Inferlume

How it Works

Reports

Pricing

About

Get Free Access →

Get Free Access

Last Updated On

Tuesday, July 21, 2026

CCTTII--22002266--00772211

CCrriittiiccaall

AAccttiivvee EExxppllooiittaattiioonn CCoonnffiirrmmeedd

Unpatched CMS VPN and AI Platforms Fall to Confirmed RCE Waves

Unpatched ServiceNow, SonicWall SMA1000, and WordPress estates are under active fire right now, not next week. A pre authentication sandbox escape in ServiceNow AI Platform, a CVSS 10.0 SMA1000 SSRF chained to root, and the WP2Shell unauthenticated RCE chain on default CMS installs are all confirmed in the wild, with SonicWall already on the CISA KEV list.

Meanwhile SleeperGem slipped malicious RubyGems into developer laptops, skipping CI runners, dropping persistence, and hunting Git and cloud keys. One poisoned workstation is enough to walk into your build pipeline.

If you run any of these platforms, inventory, patch proof, hunt vendor log patterns, and rotate secrets today. Rebuild anything that lights up. Full detection logic, playbooks, and inferred ATT&CK mappings live in the complete brief, best viewed on a wide desktop screen.

CVSS Score

IOC Count

Source Count

Confidence Score

CVEs

CVE-2026-6875, CVE-2026-15409, CVE-2026-15410, CVE-2026-60137, CVE-2026-63030

Actors

UTA0533, Under Attribution WP2Shell Operators, Under Attribution SleeperGem Operators

Sectors

Financial Services, Healthcare, Government, Technology, Managed Service Providers, Web Hosting CMS Operators, Software Development

Regions

North America, Europe, Asia Pacific, Global

Chapter 01 - Executive Overview

Today’s brief is dominated by four interlocking problems that together create immediate initial access and credential compromise risk across ITSM, remote access, public web, and developer estates.

Lead risk clusters
ServiceNow AI Platform CVE-2026-6875: pre authentication sandbox escape enabling unauthenticated remote code execution via crafted requests to /assessment_thanks.do. In the wild exploitation observed from 19 July 2026. CVSS 4.0 score 9.5. Patches available across Brazil, Australia, Zurich, and Yokohama families per KB3137947.
SonicWall SMA1000 CVE-2026-15409 and CVE-2026-15410: chained unauthenticated SSRF plus post authentication AMC code injection yielding arbitrary OS command execution and root. CVSS 10.0 on the SSRF. Active exploitation confirmed. CISA KEV listed with federal remediation deadline already passed. UTA0533 attributed in IR reporting with custom malware and lateral movement from compromised gateways.
WordPress WP2Shell CVE-2026-60137 and CVE-2026-63030: unauthenticated RCE chain on default installs (SQL injection via author__not_in plus REST API batch route confusion). In the wild exploitation confirmed by multiple firms. Public exploits available. Fixed in 6.8.6, 6.9.5, 7.0.2, and 7.1 beta2 with forced auto updates shipping.
SleeperGem malicious RubyGems: git_credential_manager 2.8.0 through 2.8.3, Dendreo 1.1.3 through 1.1.4, fastlane-plugin-run_tests_firebase_testlab 0.3.2 and related fan out. Loader fetches second stage from git.disroot.org/git-ecosystem, evades CI, drops native daemon and persistence, and targets developer credentials and cloud keys.

Strategic business impact
Unpatched ServiceNow instances expose ITSM workflows, integration credentials, and AI augmented operations to full takeover.
Unpatched SMA1000 appliances convert remote access gateways into beachheads for root level access and internal lateral movement.
Unpatched WordPress estates face mass site takeover, malware seeding, customer data exposure, and potential regulatory notification duties.
Infected developer workstations turn one compromised laptop into a path into build systems and cloud production.

Leader decisions required within hours not days
Mandate emergency patch validation for ServiceNow fixed builds, SMA1000 fixed firmware, and WordPress 7.0.2 or 6.9.5 (or confirm host forced auto update completed).
Restrict internet exposure of ServiceNow assessment endpoints and SMA1000 administrative interfaces until patch proof is in hand.
Inventory Ruby dependency trees for the named malicious gems; isolate hit hosts; rotate Git, cloud, SSH, and keychain secrets from those machines as burned.
Order targeted log review using vendor described patterns for ServiceNow, SonicWall, and WordPress before declaring environments clean.
Treat any appliance or instance with positive compromise indicators as rebuild material, not in place cleanup material.

Intelligence quality snapshot
Overall confidence 78. Strongest on SonicWall and ServiceNow because of vendor advisories, NVD, and CISA KEV. WP2Shell exploitation multi vendor confirmed. SleeperGem technically specific and actionable. Gaps remain on atomic attacker network IOCs for the three RCE clusters, source confirmed MITRE IDs, and final SleeperGem yank status. Adjacent awareness only: AI agentic targeting patterns and prior window SharePoint KEV context.

Bottom line for the executive table: if you run ServiceNow, SonicWall SMA1000, WordPress, or Ruby based developer tooling, assume you are in the blast radius until inventory, patch proof, and hunt results say otherwise.

Chapter 02 - Threat & Exposure Analysis

Four concurrent exposure classes dominate the 24 hour window: mass internet facing platform RCE with confirmed exploitation, chained appliance zero days under active abuse, default CMS unauthenticated RCE at global scale, and developer supply chain loaders aimed at cloud and Git credentials.

ServiceNow AI Platform pre authentication RCE (CVE-2026-6875)

ServiceNow AI Platform is affected by a sandbox escape that allows unauthenticated remote code execution under certain conditions. Attackers send crafted HTTP requests to the /assessment_thanks.do endpoint and break out of the script sandbox to execute arbitrary code on the underlying instance. NVD and the vendor advisory confirm the technical nature of the flaw and its potential for platform wide compromise in affected releases across Brazil, Australia, Zurich, and Yokohama product families.

