Coverage window: July 19, 2026, 08:00 — July 20, 2026, 08:00 UTC+8

This edition covers cybersecurity developments published or materially amplified during the reporting window, together with clearly identified carry-over incidents involving confirmed exploitation, active campaigns or urgent defensive action.

Official vendor advisories, government alerts and original security research were prioritised. Where technical impact, exploitation status or threat attribution remains uncertain, those limitations are stated explicitly.

---

📝 Executive Summary — 10-Second Read

• 🔴 SonicWall SMA1000 appliances remain the highest operational priority. UTA0533 exploited two zero-day vulnerabilities to tunnel into localhost-only services, achieve root-level command execution and deploy appliance-specific malware. Both vulnerabilities are listed in CISA’s Known Exploited Vulnerabilities Catalog.

• 🟠 CVE-2026-42533 affects NGINX deployments using specific regex-based map configurations. The vendor-confirmed technical impact is a remotely triggered worker crash or restart, resulting in denial of service. F5 states that remote code execution may be possible under additional conditions, including the absence or successful bypass of ASLR.

• 🟠 CERT-UA attributed a multi-vector campaign to UAC-0145, which it identifies as a Sandworm sub-cluster. Compromised websites use fake CAPTCHA and ClickFix instructions to persuade victims to execute PowerShell commands. The broader activity also includes Android applications disguised as security tools.

• 🟠 HelloNet abuses a locally installed ViPNet update component for DLL side-loading and attempted persistence. Current public evidence describes activity on already-accessible endpoints and does not establish that InfoTeCS or ViPNet’s central software-distribution infrastructure was compromised.

---

🔍 Major Incidents: Technical Analysis

1. SonicWall SMA1000 Zero-Day Chain: From External Request to Root Access

Status: Materially amplified during the coverage window; carry-over confirmed exploitation

Operational priority: 🔴 Critical
CVE-2026-15409: CVSS 10.0 — SonicWall rating
CVE-2026-15410: CVSS 7.2 — SonicWall rating
Exploitation status: Confirmed exploitation before public disclosure

Incident Overview

Volexity identified a previously undocumented threat actor, tracked as UTA0533, exploiting SonicWall SMA1000 appliances as zero-days from at least June 22, 2026.

Affected appliance models include:

• SonicWall SMA 6210

• SonicWall SMA 7210

• SonicWall SMA 8200v

Although the original vendor and incident-response disclosures preceded this reporting window, additional English-language reporting circulated on July 19. The incident remains an urgent operational priority because exploitation was confirmed before public disclosure.

On July 14, 2026, CISA added both CVE-2026-15409 and CVE-2026-15410 to its Known Exploited Vulnerabilities Catalog.

Technical Deep-Dive

Volexity reconstructed an exploitation chain beginning with a pre-authentication weakness in the appliance’s /wsproxy WebSocket endpoint.

A suspicious request pattern may contain:

• User-Agent: SMA Connect Agent

• A bmID parameter beginning with -3389

• A destination identifying an internal or loopback-only service

• A successful HTTP 101 Switching Protocols response

No valid SMA session cookie is required.

This allows an unauthenticated external attacker to tunnel traffic to services intended to listen only on the appliance’s loopback interface, including:

• 127.0.0.1:1050 — CouchDB Erlang distribution service

• 127.0.0.1:1051 — Erlang Port Mapper Daemon

• 127.0.0.1:8188 — SMA control service

The appliance effectively becomes a proxy into its own privileged internal management plane.

Volexity’s observed exploitation logs specifically showed access to ports 1050 and 8188. Port 1051 was separately verified as another reachable localhost service and should be treated as supplementary hunting context rather than an independently confirmed target in the observed intrusion logs.

Based on forensic evidence and its reconstruction of a working exploit chain, Volexity assessed that the attacker likely used the CouchDB environment to stage files and obtain appliance information required to interact with the control service. The exact CouchDB exploitation procedure used by the actor was not fully established.

The second vulnerability affects the execRemoveHotfix workflow. A caller-controlled hotfix value is appended to an expected rollback path:

/var/lib/aventail/avp/rollback/<user-controlled-value>

Insufficient path validation permits traversal sequences such as:

../../../../../tmp/payload.sh

The helper then marks the resolved file as executable and launches it. Because the helper operates with elevated privileges, a successfully staged attacker-controlled script can run as root.

