Inside UTA0533 SonicWall SMA Malware Toolkit: ROOTRUN, KNUCKLEBALL and ORANGETAIL

Introduction

The UTA0533 SonicWall SMA malware toolkit shows how attackers extended the impact of the SonicWall SMA zero-day campaign beyond initial exploitation. Our previous article examined how CVE-2026-15409 and CVE-2026-15410 enabled attackers to compromise SonicWall SMA 1000 series VPN appliances before public disclosure. It focused on affected products, vulnerability details and immediate remediation.

However, the vulnerabilities only provided initial access. After obtaining root privileges, UTA0533 deployed malware and persistence mechanisms designed specifically for SonicWall SMA appliances.

The toolkit allowed the attackers to:

• Maintain privileged command execution.
• Inject Java payloads into a legitimate SonicWall appliance process.
• Reload KNUCKLEBALL and its embedded Java payloads after a reboot.
• Expose externally accessible routes to the Suo5 proxy and ORANGETAIL web shell.
• Separately, UTA0533 placed scripts on one appliance that appeared designed to capture unencrypted LDAP traffic.

These findings show why appliance forensics must accompany vulnerability remediation. Patching closes the original security flaw, but it does not automatically remove malware or reverse configuration changes introduced before the update.

UTA0533 SonicWall SMA Malware Toolkit at a Glance

Why the UTA0533 SonicWall SMA Malware Matters More Than the Zero-Day

Vendors may eventually release patches for zero-day vulnerabilities, but malware installed during the exploitation window can remain active after administrators apply the fix.

In this campaign, UTA0533 used root access to deploy tooling that could:

• Reload KNUCKLEBALL and its embedded Java payloads after a reboot through a modified startup script.
• Operate inside a legitimate SonicWall Java process.
• Provide continued root-level command execution while ROOTRUN remained installed and accessible.
• Support additional post-exploitation activity.

This campaign shows how threat actors can build implants for specific VPN and edge-appliance environments instead of relying exclusively on commodity tools. Such malware may be harder to identify because it operates inside legitimate appliance processes and uses modified application routes

Consequently, organizations should treat patching as the start of recovery, not the end. Security teams must also review startup scripts, privileged binaries, web server configurations and other persistence locations.

Breaking Down the UTA0533 SonicWall SMA Malware Toolkit

ROOTRUN

Investigators identified an ELF binary named xzfind that internally identified itself as ROOTRUN. The binary used Linux’s setuid mechanism to execute attacker-supplied commands with root privileges.

ROOTRUN allowed UTA0533 to execute attacker-supplied commands with root privileges after the initial exploitation.

As long as ROOTRUN remained installed and accessible, it could provide root-level command execution independently of the Java payloads.

KNUCKLEBALL

Instead of creating separate malicious processes, KNUCKLEBALL injected two Java payloads into an existing SonicWall Java process through the Java Attach API. This technique helped the malware blend into normal appliance activity.

UTA0533 added KNUCKLEBALL to the legitimate appliance startup script, allowing it to:

• Run automatically after a reboot.
• Reload malicious Java payloads.
• Restore malware functionality without re-exploiting the vulnerabilities.

The startup-script modification provided KNUCKLEBALL with reboot persistence, while process injection loaded its Java payloads into a legitimate SonicWall process.

Suo5

One KNUCKLEBALL payload was a modified version of Suo5, an open-source HTTP proxy tool.

Suo5 could allow the compromised SonicWall SMA appliance to relay attacker traffic toward other network resources. Because VPN appliances connect external users with enterprise resources, their compromise may provide a useful proxy point for attempted follow-on activity.

Although Suo5 is publicly available software, its use in this campaign demonstrates how threat actors can combine open-source tools with purpose-built malware.

ORANGETAIL

The second Java payload was ORANGETAIL, a custom web shell that operated similarly to the open-source Behinder web shell.

ORANGETAIL activated only when requests contained a specific user-agent string; requests that failed validation received an HTTP 404 response.

UTA0533 also modified NGINX Unit configurations to:

• Expose the Suo5 proxy and ORANGETAIL web shell through externally accessible routes.
• Route external requests through the /__api__/login and /__api__/logout URI paths to the injected implants.

The modified routes made the ORANGETAIL command-execution channel and Suo5 HTTP proxy externally reachable.

How the UTA0533 SonicWall SMA Malware Maintained Access

UTA0533 modified the appliance environment to preserve specific capabilities after exploitation. Adding KNUCKLEBALL to a startup script provided reboot persistence, while modified NGINX Unit routes exposed the injected implants when they were active.

Observed persistence, access, and stealth techniques included:

• Adding KNUCKLEBALL to a legitimate startup script for reboot persistence.
• Injecting Java payloads into a legitimate SonicWall process.
• Modifying NGINX Unit routes to expose the implants externally.
• Installing ROOTRUN to provide root-level command execution while the utility remained present and accessible.