Searchlight Cyber reported the issue privately on 1 April 2026. ServiceNow released patches prior to public exploitation. Defused researchers and subsequent reporting confirm in the wild exploitation beginning 19 July 2026, converting this from a theoretical risk into a pre authentication RCE under active abuse. The vendor acknowledges external reports of exploitation while indicating no evidence of abuse in vendor hosted instances so far. Any internet exposed self managed or incorrectly segmented instance remains a high value initial access vector, especially where ServiceNow integrates with identity, ticketing, and automation tooling.

SonicWall SMA1000 zero day SSRF and RCE chain (CVE-2026-15409, CVE-2026-15410)

SonicWall SMA1000 appliances are affected by two zero day vulnerabilities that chain to full compromise. CVE-2026-15409 is a critical SSRF flaw in the Workplace interface allowing a remote unauthenticated attacker to force arbitrary network requests to attacker chosen destinations. CVE-2026-15410 is a high severity post authentication code injection issue in the Appliance Management Console enabling arbitrary OS command execution.

Together these flaws yield root access on affected remote access appliances and a direct foothold into VPN infrastructure. Vendor product notice, NVD, Tenable, and Help Net Security confirm active exploitation. Volexity incident response attributes at least one campaign to UTA0533, reporting root access, custom malware deployment, and lateral movement from compromised SMA1000 gateways. Both CVEs are listed in the CISA Known Exploited Vulnerabilities catalog. Affected hardware includes SMA6210, SMA7210, and SMA8200v on specified firmware builds. Activity context in IR reporting extends from approximately 22 June 2026 observations through the current window.

WordPress WP2Shell RCE chain (CVE-2026-60137, CVE-2026-63030)

WordPress core versions 6.8 and later (within stated vulnerable ranges) are exposed to a chained exploitation path combining CVE-2026-60137 (SQL injection via the author__not_in parameter in WP_Query) and CVE-2026-63030 (REST API batch endpoint route confusion leading to SQL injection and RCE). The chain permits unauthenticated remote code execution against default WordPress installations when persistent object caching is disabled. No malicious plugin is required.

Patches shipped in 6.8.6, 6.9.5, 7.0.2, and 7.1 beta2. Maintainers enabled forced auto updates for affected versions. SecurityWeek reporting of Patchstack, Hexastrike, and WatchTowr observations confirms in the wild exploitation. Hexastrike honeypots recorded attempts over the weekend preceding 20 July 2026; IR assists and public PoCs followed quickly. Cloudflare published WAF rules for unpatched customers. WatchTowr cited footprint context of hundreds of millions of websites. Operators who remain on vulnerable core without confirmed auto update completion face site takeover, malware seeding, and customer data exposure.

SleeperGem malicious RubyGems loaders

Three malicious RubyGems clusters install a second stage daemon on developer machines while attempting to avoid CI runners. Named packages include git_credential_manager versions 2.8.0 through 2.8.3 (Microsoft Git Credential Manager impersonation), Dendreo versions 1.1.3 through 1.1.4, and fastlane-plugin-run_tests_firebase_testlab version 0.3.2, with dependency fan out into additional packages. On require, the loader fetches a second stage from attacker controlled Forgejo infrastructure at git.disroot.org/git-ecosystem. If CI environment variables are detected the loader exits; otherwise it drops a native daemon, establishes cron and systemd user service persistence, and may attempt a setuid root shell when passwordless sudo is available.

StepSecurity analysis via The Hacker News on 20 July 2026 documents the campaign. Original non malicious history for some dormant packages dates to 2017 and 2018; malicious revival and dual maintainer compromise patterns are suspected. Sector exposure is explicit for software development and DevOps. A single infected workstation can pivot into build pipelines and cloud environments because developer laptops hold cloud keys, Git tokens, and production access.

Emerging AI targeted attacks and agentic misuse (adjacent awareness)

Consulted sources also highlight attacks explicitly targeting AI infrastructure and agentic workflows, including JadePuffer style autonomous agent patterns deploying ransomware against AI models and Hugging Face reporting compromise of internal datasets and credentials via an autonomous AI system. These items underscore that AI orchestration layers (agents, sandboxes, workflow engines) are now integral attack surfaces. They are retained as awareness grade context rather than lead ranking evidence for this brief.

Cross incident pattern analysis

All lead clusters show compressed disclosure to weaponization timelines (PoCs and exploitation within hours to days) and trust boundary abuse (core platform defaults, remote access appliances, package registry plus dormant maintainer accounts). Defenders should not treat these as isolated tickets; shared themes are internet exposure, slow patch proof, and credential reuse after initial access.

Chapter 03 - Operational Response

Assume internet facing ServiceNow, SMA1000, WordPress, and any Ruby developer endpoints are high priority until proven clean and patched.

Immediate priorities (0 to 24 hours)

ServiceNow AI Platform (CVE-2026-6875)
Identify all ServiceNow instances (hosted and self hosted)
Determine family and patch level
Verify installation of fixed releases Brazil EA/GA, Australia Patch 2, Zurich Patch 7b/9, Yokohama Patch 12 HF1b/13 as defined in KB3137947
Restrict public exposure of /assessment_thanks.do and related endpoints via network controls and reverse proxies for any instance that cannot be patched immediately

SonicWall SMA1000 (CVE-2026-15409, CVE-2026-15410)
Enumerate all SMA6210, SMA7210, and SMA8200v appliances
Upgrade affected firmware versions (12.4.3-03245/03387/03434 and 12.5.0-02283/02624/02800 class builds) to the fixed builds specified by SonicWall and Tenable
For appliances with suspected activity, follow vendor guidance to reimage or redeploy and rotate all administrator and user credentials
Reset TOTP tokens
Avoid restoring configurations from backups taken after December 2025 hotfix deployments unless thoroughly validated

WordPress WP2Shell
Inventory all WordPress sites and confirm upgrades to 6.8.6, 6.9.5, 7.0.2, or 7.1 beta2 as appropriate
Confirm host forced auto update path completed where relied upon
Place WAF rules (Cloudflare or equivalent) blocking known exploit patterns if patch lag remains
Disable REST API batch endpoints where business compatible until patch validation completes
Review webserver logs for unusual REST API requests, failed logins, and newly created admin accounts