Post-Exploitation Activity

After obtaining root-level access, UTA0533 deployed specialised components including:

• ROOTRUN: A setuid utility for root command execution

• KNUCKLEBALL: A Python injector carrying embedded Java agents

• Suo5: An open-source HTTP forwarding proxy

• ORANGETAIL: A custom Behinder-like Java web shell

• Modified NGINX Unit routes exposing attacker-controlled endpoints

• Packet-capture tooling targeting unencrypted LDAP traffic

Observed malicious routes included:

/__api__/login
/__api__/logout
/workplace/error.jsp
/workplace/dialogs/errorDialog.jsp

The attackers also modified:

/var/lib/unit/conf.json

The altered configuration proxied external requests to malicious Java components listening locally on the appliance.

A fully compromised SMA1000 appliance may expose:

• Stored or cached credentials

• Active authentication sessions

• Appliance configuration data

• TOTP enrollment seeds

• Directory-service credentials

• Internal identity infrastructure

• Network traffic or authentication material processed by the appliance

Volexity reported that one affected appliance contained tooling configured to inspect unencrypted LDAP traffic for usernames and passwords.

Mitigation and Threat Hunting

1. Upgrade affected appliances to:

   • 12.4.3-03453 or later

   • 12.5.0-02835 or later

2. Hunt for /wsproxy requests combining:

   • A bmID value beginning with -3389

   • User-Agent: SMA Connect Agent

   • Internal, localhost or loopback-oriented destinations

   • Ports 1050 or 8188

   • HTTP 101 Switching Protocols responses

3. Treat access to other unexpected localhost services, including EPMD on port 1051, as supplementary evidence requiring investigation.

4. Inspect control-service logs for:

   • Calls involving execRemoveHotfix

   • Path-traversal strings

   • References to files outside the legitimate rollback directory

5. Review:

   • /var/lib/unit/conf.json

   • /tmp

   • /var/tmp

   • /etc/init.d/workplace

   • NGINX Unit routing configuration

   • Unexpected setuid files

   • Unknown scripts or recently modified executables

6. Hunt for unexpected access to:

   • /__api__/login

   • /__api__/logout

   • /workplace/error.jsp

   • /workplace/dialogs/errorDialog.jsp

7. Review IdP and Active Directory telemetry for authentications originating from the appliance’s internal IP address, especially where no corresponding VPN session exists.

8. Monitor the appliance for:

   • Unusual outbound connections

   • LDAP packet capture

   • Web shells or HTTP proxies

   • Lateral movement into identity infrastructure

9. Distinguish between initial exploitation indicators and confirmed post-exploitation evidence:

   • Successful suspicious /wsproxy activity should trigger an immediate compromise assessment.

   • Malicious routes, altered NGINX Unit configuration, unknown setuid binaries or known malware should be treated as evidence of a full appliance compromise.

10. Where full compromise is confirmed—or cannot be confidently excluded:

• Reimage physical appliances or redeploy virtual appliances

• Rotate administrator, VPN, directory-service and service-account credentials

• Revoke active sessions

• Re-enroll potentially exposed TOTP tokens

• Conduct internal threat hunting for credential use and lateral movement

Installing the patch addresses the vulnerable software but does not invalidate credentials, sessions or secrets that may already have been exposed.

References

Volexity — Proxying to Compromise: SonicWall Secure Mobile Access Zero-Day Exploitation

SonicWall PSIRT — SNWLID-2026-0008

CISA — Adds Four Known Exploited Vulnerabilities to Catalog, July 14, 2026

CISA — Known Exploited Vulnerabilities Catalog

Rapid7 — SMA1000 Zero-Days Exploited in the Wild

The Hacker News — SonicWall SMA Zero-Days Exploited Before Disclosure to Gain Root Access

---

2. CVE-2026-42533: NGINX Heap Buffer Overflow in Regex-Based Map Processing

Status: New reporting during the coverage window

Vendor severity: Major
F5 CVSS v4.0: 9.2
F5 CVSS v3.1: 8.1
Analyst operational priority: 🟠 High, configuration-dependent
Vendor-confirmed technical impact: Worker crash or restart resulting in denial of service
Potential impact (under additional conditions): Remote code execution
Exploitation status: No confirmed exploitation in the wild at publication time

Incident Overview

CVE-2026-42533 is a remotely triggerable heap buffer overflow in NGINX processing involving affected combinations of the map directive, regular expressions and capture variables.

