Search: CVE-2026-15409

CVE-2026-15409 is a critical Server-Side Request Forgery (SSRF) vulnerability in the SonicWall SMA1000 Appliance Work Place interface. It allows a remote unauthenticated attacker to cause the appliance to make requests to unintended locations. The vulnerability affects specific versions of SMA1000 firmware. Exploitation can lead to complete compromise of confidentiality, integrity, and availability. Known exploits and ransomware campaigns have been reported leveraging this vulnerability.

Researchers uncovered an AI-driven intrusion ecosystem operated by affiliates of INC and The Gentlemen ransomware groups via seven exposed command-and-control servers. The operators integrated commercial AI models, exploited edge devices at scale, and compromised thousands of targets, primarily in the US industrial manufacturing and healthcare sectors. The infrastructure included multiple custom encryptor builds and evidence of active victim encryption. Operational security failures exposed source code, credentials, AI session logs, and victim data. The campaign demonstrates advanced ransomware-as-a-service operations leveraging AI and custom tooling.

Malware#simplehelp#phantom frameworkUnited States