---
id: 7566
title: "[CVE-2026-15409] UK Council Attack Linked to SonicWall SMA 1000 Campaign"
cve: CVE-2026-15409
source_domain: hunt.io
source_url: "https://hunt.io/blog/sonicwall-sma1000-uk-council-attack"
published_at: "2026-09-10T00:00:00Z"
tags: ["incident-response", "threat-intelligence", "active-directory", "impacket", "sonicwall", "dcsync", "cve-2026-15409"]
phying_url: "https://phying.com/item/7566"
lang: en
---

# [CVE-2026-15409] UK Council Attack Linked to SonicWall SMA 1000 Campaign

## Summary

Hunt.io links a UK council breach to mass exploitation of SonicWall SMA1000 CVE-2026-15409: LDAP credentials from 168 appliances, secretsdump run on-device, DCSync in five AD environments.

## Intelligence Metadata

- **Sources:** hunt.io
- **CVE:** CVE-2026-15409
- **Published:** 2026-09-10T00:00:00Z
- **Original:** https://hunt.io/blog/sonicwall-sma1000-uk-council-attack
- **Phying News:** https://phying.com/item/7566