NFL is starting back up again, which pulled a memory from six months ago forward. I was a Bush Bunny in the Bad Bunny Super Bowl halftime show. No camera was chasing me. I was down in the grass, part of the production, watching the real motion while the spectacle ran above. They were very strict about phones, so I only have a few pictures from inside that world.
So, in honor of that once in a lifetime experience, I dedicated this Branch61G Weekly to Teachings from the thickets. The view from the bushes is where you see what the cameras miss. Same job this week. The loud CVE string is the show. The campaign finishes in the layer most stacks never watch.
Branch61G Weekly. Here is what actually hit over the past seven days.
SonicWall SMA1000 moves from zero day to ransomware KEV
The most pressing edge story this week is SonicWall's SMA1000 secure remote access gateway. CISA confirmed ransomware gangs are now exploiting two flaws, CVE-2026-15409 and CVE-2026-15410, and refreshed the Known Exploited Vulnerabilities catalog to call out that ransomware link. SMA1000 sits at the front door for large enterprises, government agencies, and MSSPs that need VPN access into internal apps.
SonicWall patched both in mid July and had already warned of zero day abuse. Volexity tracked the actor as UTA0533 and put the earliest compromise on June 22, weeks before public disclosure. The chain is specific. CVE-2026-15409 abuses the /wsproxy endpoint to open unauthenticated WebSocket tunnels into services that should only have been reachable from the appliance itself, including CouchDB and the management plane. From there the actor pulls the appliance product_uuid, then hits CVE-2026-15410 through the Appliance Management Console RPC method sysCtrl.execRemoveHotfix to run commands as root.
With root, UTA0533 dropped a custom loader Volexity calls KNUCKLEBALL (deploy_new.py), which staged two Java implants built for this appliance family. Sou5 (agent_wp8.jar) runs as a reverse proxy so the attacker can tunnel through the VPN box into the inside. ORANGETAIL (agent_wp9.jar) is a Java webshell that accepts encrypted payloads over HTTP. The actor also rewired nginx to expose that webshell and installed ROOTRUN for ongoing root execution.
The dodge is appliance legitimacy. The box is supposed to terminate VPN sessions and proxy traffic. An EDR agent watching endpoints behind it never sees the root shell on the gateway. A playbook waiting for a malware hash never matches custom Java built for this hardware. From the thicket, the tell is the new tunnel and the odd reach into services that gateway never used to touch.
And in a separate incident, the edge appliance under fire was not a VPN. It was the load balancer sitting in front of the apps.
Progress Kemp LoadMaster lands in CISA KEV after mass probing
CISA added CVE-2026-8037 to the KEV catalog this week, CVSS 9.6, and gave federal civilian agencies until August 10 to patch under BOD 26-04. Kemp LoadMaster is an application delivery controller and load balancer used across tech and government environments, with Progress citing more than 100,000 deployments. The flaw is unauthenticated command injection through unsanitized input on multiple command API endpoints. watchTowr Labs traced the bug to broken handling inside escape_quotes(). Progress shipped fixes in June for LoadMaster GA through 7.2.63.1, LTSF through 7.2.54.17, and related MOVEit WAF builds before GA 7.2.63.2.
The exploitation picture is loud. eSentire saw attempts begin June 29, the same day public technical detail and a working PoC landed. KEVIntel telemetry counted 792 exploitation attempts over 41 days from 65 unique IPs across 18 countries, with the last recorded activity on August 4. Shadowserver still tracks nearly 300 LoadMaster instances exposed online.
The dodge is infrastructure trust. A load balancer is supposed to speak HTTP and farm traffic. Unauthenticated command execution on that box looks like admin work if you only watch the servers behind it. The SIEM never gets a clean "malware" event because the first stage is the appliance itself doing what appliances do, for the wrong operator.
Different attack, same week, and the edge this time was a video conference server that turned into a software supply point for everyone who joined the meeting.
Head Mare turns TrueConf servers into trojan update points
Kaspersky caught Head Mare in July abusing unpatched TrueConf Server instances across Russian instrumentation, electronics, transport, energy, IT, and software shops. TrueConf is an on premise collaboration stack widely used as a local Zoom or Teams alternative. Attackers hit TCP port 4307, open by default, with no authentication. They chained KLCERT-26-057 to run a script inside TrueConf's isolated environment, then KLCERT-26-058 to break out onto the host and land NT AUTHORITY\SYSTEM. From there they replaced public\js\locale.php with a webshell, read the TrueConf database, and swapped the legitimate client installer hosted on that server for a package carrying PhantomCore.
