UK Council Cyberattack Tied to Mass Exploitation of Critical SonicWall Flaw

Council incident linked to a wider automated campaign

The cyberattack affecting the Borough Council of King’s Lynn and West Norfolk has been linked with moderate confidence to a large-scale campaign exploiting CVE-2026-15409 in SonicWall SMA1000 appliances.

The council publicly announced on July 17, 2026 that it had detected an attack disrupting council services. Hunt.io identified the incident and related attacker infrastructure on the same day. The precise impact on the council—including whether personal information or Active Directory data was stolen—has not been disclosed.

Evidence indicates that the council was probably caught in opportunistic scanning rather than selected specifically because it was a local government body. Recovered target inventories included nearly 200,000 addresses identified as SonicWall systems, spanning government, healthcare, finance, universities, manufacturing, law enforcement and managed IT providers.

The campaign moved quickly from exploitation to mass automation. Rapid7 published a proof of concept on July 15, 2026. By July 16, 2026, an operator had converted the technique into a scanner running 50 concurrent threads. Rapid7’s Managed Detection and Response team had already observed exploitation before SonicWall issued its July 14 advisory.

That left defenders with almost no buffer. Large-scale scanning followed within days of the earliest known malicious activity.

CVE-2026-15409 turns an SMA1000 appliance into a command platform

CVE-2026-15409 is a server-side request forgery vulnerability in the WebSocket proxy used by the SonicWall SMA1000 WorkPlace portal. It carries the maximum CVSS v3 score of 10, with the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H.

An attacker can exploit the flaw remotely without credentials or user interaction. The initial request targets the appliance’s /wsproxy endpoint and induces it to connect to an unintended destination.

The affected products and versions listed by the NVD are:

Product	Vulnerable version
SonicWall SMA6210	Firmware 12.4.3-03245
SonicWall SMA7210	Firmware 12.4.3-03245
SonicWall SMA8200v	12.4.3-03245

The NVD also contains SMA6210 and SMA7210 product entries whose version field is recorded as -. Fixed firmware begins with 12.4.3-03453, and operators should install that release or a later version.

The exploit sends the appliance back to its own TCP port 1050, which hosts a CouchDB-related Erlang service. A hardcoded cookie embedded in the firmware lets the attacker complete the Erlang connection and communicate with the [email protected] node.

Commands supplied through that connection execute on the underlying operating system with the privileges of the couchdb account. Although the chain requires several stages, scripts can complete it within seconds.

CISA added CVE-2026-15409 to its Known Exploited Vulnerabilities catalog on July 14, 2026. The remediation deadline for U.S. federal agencies was July 17, 2026, and the vulnerability is recorded as having been used in ransomware campaigns.

CISA requires mitigations consistent with vendor instructions, BOD 26-04 risk-based patching guidance and its Forensics Triage Requirements. Where mitigations are unavailable, applicable cloud guidance must be followed or use of the product discontinued.

Stolen appliance credentials opened a path into Active Directory

After gaining command execution, the operator examined /usr/local/extranet/etc/policy_file.xml, which can contain LDAP passwords stored by the appliance.

Those passwords were protected with AES encryption, but the required fixed 32-byte key was embedded in ASAPPasswordUtil.class. This design meant the attacker did not need a unique secret from each device. The same extracted key could decrypt stored LDAP credentials across vulnerable appliances.

The operator then downloaded a standalone Linux build of Impacket’s secretsdump to /tmp/secretsdump, using curl to retrieve it from attacker-controlled infrastructure. Running the utility directly on the SonicWall device provided access to internal Windows systems that the appliance could already reach legitimately.

Where LDAP credentials had sufficient privileges, they could be used directly against directory services. Where they did not, the attackers attempted to extract SAM and LSA secrets.

LSA data can expose the NTLM hash belonging to a domain controller’s machine account. Because domain controllers normally hold directory replication rights, the operator could use such a hash for pass-the-hash authentication and perform a DCSync operation.

Campaign scripts automated this process. They searched secretsdump output for account names ending in $, extracted associated hashes and launched DCSync requests through the compromised appliance. The technique succeeded in five environments.

In those cases, the attackers generated copies of the Active Directory NTDS database under /tmp on the SonicWall system. The files were then retrieved through the same command-execution channel.