Affected NGINX Open Source versions include:

0.9.6 through 1.31.2

Cloud-managed or vendor-packaged deployments may already include security backports.

Fixed versions are:

• NGINX stable 1.30.4 or later

• NGINX mainline 1.31.3 or later

• NGINX Plus 37.0.3.1 or the applicable later fixed build specified by F5

NGINX classifies the vulnerability as Major. F5 assigns a CVSS v4.0 score of 9.2 and a CVSS v3.1 score of 8.1.

The presence of a vulnerable software version alone does not establish practical exposure. Exploitability requires an affected configuration and conditions partly outside the attacker’s control.

Technical Deep-Dive

NGINX evaluates certain dynamically constructed strings using two stages:

1. A sizing pass calculates the required output-buffer length.

2. A writing pass places the final data into the allocated buffer.

Public technical analysis indicates that vulnerable configurations can cause these two stages to rely on shared regular-expression capture state.

A simplified vulnerable pattern may contain:

• An earlier regex operation that produces an unnamed capture such as $1

• A regex-based map directive

• Evaluation of the map’s output variable between the sizing and writing operations

• Reuse of the earlier unnamed capture in the final expression

When the map regex executes, it may overwrite the shared capture state.

The sizing pass can therefore calculate the buffer using the original value of $1, while the writing pass reads a different attacker-influenced capture value.

In practical terms:

Measured length ≠ Written length

If the value used during the writing stage is longer than the value used during sizing, NGINX may write beyond the allocated heap buffer.

The vendor-confirmed technical impact is a worker-process crash or restart, resulting in denial of service. Repeated malicious requests could produce recurring worker failures and degraded availability.

F5 states that arbitrary code execution may also be possible where ASLR is disabled or can be successfully bypassed. No confirmed exploitation in the wild had been publicly reported at publication time.

Mitigation and Exposure Assessment

1. Upgrade affected deployments to:

   • NGINX 1.30.4 or later

   • NGINX 1.31.3 or later

   • NGINX Plus 37.0.3.1 or the applicable later fixed build

2. Search all primary and included configuration files for:

   • Regex-based map directives

   • Unnamed captures such as $1, $2 or $3

   • Expressions combining an earlier capture with a map output variable

   • Non-cacheable variables used in affected string expressions

   • Request-controlled values evaluated through multiple regex operations

3. Prioritise remediation for:

   • Internet-facing servers

   • Reverse proxies

   • API gateways

   • Ingress controllers

   • Multi-tenant environments

   • Systems matching the affected configuration pattern

4. Where immediate patching is impossible, replace affected unnamed captures with named captures and use them within the same applicable configuration block, following F5’s exact temporary mitigation guidance.

5. Monitor for:

   • Repeated NGINX worker crashes

   • Rapid worker respawning

   • Unexpected service restarts

   • Core dumps

   • Sudden increases in 5xx responses

   • Specific HTTP requests that consistently terminate worker processes

6. Validate:

   • Container images

   • Kubernetes ingress deployments

   • Appliance-embedded NGINX instances

   • Inherited base images

   • Third-party products bundling NGINX

7. For vendor-packaged or appliance-embedded builds, verify the supplier’s advisory and backport status rather than mapping exposure solely from the visible upstream NGINX version.

A version-only inventory is insufficient. Security teams must evaluate the installed release, vendor backport status and active configuration.

Additional Analyst Recommendation

Do not treat WAF signatures or request filtering as complete remediation.

Filtering may reduce exposure in some environments, but upgrading NGINX or removing the affected configuration addresses the underlying memory-corruption condition more reliably.

