#ParsedReport #CompletenessHigh
10-09-2026

UK Council Attack Linked to SonicWall SMA 1000 Campaign

https://hunt.io/blog/sonicwall-sma1000-uk-council-attack

Report completeness: High

Threats:
Impacket_tool
Secretsdump_tool
Dcsync_technique
Passthehash_technique
Credential_dumping_technique

Victims:
Local government, Law enforcement, Healthcare, Financial services, Education, Manufacturing, Engineering, Managed it services, Professional services

Industry:
Education, Healthcare, Government

Geo:
Poland, Hungary, United states, United kingdom, Sweden, Germany, India, South korea, Hong kong, Italy, Canada, France

CVEs:
CVE-2026-15409 [Vulners]
CVSS V3.1: 10.0,
Vulners: Exploitation: True
Soft:
- sonicwall sma6210_firmware (12.4.3-03245, 12.4.3-03387, 12.4.3-03434, 12.5.0-02283, 12.5.0-02624)


TTPs:
Tactics: 3
Technics: 13

IOCs:
File: 9
IP: 1
Url: 1
Hash: 1

Soft:
SonicWall, Linux, Active Directory, curl, Unix

Algorithms:
aes, md5, sha256

Functions:
exploit_read_file, parse_ldap_config, RPC

Languages:
python

Links:
have more...
https://github.com/remmons-r7/rapid7-CVE-2026-15409/blob/main/cve-2026-15409.py
https://github.com/remmons-r7/rapid7-CVE-2026-15409