SleeperGem
Search org wide for installs of git_credential_manager 2.8.0 through 2.8.3, Dendreo 1.1.3 through 1.1.4, fastlane-plugin-run_tests_firebase_testlab 0.3.2, and dependents (slackHtmlToMarkdown, seo_optimizer, array_fast_methods)
On hit hosts: isolate network, remove ~/.local/share/gcm/, remove cron and systemd persistence, check /usr/local/sbin/ping6 for setuid shell, rebuild if root was possible
Rotate GitHub/GitLab tokens, cloud keys, SSH keys, and any secrets present in env or keychains on those machines; treat as burned

Targeted log review and compromise assessment

ServiceNow
Examine HTTP access logs for anomalous requests to /assessment_thanks.do
Watch unexpected integration calls and unusual script execution patterns
Review administrative activity, integration credential changes, and workflow modifications for tampering or privilege escalation

SMA1000
Inspect extraweb_access.log for /_api_/login and /_api_/logout requests returning HTTP 200
Inspect /wsproxy calls with suspicious host parameters and status 101
Check ctrl-service.log for hotfix removal entries with path traversal indicators
Review unit configuration files for added routes

WordPress
Look for unusual use of the REST API batch endpoint
Spikes in author__not_in parameter usage
Anomalous SQL query patterns
Sudden addition of PHP files inside wp-content or upload directories
New admin users, unexpected plugins or themes, outbound callbacks on hosts that were online unpatched after disclosure

SleeperGem
Confirm presence of deploy.sh or native daemon artifacts
Validate absence of attacker controlled Forgejo callbacks to git.disroot.org/git-ecosystem
Review cron, systemd user units, and sudoers for unauthorized changes

Containment and remediation

Network level controls
Until patching and validation are complete, restrict internet exposure of ServiceNow and SMA1000 interfaces by enforcing reverse proxy protection, strong authentication, and IP based filtering for administrative endpoints

Credential and key hygiene
For any suspected compromise, rotate administrator credentials, API keys, and service accounts tied to ServiceNow, SMA1000, WordPress, and affected developer hosts
For SMA1000, reset TOTP tokens and avoid unvalidated post hotfix configuration restores

Forensic follow through
Where indicators are found, treat appliances and instances as compromised
Perform full forensic analysis, identify persistence mechanisms, and rebuild from known good images rather than attempting in place cleanup
Confirmed webshell, mass defacement, daemon C2, or cloud key use escalates to full IR plus legal/privacy review for notification duties

Security hardening actions

Enforce host managed auto updates for CMS core
Inventory internet exposed WordPress by version
Pin gems with checksums and lockfiles; block unapproved registry publishes in CI
Alert on new gem versions from long dormant maintainers
Restrict passwordless sudo on developer workstations
Disable XML-RPC and unused REST surfaces where business compatible (operational hygiene; not confirmed as a universal official WordPress advisory requirement)

Internal security coordination

Notify vulnerability management, web platform owners, SOC, AppSec, developer experience, identity/cloud admins, and communications if customer sites are affected
Escalation path: confirmed webshell, mass defacement, daemon C2, or cloud key use leads to IR plus legal/privacy review
External notification depends on confirmed personal data impact in your jurisdiction; presence of a CVE alone does not create a universal regulator notice duty

Defender priority order today

WP2Shell: mass active exploitation, unauthenticated RCE, huge blast radius
ServiceNow CVE-2026-6875: pre authentication RCE into ITSM and AI workflow fabric
SonicWall SMA1000: KEV listed, root and lateral movement, UTA0533 context
SleeperGem: fewer targets but high value developer credentials and persistence
Backlog hygiene: confirm prior window SharePoint and related KEV patch state only after today’s four leads are under control

Unified timeline across all lead clusters from consulted sources:

2017-10-14 / 2018-02-06
Original non malicious package history for Dendreo and the fastlane plugin variants that later appear in the SleeperGem cluster (dormant for years afterward)

2026-04-01
Searchlight Cyber privately reports ServiceNow CVE-2026-6875 to ServiceNow

Approximately 2026-06-22 onward
Volexity related IR context for SMA1000 exploitation activity associated with UTA0533 begins appearing in campaign timelines (awareness grade anchor for actor dwell)

2026-07-12
NVD publishes CVE-2026-6875
ServiceNow issues advisory KB3137947 with patches for multiple product families

2026-07-13
SonicWall publishes product notice for SMA1000 vulnerabilities CVE-2026-15409 and CVE-2026-15410
Help Net Security and Tenable report active exploitation and urge urgent patching plus log review

2026-07-14
CISA adds CVE-2026-15409 and CVE-2026-15410 to the Known Exploited Vulnerabilities catalog with a remediation deadline of 17 July 2026 for US federal civilian agencies

2026-07-16 to 2026-07-18
WordPress releases fixed versions 6.8.6, 6.9.5, 7.0.2, and 7.1 beta2 for the WP2Shell chain
VulnCheck, Beazley Security, and Rapid7 publish technical analysis of CVE-2026-60137 and CVE-2026-63030
Forced auto updates enabled for affected WordPress versions
Malicious git_credential_manager 2.8.0 through 2.8.3 published to RubyGems (18 July 2026)

Weekend approximately 2026-07-18 to 2026-07-19
Hexastrike honeypots see WP2Shell exploitation attempts
IR assists begin
Public PoCs for WP2Shell circulate

2026-07-19
Defused researchers observe in the wild exploitation of ServiceNow CVE-2026-6875
BleepingComputer reports active pre authentication sandbox escape RCE attacks hitting ServiceNow instances
SecurityWeek reports multi vendor confirmation of WP2Shell in the wild exploitation
Cloudflare WAF rules for WP2Shell go live for unpatched customers