References

NGINX — Security Advisories

F5 — NGINX map Directive and Regex Matching Vulnerability

NVD — CVE-2026-42533

F5 — Out-of-Band Security Notification, July 15, 2026

The Hacker News — Critical NGINX Vulnerability Can Crash Servers and May Enable RCE

---

3. Sandworm-Linked ClickFix Campaign Targets Windows and Android Devices

Status: Materially amplified during the coverage window; primary CERT-UA disclosure predates the window

Analyst-assessed operational priority: 🟠 High
Threat actor: UAC-0145
Attribution: CERT-UA identifies UAC-0145 as a Sandworm sub-cluster
Primary targets: Ukrainian organisations and individuals

Incident Overview

CERT-UA attributed a multi-vector infection campaign to UAC-0145, which it identifies as a sub-cluster of UAC-0002, also known as Sandworm, APT44 and Seashell Blizzard.

The attackers compromised legitimate websites and selectively presented visitors with fraudulent CAPTCHA or verification instructions.

Rather than exploiting a browser vulnerability, the malicious page instructed the victim to manually execute a PowerShell command.

The broader UAC-0145 activity also included Android APK files distributed through messaging platforms and disguised as security applications.

Windows ClickFix Infection Chain

The Windows activity uses ClickFix—a social-engineering technique that turns the victim into the initial execution mechanism.

According to CERT-UA, observed workflows included:

1. The victim visits a compromised website.

2. Traffic filtering or cloaking determines whether benign or malicious content is displayed.

3. A fake CAPTCHA claims that additional verification is required.

4. The victim is instructed to copy and execute a PowerShell command.

5. In one observed chain, the command downloads a VBS payload to the Windows Startup directory.

6. The payload executes automatically after the next login or system restart.

One observed VBS component was named GHETTOVIBE.

Additional malware associated with the activity includes:

• SCOUTCURL: PowerShell-based system reconnaissance

• FLUIDLEECH: Loader disguised as antivirus or malware-removal software

• LOADLOOP: Additional payload loader

• FREAKYPOLL: Python-based backdoor

CERT-UA also reported the use of EtherHiding, in which an Ethereum smart contract is queried to retrieve infrastructure information used by the attack chain.

This approach separates initial web content from later-stage infrastructure and can complicate straightforward domain-based blocking.

Android Component

The Android malware, named COWARDDUCK, was distributed as a security-themed application.

According to CERT-UA, it can collect data including:

• Contacts

• Documents

• Archives

• VPN configuration files

• Office documents

• Real-time geolocation information

The malware can use legitimate online services—including the Dropbox API and Steam community pages—as parts of its command, configuration or exfiltration workflow.

Use of trusted platforms may make malicious traffic more difficult to distinguish from ordinary user activity.

Mitigation and Detection

1. Alert when browsers initiate or are closely followed by execution of:

   • powershell.exe

   • pwsh.exe

   • wscript.exe

   • cscript.exe

   • mshta.exe

   • cmd.exe

2. Detect scripts or executables being written to:

   • The user Startup directory

   • %APPDATA%

   • %TEMP%

   • Public user directories

   • Other user-writable persistence locations

3. Monitor for:

   • Encoded PowerShell

   • Invoke-WebRequest

   • Remote-script execution

   • PowerShell downloading VBS or JavaScript payloads

   • Browser activity immediately preceding terminal execution

4. Restrict unsigned PowerShell scripts and interactive shell access for standard users where operationally feasible.

5. Enable:

   • PowerShell Script Block Logging

   • PowerShell module logging

   • Process-creation auditing

   • Command-line telemetry

   • Browser-to-shell process-chain detection

6. Communicate a clear user rule:

   Legitimate CAPTCHA or browser-verification systems do not require users to open PowerShell, Terminal, Run or Command Prompt.

7. Restrict Android APK sideloading and installation from unknown or unapproved sources.

8. Apply mobile-device management and application allow-listing to managed Android devices.

9. Inspect externally accessible corporate websites for:

   • Unauthorised JavaScript

   • CMS administrator-account changes

   • Web shells

   • Modified templates or plugins

   • Newly added traffic-distribution or cloaking code

10. Monitor unexpected access to Ethereum RPC endpoints or smart-contract infrastructure from user endpoints and web servers, particularly when followed by script retrieval or command execution.

11. Review unexpected use of Dropbox APIs, Steam community pages or other trusted services by endpoints exhibiting related execution or persistence indicators.

