Zero-Days Hit SonicWall SMA 1000 Before Patches Existed

A previously undocumented threat actor exploited multiple zero-day vulnerabilities in SonicWall Secure Mobile Access (SMA) 1000 series VPN appliances as early as June 22, 2026 — weeks before SonicWall publicly disclosed the flaws. The attacks weren’t just reconnaissance. They resulted in full root access on affected devices.

Security firm Volexity uncovered the campaign during an incident response investigation. The company is tracking the attacker under the moniker UTA0533. That’s a name you’ll want to remember, because this actor is patient, methodical, and clearly well-resourced.

The timeline matters here. Exploitation began in late June. Public disclosure didn’t happen until later. That gap — the zero-day window — is exactly what UTA0533 exploited to compromise devices before administrators even knew there was a problem.

What Volexity Found: Root Access, Not Just Footholds

Volexity’s investigation revealed that the attackers weren’t satisfied with simple unauthorized access. They escalated privileges to root on the SMA 1000 appliances. That level of access means full control over the VPN gateway — the very device organizations trust to secure remote connections.

Once root is achieved, an attacker can:

• Modify VPN configurations to redirect traffic
• Harvest credentials and session tokens
• Deploy persistent backdoors
• Lateral movement into the internal network

This isn’t a theoretical risk. It’s a confirmed campaign with real victims. Volexity’s report details the attack chain, though the company has withheld some specifics to allow organizations time to patch.

How the Exploitation Worked

While full technical details remain under wraps, Volexity’s analysis points to a combination of vulnerabilities in the SMA 1000 series. The flaws were chained together to achieve remote code execution, then privilege escalation to root.

The attack vector appears to be unauthenticated — meaning no valid credentials were required to trigger the initial compromise. That’s a worst-case scenario for exposed appliances.

Volexity noted that the actor’s tactics, techniques, and procedures (TTPs) don’t match any known group. UTA0533 appears to be a new or previously uncatalogued threat actor. That adds another layer of concern, because defenders can’t rely on existing threat intelligence to spot this group.

SonicWall’s Response and Patch Status

SonicWall released security advisories after Volexity reported the findings. The company has published patches for the SMA 1000 series, and administrators are urged to apply them immediately.

If you’re running an SMA 1000 appliance, here’s what you should do right now:

1. Apply the latest firmware update from SonicWall
2. Check for indicators of compromise provided in Volexity’s advisory
3. Review VPN logs for unusual activity dating back to June 22, 2026
4. Rotate any credentials that may have passed through the appliance

Delaying patches is no longer an option. The zero-day window has closed, but the actors who exploited it are still active. They’re likely scanning for unpatched devices.

Why This Matters for VPN Security

VPN appliances are prime targets. They sit at the network edge, they’re internet-facing, and they often have privileged access to internal systems. The SonicWall SMA 1000 is a popular choice for mid-sized and large enterprises, which makes it an attractive target for attackers seeking high-value access.

This incident is a reminder that VPN security best practices go beyond just installing patches. You need to monitor for anomalous behavior, restrict management interfaces to trusted IPs, and assume that any internet-facing device could be compromised.

Volexity’s discovery also highlights the value of incident response readiness. The organization that called in Volexity likely avoided a much worse outcome by detecting the breach early. That’s the difference between a contained incident and a full-blown data breach.

What to Watch For Next

UTA0533 isn’t going away. Volexity expects the group to continue exploiting other vulnerabilities, possibly in different VPN products. Security teams should stay alert for new advisories from SonicWall and other vendors.

If you’re responsible for network security, now is the time to audit your edge devices. Check for unauthorized changes, review logs for failed login attempts, and ensure your incident response plan is up to date. The next zero-day could be aimed at your infrastructure.

For more on defending against such threats, see our guide on VPN vulnerability management and the latest network security threat landscape coverage.

Poisoned Crates Hit the Rust Ecosystem

Security researchers have linked a new Rust supply chain attack to North Korean state-sponsored hackers. The campaign targeted the Rust ecosystem on August 20, compromising one of its most widely used crates.

The attack centered on arrayref, an array-conversion utility with more than 245 million downloads. Wiz, the cybersecurity firm that first reported the incident, notes that the crate appears in roughly 75% of Rust environments. That’s a staggering reach for a single malicious package.

Hackers published a poisoned version, [email protected], to crates.io using the legitimate maintainer’s account. Within 20 minutes, they also pushed malicious versions of two other crates from the same owner: internment and append-only-vec.

How the Malicious Dependency Worked

The attackers didn’t stop at the main packages. They created typosquatted versions of proc-macro2, a legitimate and widely used crate, and registered several attacker-owned crates with names like aovine, arone, aronenao, and tinymember. All of these referenced the same malicious dependency: [email protected].

That dependency impersonated the real proc-macro2 package. Hidden inside it was a file called build.rs, designed to fetch a platform-specific second-stage binary over TLS. Critically, the code disabled certificate validation, making the TLS connection vulnerable to interception.

Once executed, the build script could deliver a payload tailored to the victim’s operating system. This is a classic supply chain technique: compromise the build process, and you compromise everything downstream.

Rust Security Team Responds Quickly

The Rust Security Response Team acted fast. Within roughly 86 minutes of the malicious packages appearing, they were removed from crates.io. The team later confirmed the compromise in a statement:

“A new version of the arrayref crate was published with a direct dependency on proc-macro1, which would execute a malicious build script.”

Clean versions of the affected crates have been restored. The team found no evidence that the malicious versions were actually used in real-world builds. That’s the good news.

The security team also addressed the question of the maintainer’s involvement. “We do not believe the author of arrayref to be acting maliciously, but their computer or credentials are likely compromised, and we are attempting to contact them,” they said.