2026-07-20
BleepingComputer and SecurityWeek highlight ongoing exploitation of ServiceNow and SonicWall vulnerabilities
The Hacker News publishes StepSecurity analysis of SleeperGem
Continued WP2Shell exploitation risk for non updated estates

2026-07-21
This brief window close
Defenders should assume malicious gems may still be reachable until yanked or blocked org wide (yank status not confirmed in consulted sources at write time)
Unpatched ServiceNow, SMA1000, and WordPress estates remain under active threat

Pre 18 July 2026 (date unconfirmed in some pulls)
Searchlight Cyber discovery path for the WP2Shell chain and coordinated route to patch

Chapter 04 - Detection Intelligence

ServiceNow AI Platform sandbox escape (CVE-2026-6875)

CVE-2026-6875 is a code injection vulnerability in the ServiceNow AI Platform script sandbox. An unauthenticated attacker, under certain conditions, executes code within the platform by abusing the /assessment_thanks.do endpoint. Vendor advisory and NVD describe it as a sandbox escape in the layer that underpins IT service management and workflow tools, with a critical CVSS 4.0 score of 9.5.

Exploitation involves crafted HTTP requests that reach vulnerable script evaluation paths, bypass sandbox isolation, and enable arbitrary code execution inside the ServiceNow environment. Because the flaw is unauthenticated, any internet exposed instance with affected configurations is susceptible. High value follows from downstream integrations with identity, ticketing, and automation tooling. Affected release families include Brazil, Australia, Zurich, and Yokohama prior to the fixed builds in KB3137947. Private disclosure occurred 1 April 2026; public exploitation telemetry begins 19 July 2026.

SonicWall SMA1000 SSRF and code injection chain (CVE-2026-15409, CVE-2026-15410)

CVE-2026-15409 is a server side request forgery vulnerability in the SMA1000 Workplace interface. A remote unauthenticated attacker forces the appliance to make arbitrary network requests to attacker chosen destinations. CISA, NVD, and vendor advisories classify it as critical with a CVSS score of 10.0 and CWE-918 mapping.

CVE-2026-15410 is a post authentication code injection flaw in the Appliance Management Console, mapped to CWE-94, enabling an authenticated administrator to execute arbitrary operating system commands.

Adversaries chain these flaws by first using SSRF to pivot through the appliance and then leveraging AMC code injection to run arbitrary commands, ultimately obtaining root on SMA1000 gateways. Vendor guidance and Tenable analysis indicate exploitation has already produced command execution, credential extraction, and lateral movement into internal networks. Affected platforms include SMA6210, SMA7210, and SMA8200v on listed firmware trains. UTA0533 related IR describes custom malware deployment after root.

WordPress WP2Shell SQLi and REST API route confusion (CVE-2026-60137, CVE-2026-63030)

CVE-2026-60137 is a SQL injection vulnerability in the author__not_in parameter of WP_Query. Affected core ranges include 6.8.0 through 6.8.5, 6.9.0 through 6.9.4, and 7.0.0 through 7.0.1.

CVE-2026-63030 is a REST API batch endpoint route confusion flaw affecting 6.9.0 through 6.9.4 and 7.0.0 through 7.0.1. It can misroute attacker controlled input to unintended code paths and trigger SQL injection.

When chained, these vulnerabilities permit remote code execution on default WordPress installations, particularly where persistent object caching is not enabled. Searchlight Cyber described no special preconditions and exploitability on a bare install. Security research indicates batch endpoint misrouting allows crafted requests to reach SQLi vulnerable paths, enabling attackers to insert or modify data that ultimately results in arbitrary PHP execution. Public exploits released shortly after disclosure. Fixed versions: 6.8.6, 6.9.5, 7.0.2, 7.1 beta2. Forced auto updates and Cloudflare WAF rules reduce but do not eliminate residual risk for non updated estates.

SleeperGem malicious RubyGems technical progression

Attack progression from consulted analysis:
Victim installs one of the three malicious gem clusters
Loader runs on require
Loader fetches second stage from attacker controlled Forgejo at git.disroot.org/git-ecosystem
If CI environment variables are detected, loader exits (defense evasion against runners)
Otherwise drops native daemon, establishes persistence via cron and systemd user service
Optional setuid root shell attempt if passwordless sudo is available (path check associated with /usr/local/sbin/ping6)
Windows path via PowerShell noted in analysis
Artifact directory pattern: ~/.local/share/gcm/
Payload names cited: deploy.sh plus native binary

Exploitability is social and package trust abuse, not a product CVE. Typosquat and impersonation of Git Credential Manager naming; dormant packages revived after years; releases lacking matching upstream commits or tags. Dependency fan out into slackHtmlToMarkdown, seo_optimizer, and array_fast_methods expands blast radius inside Ruby lockfiles.

Shared technical themes

Pre authentication or low precondition network exploitation against commodity internet facing surfaces
Trust boundary failures (script sandbox, appliance management plane, CMS defaults, package registry)
Fast public weaponization
Post exploitation focus on credentials, persistence, and lateral movement rather than noisy destructive impact alone

Published atomic attacker infrastructure remains limited. Most lead clusters are telemetry and path focused rather than classic IP domain hash rich. Treat the following as the full honest inventory from consulted sources.

