UK Council Attack Linked to SonicWall Flaw

An attack against the Borough Council of King’s Lynn and West Norfolk was linked with moderate confidence to a wider mass-exploitation campaign targeting SonicWall SMA1000 appliances. The campaign exploited the critical CVE-2026-15409 vulnerability to obtain LDAP credentials and steal credentials and Active Directory data from internal Windows systems.