Cyber Attacks Compromise ViPNet Communications and SonicWall VPN

A sophisticated, unidentified threat actor compromised the update mechanism of the ViPNet secure‑communication suite, inserting malicious payloads into the software's distribution pipeline. The supply‑chain attack bypassed conventional perimeter defenses and gave the adversary access to encrypted channels used by Russian government agencies, creating a risk of data exfiltration and persistent infiltration of critical internal networks.

Separately, attackers exploited two zero‑day vulnerabilities (CVE‑2026‑15409 and CVE‑2026‑15410) in SonicWall Secure Mobile Access VPN appliances. By chaining an SSRF flaw with a command‑injection bug, they obtained root privileges on affected SMA 1000 series devices, deployed custom malware such as the Python‑based implant KNUCKLEBALL and a setuid tool named ROOTRUN, and modified system scripts to maintain persistence. The intrusion enabled capture of unencrypted traffic and lateral movement within victim environments.