The campaign exploited CVE-2026-15409, a critical SSRF vulnerability in SonicWall SMA1000 WorkPlace interface, disclosed on July 14, 2026, with a CVSS score of 10. The attacker used a modified Rapid7 proof-of-concept exploit to tunnel Erlang distribution protocol commands through a WebSocket proxy, authenticating with a hard-coded Erlang cookie to achieve OS command execution on the appliance. Post-exploitation scripts extracted LDAP configuration files and decrypted stored passwords, enabling access to internal Active Directory environments. A standalone Linux build of Impacket's secretsdump was deployed on compromised appliances to remotely extract SAM and LSA secrets from Windows systems. The attacker successfully performed DCSync attacks against seven domain controllers across five environments, exposing thousands of AD account records. The campaign affected at least 250 targets, spanning 160 AD domains and 255 internal LDAP endpoints, with victims in multiple countries including confirmed impacts in France, India, Italy, and the US. Attribution remains open, though some scripts contained Chinese comments. The campaign was identified by Hunt.io researchers from an open directory exposed by the attacker, providing detailed telemetry and indicators of compromise.

The exploitation of CVE-2026-15409 allowed unauthenticated remote code execution on SonicWall SMA1000 appliances, leading to full credential theft campaigns against internal Active Directory environments. The attacker gained access to LDAP configurations and decrypted stored passwords, enabling lateral movement and extensive credential harvesting. The deployment of Impacket's secretsdump on appliances facilitated extraction of SAM and LSA secrets from Windows systems, and successful DCSync attacks against domain controllers exposed thousands of AD account records. This compromises the confidentiality and integrity of affected networks, potentially allowing persistent unauthorized access and further attacks. The campaign affected multiple countries and sectors, indicating a broad opportunistic threat.

SonicWall disclosed CVE-2026-15409 on July 14, 2026, assigning it a CVSS score of 10 and reporting active exploitation. Organizations using SonicWall SMA1000 appliances should apply the official patches provided by SonicWall immediately. Hunt.io notified relevant national CERTs and affected organizations ahead of public disclosure. Since the vulnerability enables unauthenticated remote code execution, patching is critical. Additionally, affected organizations should audit their SonicWall appliances for signs of compromise, review LDAP and Active Directory credentials, and monitor for unauthorized DCSync activity. No vendor advisory content was provided in the input, so patch status should be confirmed via SonicWall's official channels. The vendor manages remediation for this appliance; check SonicWall advisories for the latest updates and guidance.