Folks @HuntressLabs were in full swing this Friday analyzing the latest and greatest of CVE-2026-15409 and CVE-2026-15410, affecting SonicWall SMA 1000-series appliances. DCSync on the DC's, Sliver on the SMA's, and more below. Our first hint of adversarial access was remote registry dumping across numerous environments, detected and mitigated by Defender. This was Impacket's Secretsdump. github.com/fortra/impacket/b… We began to analyze Huntress' SIEM data for signs of compromise from affected SMA devices within these environments. We found two distinct patterns. 1.) Adversaries acting to validate exploitation against these appliances from a variety of low rep providers. 2.) Anomalous curl activity from the 'root' user of an appliance; fetching payloads from 153.75.81[.]30. Two different payloads-- ".sshd" and ".rsyncd" were noted. They were stashed in /var/tmp/ and executed through cron (rsyncd-update and sshd-update) on the SMA appliance. Analysis of the payloads confirmed these were Sliver implants, an adversary emulation framework by BishopFox. These were configured to callback to the same staging IP. github.com/bishopfox/sliver This would allow an adversary to linger covertly after remediation efforts. Meanwhile, @xorJosh was busy cooking away on his own analysis-- and located an open directory containing CVE validation scripts (a CN-localized Rapid7 script), "autodcsync" and "autosecretsdump" Python files, and exfiltrated credentials from numerous environments. Of note, contained next to the credentials and scripts in the open dir was 'iox' and 'frp', two direct-tunnel tools. github.com/eddieivan01/iox github.com/fatedier/frp These are noteworty chiefly because they have been favorites of numerous nation-state APT groups. The key takeaways here are clear: - SIEM saves lives; make sure logs are being forwarded and retained. - Patching might not mean you're out of the woods, adversaries are already weaponizing persistent implants to maintain access. IOCs IPv4/Port: 153.75.81[.]30:30303 - Stager Resource: 153.75.81[.30:30303/a - .rsyncd Resource: 153.75.81[.30:30303/c - .sshd IPv4/Port: 153.75.81[.30:80 - Sliver C2 Callback Cron: /etc/cron.d/rsync-update - .rsyncd Cronjob Cron: /etc/cron.d/sshd-update - .sshd Cronjob Binary: 5aa0bb8a8a298fc00935dad22e73e1effc648b1739628b782727ba7bb123cbc3 (.rsyncd) Binary: 098db74319d0798291264c643522db59fc12d65ef649d7e12c7334ea75a74a4e (.sshd) Path: /var/tmp/.rsyncd Path: /var/tmp/.sshd