ServiceNow CVE-2026-6875
No explicit attacker IPs, domains, hashes, or exploit URLs published in vendor advisories or independent reporting reviewed
Publicly available sources state that no classic network IOC set has been released
Detection surface is path and telemetry oriented: POST activity to /assessment_thanks.do, non standard user agents, script evaluation failures, sandbox exceptions, unexpected integration credential changes, workflow modifications

SonicWall CVE-2026-15409 and CVE-2026-15410
Vendor and research guidance emphasize local host and log indicators rather than external attacker infrastructure
extraweb_access.log: /_api_/login and /_api_/logout returning HTTP 200
extraweb_access.log: /wsproxy calls with suspicious host parameters and status 101
ctrl-service.log: hotfix removal entries containing path traversal indicators such as ../ sequences
Unit configuration files: unauthorized added routes
No stable public C2 IP or domain list for UTA0533 confirmed in the reviewed set
Custom malware referenced in IR reporting without a published durable public hash set at time of brief

WordPress WP2Shell
Sources emphasize vulnerable code paths and version ranges rather than concrete attacker infrastructure
Hunting focus: REST API batch endpoint abuse, author__not_in parameter spikes, anomalous SQL patterns, new PHP files under wp-content or uploads, new admin users, unexpected plugins or themes, outbound callbacks from previously unpatched hosts
Generic webshell string patterns are detection aids, not campaign specific hashes
No confirmed shared scanner infrastructure list published in consulted sources

SleeperGem (actionable package, path, domain, and URL class indicators)

Malicious package versions
git_credential_manager 2.8.0
git_credential_manager 2.8.1
git_credential_manager 2.8.2
git_credential_manager 2.8.3
Dendreo 1.1.3
Dendreo 1.1.4
fastlane-plugin-run_tests_firebase_testlab 0.3.2

Dependency fan out cited in analysis
slackHtmlToMarkdown
seo_optimizer
array_fast_methods

Infrastructure
git.disroot.org/git-ecosystem (attacker controlled Forgejo host for second stage fetch)

Payload and persistence artifacts
deploy.sh
native daemon binary
~/.local/share/gcm/ directory
cron persistence entries
systemd user service persistence
/usr/local/sbin/ping6 setuid shell check path
Windows PowerShell second stage path

IOC type summary present in this brief
Domain
URL and request path patterns
File path
Package name
Log pattern
Behavioral telemetry

Explicitly not confirmed
Additional attacker IPs beyond what defenders observe in their own logs
Malware family hashes beyond UTA0533 custom tooling references without public values
External C2 endpoints outside the SleeperGem Forgejo host
Any claim that merges WP2Shell scanning infrastructure with SleeperGem loader infrastructure

Operational stance
IOC coverage is telemetry first for ServiceNow, SonicWall, and WordPress
IOC coverage is package and path first for SleeperGem
Enrichment status remains Pending for passive DNS, reputation, and detonation cycles
Do not wait on enrichment to patch, inventory gems, rotate credentials, or deploy the log based detections in the Detection Engineering chapter

Detection content below merges vendor described log patterns, multi firm WP2Shell hunt guidance, and SleeperGem host signals from consulted sources. Rules are experimental analyst derived aids, not production validated signatures. Baseline before enforce. Special formatting is limited to codeblocks only.

SIGMA style: SonicWall SMA1000 SSRF and AMC exploitation

title: SonicWall SMA1000 SSRF and AMC Exploitation (CVE-2026-15409, CVE-2026-15410)
id: inferlume-sigma-sma1000-ssrf-amc
status: experimental
description: Detects patterns associated with exploitation of SonicWall SMA1000 SSRF and AMC code injection vulnerabilities using vendor described log fields.
logsource:
  product: sonicwall
  service: extraweb_access

detection:
  selection_ssrf_login_logout:
    http_status: 200
    request_path|contains:
      - "/__api__/login"
      - "/__api__/logout"

  selection_wsproxy_tunnel:
    http_status: 101
    request_path: "/wsproxy"
    host_param|startswith: "http"

  condition: selection_ssrf_login_logout or selection_wsproxy_tunnel

fields:
  - timestamp
  - src_ip
  - request_path
  - http_status
  - host_param

falsepositives:
  - Legitimate administrative use of Workplace API (baseline required)
level: high

SIGMA style: SonicWall SMA1000 hotfix tampering

title: SonicWall SMA1000 Hotfix Tampering (CVE-2026-15409, CVE-2026-15410)
id: inferlume-sigma-sma1000-hotfix-tamper
status: experimental
description: Detects potential removal or tampering of SMA1000 hotfixes via ctrl-service.log entries containing path traversal indicators.
logsource:
  product: sonicwall
  service: ctrl-service

detection:
  selection_hotfix_removal:
    message|contains: "hotfix removal"
    message|contains: "../"

  condition: selection_hotfix_removal

fields:
  - timestamp
  - message

falsepositives:
  - Rare; manual maintenance operations should be documented
level: critical

SIGMA style: suspicious WordPress REST batch burst (WP2Shell)

title: Suspicious WordPress REST Batch Burst Pre Auth
id: inferlume-sigma-wp2shell-rest-batch
status: experimental
description: Detects burst POST activity against WordPress REST batch style paths consistent with WP2Shell pre auth exploitation patterns.
logsource:
  category: webserver

detection:
  selection:
    cs-method: POST
    cs-uri-stem|contains:
      - "/wp-json/"
      - "batch"
  timeframe: 5m
  condition: selection | count() by src_ip > 20

falsepositives:
  - Legitimate bulk admin or migration tooling (baseline required)
level: high

SIGMA style: SleeperGem Forgejo second stage fetch

title: SleeperGem Forgejo Second Stage Fetch
id: inferlume-sigma-sleepergem-forgejo
status: experimental
description: Detects network or PowerShell activity associated with SleeperGem second stage retrieval from attacker controlled Forgejo infrastructure.
logsource:
  product: windows

detection:
  selection_net:
    DestinationHostname|contains: "git.disroot.org"
  selection_ps:
    Image|endswith: "\\powershell.exe"
    CommandLine|contains:
      - "git.disroot"
      - "deploy.sh"
  condition: selection_net or selection_ps

falsepositives:
  - Rare legitimate use of disroot Forgejo (allowlist known business cases)
level: critical

YARA style: generic PHP webshell in WP2Shell context

rule Inferlume_WP2Shell_Generic_Webshell
{
    meta:
        description = "Detects generic PHP webshell patterns in WordPress installations potentially exploited via WP2Shell"
        author = "Inferlume CTI"
        reference = "WP2Shell chain (CVE-2026-60137, CVE-2026-63030)"
    strings:
        $php_tag = "<?php" nocase
        $eval_base64 = "eval(base64_decode" nocase
        $assert_post = "assert($_POST" nocase
        $shell_exec = "shell_exec" nocase
        $passthru = "passthru" nocase
        $filesman = "FilesMan" nocase
        $c99 = "c99shell" nocase
    condition:
        $php_tag and 2 of ($eval_base64, $assert_post, $shell_exec, $passthru, $filesman, $c99)
}

