Latest / Tech Talks With Kinsoft
SonicWall SMA1000 – Zero-Days at the Edge, Stolen MFA Seeds, and a Password Called admin:admin
Two SonicWall SMA1000 flaws — an unauthenticated SSRF rated a perfect 10.0 (CVE-2026-15409) and a path-traversal-to-root bug (CVE-2026-15410) — were exploited as zero-days from at least 22 June, three weeks before the 14 July patches. We walk through the tradecraft of actor UTA0533: in-memory Java implants injected into legitimate appliance processes, a webshell that plays dead for scanners, logs symlinked to /dev/null — plus stolen credentials, session databases and TOTP MFA seeds, and lateral movement into domain controllers from the appliance's own service account. Also covered: CISA's KEV…
The skinny
The skinny isn't ready yet — notes appear once the transcript is processed.