SonicWall SMA1000 Flaws Exploited as Zero-Days to Push Custom Malware

SonicWall confirmed active zero-day exploitation of two chained vulnerabilities in SMA1000 appliances that allowed attackers to install custom firmware-level implants which persist across resets, harvest VPN credentials, intercept TLS sessions, and maintain encrypted C2; patches and IOCs were released and organizations are advised to assume compromise, capture forensics before patching, rotate credentials, and verify firmware integrity.