YARA style: SleeperGem loader strings

rule Inferlume_SleeperGem_Loader_Strings
{
    meta:
        description = "Detects string patterns associated with SleeperGem loader and persistence artifacts"
        author = "Inferlume CTI"
        reference = "SleeperGem RubyGems campaign"
    strings:
        $a = "git.disroot.org/git-ecosystem" ascii
        $b = ".local/share/gcm" ascii
        $c = "/usr/local/sbin/ping6" ascii
        $d = "deploy.sh" ascii
    condition:
        2 of them
}

SIEM pseudocode: ServiceNow CVE-2026-6875 exploitation attempts

Data sources:
  - Web access logs from ServiceNow reverse proxy or WAF
  - Application logs with script evaluation errors

Fields:
  - http_request_path
  - http_method
  - http_status
  - src_ip
  - user_agent
  - app_error_code

Logic:
  1. Filter logs where http_request_path = "/assessment_thanks.do" AND http_method = "POST".
  2. Group by src_ip over 5 minute windows.
  3. Flag src_ip where count of anomalous http_status events >= org threshold AND
     user_agent not in known ServiceNow clients.
  4. Correlate flagged events with app_error_code indicating script evaluation failures
     or sandbox exceptions in the same time window.
  5. Generate high severity alert if correlation exists

SIEM pseudocode: WordPress WP2Shell exploit hunt

Data sources:
  - Web access logs, WAF logs, WordPress audit or debug logs, EDR file and process on web servers

Logic:
  1. Filter http_method in (POST, GET) where url_path matches wp-json, admin-ajax.php, or xmlrpc.php patterns.
  2. Flag status 200 with unusually large bytes_out, suspicious scanner user agents, or response body patterns matching eval(, base64_decode, shell_exec, passthru.
  3. Stats count by src_ip, url_path, host, user_agent; alert when count exceeds org baseline.
  4. Correlate with new PHP under wp-content/uploads, wp-includes, or web root and with new wp_users administrators outside change windows.
  5. Hunt version banners still serving 7.0.0/7.0.1 or 6.9.0 through 6.9.4 with post 18 July admin creation events

SIEM / EDR pseudocode: SleeperGem host signals

Data sources:
  - DeviceProcessEvents or Sysmon, DeviceNetworkEvents, Linux auditd or EDR file events

Logic:
  1. Alert where FolderPath ends with .local/share/gcm or FileName in (deploy.sh, gcm) or (FileName == ping6 and FolderPath contains /usr/local/sbin).
  2. Join to network events where RemoteUrl contains git.disroot.org.
  3. Alert on ruby or gem process lineage followed by curl/wget to git.disroot.org or PowerShell download cradles.
  4. Alert on new systemd user units, cron lines invoking gcm paths, or setuid bit on /usr/local/sbin/ping6.
  5. Estate sweep: Gemfile.lock and gem list for named packages; fleet query for unexpected setuid ping6

Detection context quality and gaps

Data sources that matter: reverse proxy and WAF logs, ServiceNow app logs, SonicWall extraweb_access.log and ctrl-service.log, WordPress web and audit logs, EDR file/process/persistence, Ruby gem inventory, Linux systemd/cron/auditd.

Gaps: no published atomic attacker network IOC sets for ServiceNow, SonicWall, or WP2Shell; encrypted admin-ajax noise; hosts without file integrity monitoring; SleeperGem enrichment still Pending.

Hunt hypotheses this week

Sites unpatched between WP2Shell disclosure and forced update received webshell drops
SMA1000 appliances with hotfix removal and wsproxy anomalies are already rooted
Developer hosts that installed named gems still hold burned cloud and Git secrets even after gem uninstall
ServiceNow instances with POST bursts to /assessment_thanks.do plus sandbox exceptions warrant full integration credential review

Consulted public advisories and analyses for CVE-2026-6875, CVE-2026-15409, CVE-2026-15410, CVE-2026-60137, CVE-2026-63030, and the SleeperGem loaders do not explicitly map these items to numbered MITRE ATT&CK technique IDs. Every technique and tactic below is analyst inferred from described adversary behavior. Downstream detection engineering must label them analyst derived rather than source confirmed.