Investigators also found scripts configured to capture unencrypted LDAP traffic on one appliance. This activity appears to indicate preparation to capture unencrypted LDAP traffic, potentially including usernames and passwords. However, public reporting has not confirmed that UTA0533 successfully captured credentials.

These findings underline a critical incident-response principle: a patched appliance is not necessarily a clean appliance. Administrators should validate system integrity before returning a previously compromised device to production.

Indicators of Compromise and Hunting Priorities

Security teams investigating affected SonicWall SMA appliances should look for:

• Unexpected setuid binaries, including ROOTRUN-like utilities.
• Modified startup scripts that reload unfamiliar code.
• Unauthorized NGINX Unit routes or configuration changes.
• Evidence that KNUCKLEBALL used the Java Attach API to load /tmp/agent_wp8.jar or /tmp/agent_wp9.jar into the SonicWall workplace.startup.CommandStartup process.
• Suo5-related files, hashes, injected Java classes or routes identified in Volexity’s published indicators.
• ORANGETAIL-related hashes, Java classes, URI routes, request parameters or user-agent activity identified in Volexity’s published indicators.
• Requests using the specific fabricated user-agent published by Volexity, particularly when directed to unexpected or modified SonicWall SMA routes.
• Scripts configured to capture unencrypted LDAP traffic.
• Configuration differences from a trusted baseline.

Some behavioral findings may not prove compromise independently; however, exact malware hashes, known implant files and confirmed malicious configuration changes can provide strong evidence of compromise. Therefore, defenders should compare them with SonicWall and Volexity indicators, appliance logs and forensic evidence from the relevant exploitation period.

How UTA0533 Used Appliance-Specific Malware

UTA0533’s toolkit demonstrates how attackers can combine appliance-specific malware, open-source tooling, and configuration changes during post-exploitation. VPN, firewall and other edge appliances can present attractive targets because these systems:

• May be directly exposed to the internet.
• Occupy trusted network positions.
• Provide paths toward internal resources.
• May provide less endpoint-style telemetry than fully monitored workstations and servers, depending on the appliance and logging configuration.

As a result, organizations should investigate compromised appliances with the same rigor applied to workstations and servers. Rapid patching remains essential, but defenders must also hunt for persistence, validate configurations and examine adjacent systems for follow-on activity.

Featured resource

Introduction to Hexnode XDR

Learn how Hexnode XDR helps security teams investigate endpoint activity, hunt threats, and accelerate incident response after suspected compromises.

Download the Presentation

How Hexnode XDR Can Support Post-Compromise Investigations

The malicious activity occurred on SonicWall SMA appliances and was therefore outside the direct telemetry Hexnode XDR collects from managed Windows and macOS endpoints. However, endpoint telemetry becomes important when attackers attempt to move from a compromised appliance to managed devices.

Hexnode XDR can help security teams investigate supported Windows and macOS endpoints by enabling them to:

• Run Advanced Investigation Queries to search detailed endpoint telemetry for suspicious activity.
• Investigate endpoint behavior, including processes and other endpoint events, to identify potential indicators of compromise.
• Isolate affected devices to help contain suspicious endpoint activity during an investigation.
• Terminate malicious processes using the Kill Process action when security teams determine that endpoint response is required.

Hexnode XDR can complement appliance forensics by helping security teams investigate managed Windows and macOS endpoints for evidence of possible follow-on activity.

Security teams can review Hexnode XDR endpoint data alongside appliance, network, and identity evidence to investigate possible follow-on activity and decide whether endpoint containment is necessary.

Conclusion

The SonicWall SMA zero-days enabled the initial compromise, while the UTA0533 malware toolkit demonstrates an effort to maintain privileged access and support further activity.

ROOTRUN provided root-level command execution while it remained installed and accessible, KNUCKLEBALL loaded Java payloads, Suo5 provided an HTTP traffic-proxying capability, and ORANGETAIL provided covert web shell access. Meanwhile, the startup-script modification enabled reboot persistence, while the NGINX Unit changes kept Suo5 and ORANGETAIL accessible through external routes.

The primary lessons are clear:

• Patch affected appliances promptly.
• Verify appliance integrity after patching.
• Hunt for unauthorized binaries and configuration changes.
• Investigate adjacent endpoints for follow-on activity.
• Treat internet-facing appliances as potentially high-value assets and prioritize them according to their exposure, privileges, and role in the network.

Ultimately, recovery from an appliance compromise requires more than installing an update. Organizations should combine patching, appliance forensics and endpoint investigation to identify remaining persistence and increase confidence that unauthorized access has been removed.