. Associated deployment activity also alters NGINX Unit routing configuration to make the implanted functionality remotely accessible through the appliance's web interface.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
2 CVEs Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.
The attackers first exploited CVE-2026-15409 to abuse the SMA1000's '/wsproxy' endpoint, allowing them to establish unauthenticated WebSocket tunnels to services that should only have been accessible from the appliance itself.
After obtaining the appliance's product_uuid, the attackers exploited the CVE-2026-15410 command injection vulnerability through the Appliance Management Console's 'sysCtrl.execRemoveHotfix' RPC method, allowing them to execute commands as root and take full control of the appliance.
1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
With root access, UTA0533 installed a custom malware dropper that Volexity calls KNUCKLEBALL under the file name 'deploy_new.py'.
20 distinct techniques documented for this family, organized by ATT&CK tactic.
The campaign mass-exploited SonicWall SMA1000 appliances using CVE-2026-15409, an unauthenticated SSRF flaw in the WorkPlace portal WebSocket proxy.
attackers used the appliance's embedded CouchDB service — which ships with hard-coded default credentials — to stage a script and trigger the path-traversal flaw. This allowed root command execution without any valid SMA administrator credentials.
Execution (T1059.004, Unix Shell): через AMC отправляется payload с code injection (CVE-2026-15410), выполняющий произвольные OS-команды на Linux-based ОС SMA1000.
The threat actor, which Volexity tracks as UTA0533, chained two vulnerabilities to achieve root-level access on the devices before patches existed. UTA0533 had exploited to deploy a malicious Python script named KNUCKLEBALL.
This malware injected Java payloads into a legitimate SonicWall process and achieved persistence by modifying a startup script.
KNUCKLEBALL is the primary malware loader responsible for deploying the remaining implants. Instead of dropping standalone malware, it injects malicious Java agents directly into the legitimate SonicWall JVM using the Java Attach API.
Appends python3 /usr/lib/python3.11/site-packages/deploy_new.py to /etc/init.d/workplace for startup persistence.
With root access, the operators deployed a durable backdoor, a covert forwarding tool and a memory-based web shell.
With root access, the attacker deploys a durable backdoor (ROOTRUN), a covert forwarding tool (Suo5), and a memory-resident web shell (ORANGETAIL/KNUCKLEBALL loader)
Deploy persistence: The attacker modifies startup scripts and configuration files to keep access after restart.
altered startup and routing settings helped implants survive restarts
The attackers altered the NGINX Unit configuration to redirect requests from /api/login and /api/logout to the hidden implants.
Appends python3 /usr/lib/python3.11/site-packages/deploy_new.py to /etc/init.d/workplace for startup persistence.
The latter injected two hidden Java components directly into a legitimate running SonicWall process, to keep the malware in memory.
The attacks are suspected to involve the exploitation of CVE-2026-15409 and CVE-2026-15410, which could be chained to facilitate arbitrary command execution and take over susceptible devices.
Deploy persistence: The attacker modifies startup scripts and configuration files to keep access after restart.
altered startup and routing settings helped implants survive restarts
The attacker exploits CVE-2026-15410, a path-traversal flaw in the removehotfix process, causing a staged script to execute with full root privileges.
The latter injected two hidden Java components directly into a legitimate running SonicWall process, to keep the malware in memory.
This malware injected Java payloads into a legitimate SonicWall process and achieved persistence by modifying a startup script.
KNUCKLEBALL is the primary malware loader responsible for deploying the remaining implants. Instead of dropping standalone malware, it injects malicious Java agents directly into the legitimate SonicWall JVM using the Java Attach API.
The attackers altered the NGINX Unit configuration to redirect requests from /api/login and /api/logout to the hidden implants.
With root access, the threat actor could access stored or cached credentials, capture network traffic, and potentially intercept credentials processed by the appliances.
The attackers altered the NGINX Unit configuration to redirect requests from /api/login and /api/logout to the hidden implants.
With root access, the threat actor could access stored or cached credentials, capture network traffic, and potentially intercept credentials processed by the appliances.
With root access, the threat actor could access stored or cached credentials, capture network traffic, and potentially intercept credentials processed by the appliances.
CVE-2026-15409 carries a CVSS 10.0 score and involves a pre-authentication /wsproxy bypass that allows an unauthenticated external request to establish a WebSocket tunnel to localhost-only services on the appliance.
The attacks involve the deployment of a Python script named KNUCKLEBALL that's used to launch Suo5, an open-source HTTP proxy
Volexity later revealed that a threat actor tracked as UTA0533 began exploiting the vulnerabilities as early as June 22 (weeks before SonicWall publicly disclosed the flaws) to deploy custom malware known as KNUCKLEBALL, Sou5, ROOTRUN, and ORANGETAIL on vulnerable VPN appliances.
29 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Other indicator types observed in public reporting.
22 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Malware deployed by UTA0533 through exploitation of SonicWall SMA 1000 vulnerabilities in June 2026. It appears as historical background to the current exploitation of CVE-2026-102255; the content does not describe its capabilities or connect it to exploitation of that newer vulnerability.
Malware reportedly deployed by UTA0533 through exploitation of the SonicWall SMA1000 vulnerability.
KNUCKLEBALL is mentioned only as malware associated with a separate, earlier July 2026 SonicWall SMA 1000 exploitation campaign.
A malicious Python script deployed by UTA0533 after the actor chained zero-day vulnerabilities in SonicWall SMA 1000 VPN appliances to obtain root-level access.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.