References

CERT-UA — UAC-0145 Initial Compromise Vectors

The Hacker News — UAC-0145 Uses ClickFix CAPTCHAs to Deliver Malware

---

4. HelloNet Uses DLL Side-Loading Through a Locally Installed ViPNet Update Component

Status: Carry-over — active targeted campaign; original research published July 16, 2026

Analyst-assessed operational priority: 🟠 High for ViPNet environments; 🟡 Medium globally
Campaign status: Active at the time of original publication
Primary targets: Russian government, energy, transport, education, logistics and industrial organisations
Attribution: Possible unidentified Chinese-speaking actor; low confidence

Incident Overview

Kaspersky identified an APT campaign, named HelloNet, targeting high-value organisations using ViPNet secure-networking products. The activity began at least as early as May 2026 and remained active when Kaspersky published its research on July 16.

The campaign is notable because its malware is launched through a legitimate ViPNet update executable.

However, available research does not establish that InfoTeCS or ViPNet’s central update servers or software-distribution infrastructure were compromised.

Instead, Kaspersky found a malicious DLL placed inside the local ViPNet Update System directory of an analysed endpoint. The public research does not establish how the attackers initially obtained sufficient access to place that file.

Technical Deep-Dive

Attackers place a malicious file named:

wtsapi32.dll

inside:

C:\Program Files (x86)\InfoTeCS\VIPNet Update System\

When the legitimate itcsrvup64.exe process starts, Windows DLL search-order behaviour causes it to load the malicious local DLL.

Kaspersky named this component HelloInjector.

HelloInjector searches for a suitable svchost.exe process whose command line contains netsvcs, then injects code using:

• NtWriteVirtualMemory

• NtCreateThreadEx

After injection, HelloInjector loads the next-stage payload directly into memory. Kaspersky described the use of the ViPNet component as an attempt to establish persistence.

HelloProxy

The next-stage implant, HelloProxy, operates as:

• A concealed network proxy

• An in-memory loader for additional modules

It hooks functions including:

• NtDeviceIoControlFile

• closesocket

• shutdown

It also intercepts AFD networking operations including:

• AFD_RECV

• AFD_GET_TDI_HANDLES

Kaspersky assessed that this behaviour can hinder user-mode security products that filter network connections.

Observed HelloProxy listening ports include:

• TCP 5003

• TCP 5060

HelloProxy sends the bytes 0x0502 and expects the string:

ASDFASFSAFASDF

as part of its command-server handshake.

Additional Modules

• HelloExecutor: Command execution and system or network reconnaissance

• HelloCleaner: Removal of ViPNet log data

• HelloBackdoor: Rust-based file-transfer and command-execution backdoor

• Renamed PuTTY or Plink components used for SSH tunnelling and reverse port forwarding

HelloBackdoor listens on TCP 443 and expects the following activation command in the first packet:

47c6235b4d2611184

Kaspersky stated that this value forms part of the MD5 hash of the string hello\n.

Attribution

Kaspersky identified limited indicators suggesting a possible connection to an unidentified Chinese-speaking threat actor.

The researchers assessed this attribution with low confidence and stated that deliberate false-flag indicators could not be excluded.

The available evidence is therefore insufficient for definitive attribution to a specific state or organisation.

Defensive Significance

HelloNet demonstrates an important distinction:

Trusted software does not need to be malicious—or centrally compromised—to become an execution primitive.

A legitimate signed executable with an unsafe DLL-loading pattern can be abused for attempted persistence, process injection and covert execution after an attacker has already obtained access to the endpoint.

Mitigation and Threat Hunting

Organisations using ViPNet should prioritise detection of:

1. Creation of:

   C:\Program Files (x86)\InfoTeCS\VIPNet Update System\wtsapi32.dll
   

2. itcsrvup64.exe or itcsrvup.exe loading:

   • Unsigned DLLs

   • Incorrectly signed DLLs

   • DLLs not signed by InfoTeCS

   • Unexpected local copies of wtsapi32.dll

3. Process injection from:

   itcsrvup64.exe → svchost.exe
   

4. Abnormal activity from the injected svchost.exe, including:

   • File creation

   • Command execution

   • Reconnaissance

   • New network listeners

   • Tunnelling activity

5. Unexpected listening or inbound traffic on:

   • TCP 5003

   • TCP 5060

   • TCP 443

6. HelloProxy traffic containing:

   • Initial bytes 0x0502

   • Handshake string ASDFASFSAFASDF

7. TCP 443 connections whose first payload contains:

   47c6235b4d2611184
   

8. Renamed PuTTY or Plink binaries used for:

   • SSH tunnelling

   • Reverse port forwarding

   Detection should use the original PE filename, metadata, command line and binary characteristics rather than relying only on the current filename.