Inferred techniques by incident

Inferred ID	Name	Basis in narrative	Incident
T1190	Exploit Public Facing Application	Unauthenticated crafted HTTP to /assessment_thanks.do	ServiceNow CVE-2026-6875
T1059	Command and Scripting Interpreter	Sandbox escape to arbitrary code execution in script layer	ServiceNow CVE-2026-6875
T1068	Exploitation for Privilege Escalation	Breakout from script sandbox isolation	ServiceNow CVE-2026-6875
T1078	Valid Accounts	Post compromise abuse of integration credentials	ServiceNow CVE-2026-6875
T1552	Unsecured Credentials	Exposure or theft of integration secrets after instance compromise	ServiceNow CVE-2026-6875
T1190	Exploit Public Facing Application	Unauthenticated SSRF against Workplace interface	SonicWall CVE-2026-15409
T1090	Proxy	SSRF forced requests to attacker chosen destinations	SonicWall CVE-2026-15409
T1059	Command and Scripting Interpreter	AMC code injection yielding OS command execution	SonicWall CVE-2026-15410
T1068	Exploitation for Privilege Escalation	Path from AMC abuse to root on appliance	SonicWall chain
T1078	Valid Accounts	Theft or reuse of administrator and user credentials	SonicWall / UTA0533 context
T1021	Remote Services	Lateral movement from compromised SMA1000 into internal networks	UTA0533 related IR
T1505	Server Software Component	Persistence or tooling placement on appliance after root	SonicWall / UTA0533 context
T1190	Exploit Public Facing Application	Unauthenticated HTTP exploitation of WP_Query and REST batch routes	WP2Shell
T1059.004	Command and Scripting Interpreter: PHP	Arbitrary PHP execution after SQLi plus route confusion	WP2Shell
T1505.003	Server Software Component: Web Shell	Webshell and unexpected PHP under wp-content or uploads	WP2Shell
T1136	Create Account	Sudden creation of new administrator accounts	WP2Shell
T1105	Ingress Tool Transfer	Drop of secondary payloads onto compromised sites	WP2Shell
T1195.002	Supply Chain Compromise: Compromise Software Supply Chain	Malicious gems on public RubyGems registry	SleeperGem
T1204.005	User Execution: Malicious Library	Victim installs or bundles gem; loader runs on require	SleeperGem
T1105	Ingress Tool Transfer	Second stage fetch from git.disroot.org/git-ecosystem	SleeperGem
T1497	Virtualization/Sandbox Evasion	Loader exits when CI environment variables detected	SleeperGem
T1053.003	Scheduled Task/Job: Cron	Cron based persistence on developer hosts	SleeperGem
T1543.002	Create or Modify System Process: Systemd Service	Systemd user service persistence	SleeperGem
T1548.001	Abuse Elevation Control Mechanism: Setuid and Setgid	Optional setuid root shell via /usr/local/sbin/ping6 path	SleeperGem
T1552	Unsecured Credentials	Theft of Git tokens, cloud keys, SSH keys from developer workstations	SleeperGem
T1078	Valid Accounts	Reuse of stolen developer and cloud credentials	SleeperGem

Inferred tactics in kill chain order

Initial Access: exploit of public facing applications (ServiceNow, SonicWall Workplace SSRF, WordPress core) and supply chain compromise (malicious RubyGems)

Execution: sandbox escape and script abuse (ServiceNow), OS command execution on SMA1000, PHP execution on WordPress, gem loader execution on require

Persistence: SleeperGem cron/systemd/setuid and artifact directory; WordPress webshells, rogue plugins, new admins; SonicWall and ServiceNow configuration tampering, hotfix removal patterns, custom malware on appliances

Privilege Escalation: ServiceNow sandbox breakout; SonicWall path to root; SleeperGem setuid attempt; WordPress admin creation and full site control

Defense Evasion: SleeperGem CI environment skip; SonicWall hotfix tampering; abuse of legitimate platform interfaces to blend with normal traffic

Credential Access: SleeperGem developer secret theft; post compromise API key and credential theft on ServiceNow, SMA1000, and WordPress

Discovery and Lateral Movement: SonicWall SSRF as pivot primitive; UTA0533 related lateral movement from SMA1000; ServiceNow integration abuse into identity and automation systems

Command and Control / Collection / Impact (secondary): SleeperGem second stage fetch; WordPress site takeover and malware seeding; ServiceNow workflow and data plane compromise; potential regulatory impact when personal data is involved

Defender priority order for inferred tactics: Initial Access and Execution first (patch and exposure reduction), then Credential Access and Persistence (rotation and rebuild), then Lateral Movement (segmentation and appliance trust downgrade).

D3FEND style defensive themes (analyst inferred): harden public facing applications through rapid patch proof; software bill of materials and dependency allowlists; process lineage detection on gem/ruby to network fetch; reverse proxy and WAF controls on assessment and Workplace endpoints; file integrity monitoring on web roots and developer home paths.

Chapter 05 - Governance, Risk & Compliance

Organizations running ServiceNow, SonicWall SMA1000, WordPress core, or Ruby developer tooling face material governance and risk consequences if these issues remain open on internet exposed or high privilege estates.

Regulatory exposure

Financial services and healthcare: incidents on these platforms can trigger reporting duties under GDPR, UK GDPR, HIPAA, India DPDP, state privacy laws, PCI DSS (if payment pages), or sectoral cyber incident disclosure rules, but only after confirmed personal data impact. Presence of a CVE alone does not create a universal regulator notice duty.

US federal civilian agencies: CISA KEV listing of SonicWall CVE-2026-15409 and CVE-2026-15410 elevates those flaws to mandatory remediation status. The federal deadline of 17 July 2026 has already passed relative to this brief window, which raises audit and accountability exposure for any still open federal instances.

Evidence preservation: snapshot web roots, appliance configs, developer disk images (especially if setuid root is confirmed), and access logs before mass rebuilds. Notification clocks start from awareness of personal data breach, not from CVE publication date.

Contractual and customer duty: MSPs and SaaS operators may owe customer notice if managed ServiceNow, SMA1000, WordPress, or build pipeline exposure is confirmed. DevSecOps contractual obligations can require notice if customer code or keys were exposed. Fact specific legal review required.

Business risk impact

Operational: ITSM and AI workflow takeover; VPN beachhead and internal lateral movement; customer site outages; SEO and malware blacklisting; secret rotation at scale; possible pipeline trust break.

Reputational: public narrative of unpatched CMS mass exploit, appliance zero day root, or developer supply chain failure.

Financial: incident response cost, customer remediation, cloud abuse and fraud from stolen keys, potential regulator scrutiny if notifications are mishandled, loss of trust in AI augmented operations.

Board and risk committee framing

Treat this week as a live test of three controls: patch governance speed, asset inventory quality (do you even know every ServiceNow instance, SMA1000, WordPress version, and Ruby lockfile?), and risk based vulnerability management aligned to KEV driven prioritization.

Two practical failures matter immediately: public websites still on vulnerable WordPress builds can be taken over without a login; a handful of poisoned software packages can hand attackers the keys sitting on developer laptops. Neither requires a nation state story to hurt revenue or trust. Speed of patching and secret rotation is the control that matters.

CISO risk decisions today

Escalate: internet facing unauthenticated RCE with confirmed exploitation on WordPress and ServiceNow; KEV listed SonicWall chain with root and lateral movement. Treat as P1 patch compliance metrics within hours.

Escalate: engineering org secret hygiene for any host that touched named SleeperGem packages; monitor registry wide if estate scan returns zero hits.