A successful DCSync can expose directory credential material at scale. Consequently, rebuilding only the appliance would not remove the attacker’s access if hashes, passwords or authentication tokens had already been stolen.

Open attacker infrastructure revealed the campaign’s reach

Hunt.io found an unauthenticated HTTP directory on port 80 at 95.181.173[.]36. It contained scanning and exploit scripts, credential-processing tools, a standalone Impacket binary and output from active operations.

Recovered data documented 250 targeted appliances. Among them:

• 168 exposed LDAP configuration files containing credentials.
• Those files covered 534 Active Directory accounts across 160 domain names.
• The compromised configurations identified 255 internal LDAP server addresses.
• Nine environments lost SAM and LSA secrets.
• Five environments suffered full Active Directory replication through DCSync.
• Seven domain controllers were targeted by the DCSync activity.

Confirmed SAM and LSA theft affected environments in France, India, Italy and the United States. The wider inventory included gateways associated with organizations in the United Kingdom, Canada, Germany, Sweden, Poland, Hungary, South Korea and Hong Kong.

The King’s Lynn and West Norfolk case is therefore one part of an international operation rather than an isolated intrusion. However, moderate-confidence linkage does not establish that every documented post-exploitation action occurred in the council’s environment.

Attribution also remains unresolved. Chinese-language comments appeared throughout the recovered scripts, but that evidence is insufficient to identify the operator’s location, nationality or organizational affiliation.

Other actors have independently exploited the same vulnerability. The actor tracked as UTA0533 used it to deploy KNUCKLEBALL malware, while the INC ransomware group also employed the chain. There is no evidence that all exploitation activity originated from a single group.

An edge appliance can evade normal endpoint monitoring

The SonicWall device offered attackers more than initial access. It became an internal attack host positioned outside many organizations’ usual monitoring coverage.

Connections from a remote-access appliance to LDAP servers, Windows hosts or domain controllers can appear operationally plausible. When secretsdump runs on the appliance, there is no corresponding rogue process to identify on the targeted Windows endpoint.

The activity may therefore avoid an endpoint detection alert, leave no obvious attacker process in Windows event logs and bypass SIEM rules written for managed Windows or Linux systems. Appliance operating systems also tend to offer defenders less process-level telemetry than conventional servers.

This visibility gap made credential theft and directory replication harder to detect. Network traffic generated by a trusted edge device could blend into expected authentication and management activity.

CVE-2026-15409 is also not SonicWall’s only recent KEV entry. CVE-2026-15410 entered the catalog on July 14, 2026 and is flagged for ransomware use. CVE-2026-83548 and CVE-2026-83549 were added on September 2, 2026. Organizations operating SonicWall products should account for this broader sequence when reviewing exposed assets.

Patching is only the first response step

SMA1000 operators should upgrade to firmware 12.4.3-03453 or later. Systems that may have been exposed before patching require incident-response work, not merely a software update.

SonicWall’s recommended recovery measures include re-imaging affected appliances, rotating user and administrator credentials, and resetting TOTP tokens. If exploitation cannot be excluded, credentials stored on or reachable through the appliance should be treated as compromised.

Defenders should search for:

• Connections to 95.181.173[.]36 over unauthenticated HTTP on port 80.
• Activity involving /wsproxy and local TCP port 1050.
• Unexpected access to the Erlang node.
• The file /tmp/secretsdump.
• NTDS database files or other unusual artifacts under /tmp.
• Access to /usr/local/extranet/etc/policy_file.xml.
• SAM or LSA secret extraction.
• Authentication using domain-controller machine-account hashes.
• Pass-the-hash DCSync requests.
• Unusual LDAP, Windows or replication traffic originating from the appliance.

The reported secretsdump binary has the SHA-256 hash:

690f5031deede7d3357d0ca24c89866ae8c60e6c63b3a2c8bba813a6ac10ae5b

Specific SonicWall log paths relevant to the campaign have not been disclosed. Investigators should preserve available appliance logs before re-imaging and correlate them with domain-controller, LDAP, firewall and network telemetry.

Where DCSync or NTDS theft is suspected, the response must expand to a full Active Directory compromise assessment. Password changes alone may be inadequate if privileged hashes, machine-account secrets or persistent access mechanisms remain valid.