9. Separately investigate SOCKS or other proxy activity associated with HelloProxy.

10. Deletion or modification of ViPNet logs.

11. Executable or DLL creation in:

• %ProgramData%

• %TEMP%

• %SystemRoot%\Temp

• C:\Users\Public

• Other broadly writable directories

12. Non-standard child processes launched by ViPNet update components.

Application-control policies should prevent unauthorised users and processes from creating executables or DLLs inside trusted application directories.

Where possible, apply file-integrity monitoring to ViPNet installation paths.

References

Kaspersky Securelist — HelloNet Campaign: A Threat via the ViPNet Update System

BleepingComputer — Hackers Abuse ViPNet Software to Target Russian Government Agencies

---

🛡️ Today’s Defensive Action Items

P0 — Act Immediately

• Identify every Internet-facing SonicWall SMA1000 appliance.

• Confirm the actual installed version rather than relying solely on update-policy or management-console status.

• Hunt for suspicious /wsproxy requests combining:

  • bmID=-3389...

  • User-Agent: SMA Connect Agent

  • Internal or localhost-oriented destinations

  • Ports 1050 or 8188

  • HTTP 101 responses

• Review /var/lib/unit/conf.json and known malicious routes.

• Treat requests matching the observed IOC combination activity as requiring an immediate compromise assessment.

• Treat altered Unit routes, known malware, malicious web-shell paths or unexpected setuid files as evidence of full appliance compromise.

• Rebuild confirmed compromised appliances and rotate exposed credentials, sessions, tokens and TOTP secrets.

P1 — Assess Today; Patch Affected Deployments Urgently

• Inventory NGINX and NGINX Plus versions across servers, containers, ingress platforms and embedded products.

• Search active configurations for regex-based map directives combined with unnamed capture variables.

• Prioritise Internet-facing systems matching the affected configuration pattern.

• Review worker crashes, core dumps and unexplained restart loops.

• Apply the corresponding fixed release or F5-approved temporary mitigation.

• Verify vendor backports for packaged or embedded builds.

P2 — Strengthen Detection

• Alert when users execute PowerShell immediately after browser activity.

• Detect scripts written to Windows Startup folders and user-writable persistence paths.

• Enable PowerShell Script Block Logging and browser-to-shell telemetry.

• Restrict Android APK sideloading.

• Educate employees that CAPTCHA pages must never require terminal commands.

Environment-Specific

Organisations using ViPNet should:

• Inspect update directories for wtsapi32.dll.

• Monitor itcsrvup64.exe and itcsrvup.exe image loads.

• Detect ViPNet processes injecting into svchost.exe.

• Review SSH or Plink tunnelling activity.

• Monitor traffic involving TCP ports 5003, 5060 and 443.

• Hunt for ASDFASFSAFASDF and 47c6235b4d2611184 in appropriate network telemetry.

• Investigate deletion or modification of ViPNet logs.

---

📌 Final Assessment

Today’s threat picture combines exploitation of trusted infrastructure, abuse of legitimate execution paths and memory-safety failures in widely deployed software:

• A secure-access appliance became a tunnel into its own localhost-only management services.

• A web server’s regex and variable-processing logic produced configuration-dependent heap corruption.

• A fraudulent CAPTCHA persuaded victims to become the initial execution mechanism.

• A signed update executable became a malware loader through DLL search-order abuse.

The common defensive lesson is clear:

Inventory and patching reduce exposure, but behavioural monitoring is essential for detecting compromise after preventive controls or trusted execution paths have failed.

#CyberSecurity #ThreatIntelligence #CISO #SOC #SonicWall #NGINX #Sandworm #ClickFix #APT #VulnerabilityManagement