Anyone who connected to the compromised server for a meeting got a trojanized, unsigned client as an "update." Kaspersky stressed the blast radius reaches past the owning org. Employees can join a counterparty's server and pull the poisoned installer without ever running TrueConf at home. Head Mare also deployed PhantomGraph, split across SysExcSvc.dll and SysReadSvc.dll, taking commands through a Microsoft OneDrive account. Observed work included LSASS dumps, hostname and whoami recon, and a reverse SSH tunnel. Kaspersky assessed the split DLL design as an intentional EDR dodge. Vendor fixes shipped June 18 in TrueConf Server 5.3.9, 5.4.9, and 5.5.5.
The dodge is the meeting update. The download looks like the product you already trust. Endpoint tools built for random malware samples struggle when the delivery channel is the collaboration server itself, and when C2 hides inside OneDrive and SSH patterns that plenty of admins allow on purpose.
Three edge stories in and the fourth hits a different kind of perimeter. The analytics portal that sits on top of the databases.
Metabase SQLi zero day used for customer data theft
Metabase disclosed a critical unauthenticated SQL injection in versions 1.58 and above, CVSS 10.0, still without a CVE string at disclosure. The bug lets a remote attacker inject SQL into the Metabase application database, seize administrator access, steal stored credentials for connected databases, read anything those connections can see, and export it. Metabase Cloud was hit. Self hosted instances were vulnerable too. Cloud customers were patched by the vendor. Self hosted teams have to move themselves to the safe builds Metabase published, or temporarily block /api/session/reset_password.
Metabase published a clean compromise fingerprint. A POST to /api/session/reset_password returning 400, followed by a successful GET to /api/user/current. Framework confirmed attackers accessed its instance on August 3 and stole customer names, emails, login IPs, addresses, phone numbers, and company details. Tally said its Metabase analytics environment was hit the same day, exposing email addresses and password hashes. That is an internet facing analytics edge sitting on top of the crown jewels, owned before a signature pack had a name for it.
The dodge is "business intelligence traffic." Admin API calls and database exports can look like a legitimate analyst session if the only question the stack asks is whether the user eventually held a valid cookie. The sequence that creates that admin from an unauthenticated SQLi is the part most playbooks never modeled.
What this week means
VPN appliances, load balancers, collaboration servers, analytics portals. Four separate incidents, and the same shape underneath. The enterprise edge is where trust is thickest and visibility is thinnest. Attackers keep choosing the box that is supposed to be the safe perimeter, then finishing the campaign in tunnels, C2, credential theft, and bulk export that the cameras on the endpoint never frame.
Teachings from the thickets again. From the grass you see the motion the spectacle hides. Detections stay broken for attacks that do not match a named playbook. DeepTempo is already part of the change. LogLM is a foundation model built as an encoder on network metadata. It learns normal deeply enough that a genuine deviation is legible on its own, with no prewritten signature for that CVE or appliance family required first.
Walk those four back through the wire. On SMA1000, Sou5 reverse proxy tunnels and ORANGETAIL webshell sessions are C2 and covert internal reach that sit outside a healthy VPN appliance's baseline, even when the first SSRF step is thin in netflow. On LoadMaster, the initial unauthenticated injection may be a short API blip, but any completed campaign still needs recon, C2, or staging off that newly owned ADC, and that is the completion path LogLM is built for. On TrueConf, PhantomGraph talking to OneDrive plus a reverse SSH tunnel is C2 with a trusted looking destination, and LSASS theft followed by odd reach is credential staging that reads against the host's normal meeting traffic. On Metabase, bulk export of customer tables or connected warehouse data at a volume and cadence that instance has never produced is exfiltration, independent of whether the SQLi itself left a clean network signature.
That is the generalizability. New edge, same behavioral grammar underneath it. DeepTempo's LogLM catches what the rulebook has never named yet.
AI SOCs are only as good as the detections that feed them. When a zero day or a novel sequence slips past those detections, the rest of the stack has nothing left to reason over.
The show is loud. The thicket is where the truth moves. Branch61G keeps watching from the grass.
Sources for this week include BleepingComputer and The Hacker News coverage of the SonicWall SMA1000 ransomware KEV update and Volexity's UTA0533 reporting, the Progress Kemp LoadMaster CVE-2026-8037 KEV listing, Head Mare's TrueConf and PhantomCore campaign reported by Kaspersky, and the Metabase SQLi zero day impacting Framework and Tally.
