Hackers Quietly Broke Into SonicWall Systems for Weeks, Planting Hidden Backdoors

Security researchers have uncovered a serious attack campaign targeting SonicWall, a major company that makes network security equipment used by businesses worldwide. Criminals discovered and exploited two previously unknown security weaknesses—identified as CVE-2026-15409 and CVE-2026-15410—to gain unauthorized access to customer systems and install malicious software. The attackers, identified by security firm Volexity as a group called UTA0533, managed to operate undetected for several weeks before patches were made available to fix the problems.

What this means

Think of SonicWall firewalls like security guards at a building entrance—they're supposed to block bad guys from getting in. In this case, hackers found secret doors that the guards didn't know about. Once inside, they planted surveillance equipment (the custom malware) that allowed them to watch and control what happened on company networks.

The fact that these weaknesses existed in a widely-used security product and were actively being exploited for weeks represents a significant breach of trust. Organizations believed their networks were protected when, in reality, attackers had already crossed the perimeter. This is particularly concerning because SonicWall products are used to defend sensitive data and critical business operations at thousands of companies.

Why you should care

• Your data might be at risk: If your company uses SonicWall firewalls and didn't quickly apply the security update, attackers may have already installed backdoors that give them ongoing access to your systems.
• This happens more than you think: Security gaps in major software affect large numbers of organizations simultaneously. When one company finds a weakness, many others are likely vulnerable at the same time.
• Delayed fixes create danger: The multi-week delay between when hackers discovered these flaws and when official patches arrived left countless businesses exposed during that window.
• Custom-built attacks are harder to detect: Rather than using off-the-shelf malware, these attackers created custom tools specifically designed for SonicWall systems, making them harder for standard security tools to recognize and remove.

What you can do

If you work in IT or manage your company's network security: Check immediately whether your organization uses SonicWall products. If you do, verify that the latest security patches for CVE-2026-15409 and CVE-2026-15410 have been installed. Don't delay this—apply updates as soon as feasible to close the door on potential attackers.

For everyone: Ask your IT department whether your company has been affected and what steps they're taking to investigate. Request confirmation that security patches are current. This isn't to create panic, but to ensure your workplace is taking security seriously.

General best practices: Enable multi-factor authentication on important accounts, monitor network activity for suspicious behavior, and maintain regular backups of critical data. These practices help limit damage if attackers do gain access despite firewalls.

The SonicWall incident serves as a reminder that even companies specializing in security aren't immune to attack, making vigilance and rapid response essential for all organizations handling sensitive information.