Skip to content

Back to the catalog

dfir.chwriteup

MicroSocks: Convenient access through a compromised SonicWall SMA

DFIR investigation by a researcher into a SonicWall SMA compromise where the threat actor exploited CVE-2021-20039 (authenticated command injection) to drop the previously-known wafxSummary web shell, then months later placed a second binary, wafySummary, identified as the open-source MicroSocks SOCKS5 proxy. The attacker used MicroSocks to tunnel RDP traffic into the internal network, avoiding further malware deployment and detection for nearly 11 months before deploying Abyss ransomware. Includes reproduction steps confirming the binary's SOCKS proxy functionality and its VirusTotal PUA detection.

TL;DR Attackers exploited CVE-2021-20039 on a SonicWall SMA, dropped a known web shell, then used the MicroSocks proxy to tunnel RDP for nearly a year before deploying Abyss ransomware.
Open original ↗
Document

What it is

An incident writeup by DFIR.ch (investigator Giuseppe Paternicola) of an Abyss ransomware case that began with a SonicWall SMA appliance compromised via CVE-2021-20039 (authenticated command injection). The value beyond the summary is the specific artifacts: filenames, a hash, a detection name, and the timeline showing how long each stage sat dormant.

Preconditions / Affected

An internet-facing SonicWall SMA vulnerable to CVE-2021-20039 — a flaw with a public Metasploit module since January 2022 (per the linked pull request). The appliance was unpatched and unmonitored, which is what let the two stages persist.

Indicators and detections

  • Web shell dropped as wafxSummary, MD5 b664a4701731651056c22c8d4cd3ed16 — the same hash documented in Truesec's "Persistent web shell identified in SonicWall SMA" post. Look for it alongside sibling names wafySummary and wafzSummary (the latter was named by Truesec but not found on either DFIR.ch's or Truesec's device).
  • wafySummary is the microsocks SOCKS5 proxy binary. Truesec's THOR scanner flags it as PUA_MicroSocks_Proxy_Server_Oct21; it is also on VirusTotal.
  • microsocks defaults to port 1080 (the standard SOCKS port per /etc/services) and runs with no username or password unless the -u/-P flags are set — so an exposed instance is openly usable. Its usage string is a reliable string-based indicator:
usage: microsocks -1 -q -i listenip -p port -u user -P password -b bindaddr

What to do

The page's stated mitigations:

  • Patch externally facing appliances and devices promptly.
  • Scan the network for vulnerabilities, externally and internally.
  • Deploy an EDR agent or an agentless solution to monitor devices/hosts — the appliance being outside EDR/AV coverage is the core failure here.

Timeline (the part the summary flattens)

The two stages were months apart, which matters for retention/log scoping:

timeline
    Jan 2022 : CVE-2021-20039 exploit public in Metasploit
    Apr 25 2023 : wafxSummary web shell already on device
    Nov 2023 : wafySummary (microsocks) copied, ~6 months later
    ~Mar 2024 : Abyss ransomware, ~11 months after initial compromise

Caveats

The web shell itself is not analyzed here — DFIR.ch defers entirely to Truesec's post since the hash matched. The microsocks reproduction was done on the authors' own Ubuntu/Azure test host to confirm behavior, not observed live on the victim; their claim that the attacker tunneled RDP through the appliance and executed "almost no further malicious code" is an inference about why detection failed, stated by the authors rather than shown with evidence in the post.

Organisations named here

  • Truesec
  • wafySummary

CVEs named here

  • CVE-2021-20039

Technologies named here

  • wafxSummary
  • SonicWall Secure Mobile Access
  • microsocks
  • Metasploit
  • THOR scanner
  • VirusTotal
  • curl
  • RDP
  • SonicWall

Techniques named here

  • Authenticated Command Injection
  • Web shell deployment
  • SOCKS proxy tunneling
  • Targeting of unmonitored edge devices/appliances

Threat actors named here

  • Abyss ransomware

Related in Threat Intel