UK Council Attack Linked to SonicWall SMA 1000 Campaign

**Hunt.io observed a mass-exploitation campaign (CVE-2026-15409) targeting SonicWall SMA1000 appliances that enabled operators to execute commands via an Erlang SSRF chain, extract and decrypt LDAP bind credentials from policy_file.xml, drop a Linux build of Impacket's secretsdump onto compromised appliances, and remotely harvest SAM/LSA secrets and perform DCSync against multiple Active Directory domains across several countries, resulting in confirmed full-domain replication in five environments.**