North Korean Hackers Behind the Attack

Wiz’s analysis points a finger at Sapphire Sleet, a North Korean threat actor. The group previously mounted the Axios and Mastra NPM supply chain attacks in April and June of this year.

The evidence is substantial. The arrayref payloads beacon to an endpoint used in the Mastra attack. Command-and-control traffic was recorded to an IP address used in the Axios campaign. And all three incidents used infrastructure from the same Hostwinds LLC IP range.

That’s not a coincidence. It’s a pattern.

StepSecurity’s Analysis of the Campaign

StepSecurity’s own analysis shows how carefully the operation was planned. The attackers created typosquatted versions of proc-macro2 and set up an impersonating account right before the poisoned arrayref release was published. The timing was deliberate, designed to maximize the window before detection.

This wasn’t a sloppy attack. Every step was choreographed.

What This Means for the Open Source Community

This incident is another reminder that open source software remains a prime target for nation-state actors. The Rust ecosystem, with its strong focus on safety, is not immune to supply chain attacks.

For developers, the lesson is straightforward: verify the integrity of your dependencies, monitor for unexpected updates, and consider using tools that scan for known malicious packages. The open source supply chain security landscape is shifting, and vigilance is the only defense.

Related incidents in the broader ecosystem include Azure data theft campaigns and malware targeting Zimbra servers. The pattern is clear — attackers are going after the foundations of modern software development.

As for the Rust community, the quick response from the security team is reassuring. But the fact that a North Korean hacking group can compromise a crate with 245 million downloads should give every developer pause.

The Rust supply chain attack was neutralized this time. The next one might not be so easily contained.

Fake CAPTCHAs Are Spreading Malware Across Ukraine—Here’s How the ClickFix Trick Works

Ukrainian devices are under a new wave of attack, and this time the bait is something internet users see every day: a CAPTCHA. The Computer Emergency Response Team of Ukraine (CERT-UA) has linked the campaign to UAC-0145, a sub-cluster within the notorious Russian hacking unit Sandworm, which operates under the GRU, Russia’s military intelligence agency.

The method is called ClickFix, and it’s deceptively simple. A user lands on a compromised or malicious site, gets hit with a fake CAPTCHA prompt, and is told to verify they’re human by running a command. That command? It’s actually a download-and-execute payload that infects the machine with data-stealing malware.

This isn’t a novel technique, but it’s proving effective. CERT-UA’s warning highlights how the attackers are tailoring the trick to Ukrainian targets, using lures that feel urgent and legitimate.

How the ClickFix Attack Unfolds

The attack chain starts with a phishing page or a compromised website. Visitors see a CAPTCHA that looks like the standard “I’m not a robot” checkbox or a puzzle. But instead of simply verifying, the page instructs them to open the Windows Run dialog (Win+R) and paste a command.

That command, often obfuscated, reaches out to a remote server, pulls down a malicious script, and executes it. Within seconds, the system is compromised. The malware deployed in these campaigns is designed to siphon credentials, browser data, and other sensitive information.

CERT-UA’s report notes that UAC-0145 has been active in this space for a while, but the ClickFix approach marks a shift toward social engineering that preys on user trust in familiar interfaces.

Why CAPTCHAs Are the Perfect Cover

CAPTCHAs are everywhere. Users are conditioned to solve them without thinking. That conditioning is exactly what the attackers exploit. A prompt that says “Press Win+R, paste this, and hit Enter” doesn’t raise suspicion because it’s framed as a verification step.

In many cases, the fake CAPTCHA even includes a progress bar or a countdown timer, adding pressure to act fast. This urgency is a classic manipulation tactic, and it works.

Who Is Behind UAC-0145?

UAC-0145 is a sub-cluster of Sandworm, a unit with a long history of disruptive cyber operations. Sandworm has been linked to attacks on Ukrainian infrastructure, including the 2015 and 2016 power grid blackouts, as well as the NotPetya worm that caused billions in damage globally.

This new campaign fits a broader pattern of Russian cyber aggression against Ukraine, which has intensified since the full-scale invasion in 2022. The focus on data theft suggests the attackers are after intelligence, not just disruption.

CERT-UA’s attribution is based on technical indicators and infrastructure overlaps with previous UAC-0145 operations. The agency has urged Ukrainian organizations and individuals to be vigilant.

How to Protect Yourself from ClickFix Attacks

The defense against ClickFix is straightforward, but it requires a shift in mindset. Here’s what security experts recommend:

• Never run commands from CAPTCHAs. Legitimate CAPTCHAs never ask you to open a Run dialog or execute a script. If a page does, close it immediately.
• Verify the source. If you’re on a site you didn’t intend to visit, or the URL looks off, don’t interact with it.
• Keep systems patched. Malware often exploits unpatched vulnerabilities. Regular updates reduce the risk.
• Use endpoint protection. Modern antivirus and EDR tools can detect and block the malicious scripts before they execute.
• Train users. Awareness is the first line of defense. If people know what ClickFix looks like, they’re less likely to fall for it.

What CERT-UA’s Warning Means for the Broader Threat Landscape

This campaign is a reminder that state-sponsored hacking groups are constantly evolving their tactics. ClickFix isn’t new—researchers have documented it since 2023—but its adoption by a group like Sandworm signals that it’s now a mainstream tool in the espionage playbook.

The targeting of Ukrainian devices is no surprise. But the same technique can be repurposed for any region. Organizations worldwide should treat fake CAPTCHA prompts as a potential red flag.

For more on how to spot phishing and social engineering attempts, check out our guide on recognizing phishing emails. And if you’re responsible for security in your organization, it’s worth reviewing endpoint security best practices to close gaps that attackers like UAC-0145 exploit.

The bottom line: trust nothing that asks you to run a command. That CAPTCHA might be more than an annoyance—it could be the door to a compromised network.