Two recently disclosed SonicWall SMA1000 vulnerabilities were exploited in zero-day attacks for weeks, allowing threat actors to install custom malware on vulnerable VPN appliances.

Volexity links UTA0533 to two SonicWall SMA 1000 zero-days used before disclosure to gain root, plant malware, and capture LDAP credentials.

Two recently patched SonicWall appliance zero-days were exploited by threat actors for weeks before patches were released