KNUCKLEBALL persistence via /etc/init.d/workplace boot script modification

Ethan Andrews@eandrews

•updated Aug 3, 2026•2•0•5

Detects unauthorized modifications to the /etc/init.d/workplace initialization script on SonicWall SMA appliances, specifically looking for additions of commands that launch the KNUCKLEBALL Python-based loader (deploy_new.py). This behavior indicates an adversary attempting to establish boot-time persistence.