Monitor only after proof: prior window SharePoint and related KEV backlog items rank below today’s four leads.

Governance actions checklist

Require written patch proof for ServiceNow KB3137947 builds, SMA1000 fixed firmware, and WordPress 7.0.2 / 6.9.5 (or confirmed forced auto update)
Require gem estate attestation and credential rotation evidence from engineering leadership
Map internet exposed instances to business owners and data classifications within 24 hours
Brief legal/privacy on notification decision trees for confirmed webshell, mass defacement, daemon C2, or cloud key use
Report KEV closure status for SonicWall CVEs to risk committee even if outside federal scope, as a proxy for critical infrastructure diligence

Chapter 06 - Adversary Emulation

Red and purple teams may use these scenarios only in controlled lab environments or on explicitly authorized internal systems. Do not run public RCE exploit payloads against production. No source confirmed ATT&CK mapping exists; scenarios use inferred techniques labeled as such. Focus is defensive verification.

ServiceNow CVE-2026-6875 validation

Scope: vendor approved test instances only
Approach: benign payloads against /assessment_thanks.do; confirm WAF rules and anomaly detection distinguish exploitation shaped traffic from legitimate clients
Expected detection: reverse proxy or WAF hit on anomalous POST to /assessment_thanks.do; SOC alert; correlation with script evaluation or sandbox exception logs
Failure signal: exploitation shaped requests reach the instance with 200 and no alert
Inferred technique under test: T1190, T1059 (analyst derived)
Purple add on: tabletop of integration credential rotation and workflow integrity review after simulated sandbox escape

SonicWall SMA1000 validation

Scope: isolated lab appliances or vendor provided simulation only; never production gateways
Approach: simulate SSRF request shapes to Workplace interfaces and controlled AMC code injection in lab; verify logging of /_api_/login, /_api_/logout, /wsproxy status 101, and hotfix removal path traversal messages; verify alerting and containment playbooks fire
Expected detection: high or critical alerts from extraweb_access and ctrl-service detections; containment ticket opened; credential rotation workflow triggered
Failure signal: SSRF or hotfix tamper patterns generate no log or no alert
Inferred techniques under test: T1190, T1090, T1059, T1068 (analyst derived)
Purple add on: tabletop of reimage versus in place cleanup decision and TOTP plus admin credential reset

WordPress WP2Shell validation

Scope: isolated lab on intentionally vulnerable 7.0.1 or 6.9.4 class builds
Approach: replay benign authenticated admin baselines; validate WAF rules block known public PoC request shapes in test mode without running exploit payloads on production; verify FIM on webroot; verify alerts on REST batch bursts and new PHP under uploads
Expected detection: WAF signature hit plus SOC alert; FIM alert on new PHP; optional YARA hit on generic webshell strings
Failure signal: PoC shaped requests reach origin with 200 and no alert; webshell file creates silently
Inferred technique under test: T1190 (analyst derived)
Purple add on: measure percent of estate on 7.0.2 or 6.9.5 within 24 hours; tabletop webshell discovery to customer notification decision tree

SleeperGem validation

Scope: disposable VMs only; do not fetch real attacker Forgejo payloads on corporate network
Approach: install a harmless canary gem that only writes a test file under a monitored path; validate EDR alerts on ~/.local/share/gcm/ style paths, systemd user unit creation, cron lines, and unexpected setuid on ping6 style paths; validate network alert concepts against a lab sinkhole rather than live git.disroot.org if policy requires
Expected detection: EDR file plus persistence alert; optional YARA string hit; SOC ticket for credential rotation
Failure signal: silent daemon path creation or silent systemd user unit
Inferred techniques under test: T1195.002, T1543.002, T1053.003, T1548.001 (analyst derived)
Purple add on: exercise dependency allowlisting that blocks installs from maintainers dormant beyond N years without security review; validate secret scanning after simulated laptop compromise

Cross scenario validation metrics

Time to patch proof for each platform family
Time to first high fidelity alert after simulated technique
Time to credential rotation completion on hit hosts
False positive rate after one week baseline on ServiceNow assessment traffic and WordPress REST admin tooling
Inventory completeness: percent of ServiceNow instances, SMA1000 appliances, WordPress versions, and Ruby lockfiles known to the CMDB before versus after the exercise

Rules of engagement reminder

Authorized systems only
No production exploit payloads
No real second stage downloads from attacker infrastructure on corporate networks
Document inferred versus source confirmed language in every purple team report
Rebuild lab assets from known good images after each run

Intelligence Confidence78%

Overall confidence score for the combined authoritative record: 78

Factor	Effect on score	Detail
Authoritative advisories and catalogs	Strong upward	NVD, ServiceNow KB3137947, SonicWall product notice, CISA KEV for CVE-2026-15409 and CVE-2026-15410
Multi outlet exploitation corroboration	Strong upward	Defused and BleepingComputer on ServiceNow in the wild; Tenable, Help Net Security, Volexity on SonicWall; Patchstack, Hexastrike, WatchTowr via SecurityWeek on WP2Shell; StepSecurity via The Hacker News on SleeperGem
Technical specificity of remediation	Upward	Patch matrices, firmware builds, WordPress fixed versions, named malicious gem versions, vendor log IOC patterns
Atomic attacker network IOC sets	Downward	None published for ServiceNow, SonicWall, or WP2Shell clusters in consulted sources
Source confirmed MITRE IDs	Downward	None; all technique and tactic mappings are analyst inferred
Vendor versus third party discrepancy	Mild downward	ServiceNow reports no observed abuse in hosted instances while third party telemetry reports active attacks
WP2Shell official NVD base scores	Mild downward	Incomplete in one research pull; operational Critical retained from exploitation evidence
SleeperGem attribution and yank status	Mild downward	Operators under attribution; registry yank not confirmed at write time
Adjacent AI infrastructure items	Neutral	Retained as awareness only; not scored as lead evidence
Marketing only content	Neutral	Excluded from technical conclusions