Threat actor
UTA0533
Tracked by CyberSIXT since 19 Jul · last activity 21 Jul
- articles · all time
- 4+0 this week
- outlets
- 4
- week of 20 Jul · busiest week
- 3
- CVEs exploited · attributed
- 2
4 articles from 4 outlets since 19 Jul; the latest 97 days ago.
- Article
- First report
Show as table
| Published (UTC) | Outlet | Headline |
|---|---|---|
| Tue 21 Jul · 09:51 UTC | SOCRadar | SonicWall SMA 1000 zero day used to spread KNUCKLEBALL |
| Mon 20 Jul · 14:51 UTC | SecurityWeek | SonicWall Zero-Days Exploited to Deliver Custom Malware for Weeks Before Patch |
| Mon 20 Jul · 07:40 UTC | Security Affairs | Zero day exploits hit SonicWall VPN, giving attackers root access |
| Sun 19 Jul · 14:49 UTC | SecurityOnline | Zero day exploit targets SonicWall SMA 1000, installs malware |
Who reported 4 outlets, last 12 months
- SecurityOnline1
- Security Affairs1
- SecurityWeek1
- SOCRadar1
CVEs exploited
2 CVEs an article attributes to UTA0533CVE-2026-15409SonicWall SMA1000 Appliances Server-Side Request Forgery Vulnerability · attributed by SonicWall, Volexity, 21 JulCVSS10.0CriticalExploited6.8%EPSS19articles
CVE-2026-15410SonicWall SMA1000 Appliances Code Injection Vulnerability · attributed by SonicWall, Volexity, 21 JulCVSS7.2HighExploited12%EPSS16articles
- SonicWall SMA 1000 zero day used to spread KNUCKLEBALLSOCRadar
- SonicWall Zero-Days Exploited to Deliver Custom Malware for Weeks Before PatchSecurityWeek
- Zero day exploits hit SonicWall VPN, giving attackers root accessSecurity Affairs
- Zero day exploit targets SonicWall SMA 1000, installs malwareSecurityOnline · first in our coverage