Two SonicWall SMA1000 flaws — an unauthenticated SSRF rated a perfect 10.0 (CVE-2026-15409) and a path-traversal-to-root bug (CVE-2026-15410) — were exploited as zero-days from at least 22 June, three weeks before the 14 July patches. We walk through the tradecraft of actor UTA0533: in-memory Java implants injected into legitimate appliance processes, a webshell that plays dead for scanners, logs symlinked to /dev/null — plus stolen credentials, session databases and TOTP MFA seeds, and lateral movement into domain controllers from the appliance's own service account. Also covered: CISA's KEV listing and 3-day federal deadline under BOD 26-04, an INC ransomware affiliate reusing the chain within days, and the shipped admin:admin database and shared vendor-default identifier that amounted to a backdoor by default. Four actions: hunt (don't just pa ...