ctrlINT What the industry said about every indicator, with the quote

UTA0533Threat actor

UTA0533 has been linked to compromised SonicWall SMA appliances, with exploitation beginning on June 22, 2026. The actor routed traffic through ExpressVPN and Mullvad exit nodes, utilizing over 200 IP addresses. Notably, several attacker hostnames, including a Kali Linux machine, were leaked during lateral movement, indicating hands-on-keyboard intrusion.From MISP Galaxy

Last reported 11 days ago, by Volexity3 reports

ATT&CK techniques

6 of 7 · each with the sentence it comes from
  1. T1505.003Web Shell

    “…ds and results through the exploit chain’s HTTPS requests rather than a separate command-and-control (C2) channel, with no backdoor or web shell deployed to the compromised device.”

    VolexityVendor
  2. T1003.007Proc Filesystem

    “… of the workplace.startup.CommandStartup process is located by enumerating the command-line pseudo-file for each PID listed in the /proc filesystem.”

    VolexityVendor
  3. T1027.009Embedded Payloads

    “The two embedded payloads are Base64-encoded and temporarily written to disk at the following paths during the injection process:”

    VolexityVendor
  4. T1036Masquerading

    “Tool masquerading and capture rotation: The attacker used a renamed tcpdump executable (/data/.icscap/dsstatmond) and eight rotating packet-capture files.”

    VolexityVendor
  5. T1110.002Password Cracking

    “It prints recovered credentials and password-cracking material to standard output, allowing the attacker to collect authentication data from intercepted network traffic.”

    VolexityVendor
  6. T1110.003Password Spraying

    “Password spraying”

    VolexityVendor

Reports per month

last 12 months

October so far (hatched). Counted by report, not by story.

What the reports say

3 reports, newest first · the exact sentence from each

  1. “It is worth noting that this technique was also recently used by another threat actor, which Volexity tracks as UTA0533, who obtained root access via zero-day exploitation on SonicWall SMA VPN appliances.”

    VolexityVendor
    A Series of Unauthenticated Events: Chained Exploitation of Ivanti Connect Secure Zero-Days

  2. “…e product (CVE-2026-15409, CVSS score: 10.0, and CVE-2026-15410, CVSS score: 7.2) were weaponized as zero-days by a threat actor dubbed UTA0533 to deploy Java web shells and a malware called KNUCKLEBALL.”

    The Hacker NewsNews
    Critical SonicWall SMA 1000 Flaw Targeted in 135 Exploitation Attempts After Patch

  3. “Volexity’s analysis of logs, disk images, and memory led to the discovery of a threat actor Volexity tracks as UTA0533.”

    VolexityVendor
    Proxying to Compromise: SonicWall Secure Mobile Access 0-day Exploitation

Indicators in its reports

named in the reports above
Copy these 20 indicators · defanged

Thanks — we review every report.

Report a wrong match
What is wrong with UTA0533 here?
No account needed. We do not store your IP address.