INC Ransomware Emerges as the Top Exploiter of SonicWall SMA 1000 Vulnerabilities

The INC Ransomware operation has become, in Resecurity's assessment, the “dominant threat actor” exploiting recently disclosed vulnerabilities in SonicWall's Secure Mobile Access (SMA) 1000 series VPN appliances. In a report published over the past weekend, researchers described a sharp uptick in the group's activity since the start of August 2026, along with the appearance of new victims on its leak site. According to Ransomware.Live statistics, INC Ransomware has already claimed 885 victims, the most recent of which was added on August 2, 2026.

The Vulnerability Chain

The attacks are believed to leverage CVE-2026-15409 and CVE-2026-15410. When strung together, they allow arbitrary commands to be executed and the vulnerable device to be fully taken over. SonicWall released fixes in mid-July 2026, but both flaws are thought to have been used as zero-day vulnerabilities.

According to Rapid7, the attackers used the foothold they gained to extract valuable credentials, active session databases, and TOTP seed configurations for multi-factor authentication. The goal was to secure long-term, persistent access and to move further laterally inside the corporate network.

Volexity attributed the pre-disclosure exploitation, which began on June 22, 2026, to a cluster it tracks under the name UTA0533. The attacks used a Python script called KNUCKLEBALL, which launched the open-source HTTP proxy Suo5, as well as a custom Java web shell called ORANGETAIL that resembles Behinder. Rapid7 noted significant tactical overlap with its own investigations, pointing to a single operator or a coordinated group.

Victims and Pressure

Among the new victims added between July 17 and August 1, 2026 are private companies and government organizations from Australia, the United States, the UAE, Colombia, Switzerland, and other countries.

Of particular interest are the pressure tactics. Many victims, according to Resecurity, received emails and calls from unknown organizations claiming to offer help with the ransomware problem. In a number of cases, they were contacted by a person who identified himself as “Andrew,” calling from +1 (304) 384-0401. He claimed to be calling “on behalf of a group of hackers,” reported that the network had been compromised, and at the end of the conversation left the address info@helprans[.]com for negotiations. Techniques like these are a typical ransomware psychological-pressure tactic.

Recommendations

Customers are strongly advised to update their SMA 1000 appliances to the latest version immediately. Resecurity also recommends conducting a comprehensive threat hunt, rotating credentials, and verifying system integrity. In particular, it is worth identifying external addresses that accessed /wsproxy or used unusual parameters, and correlating them with internal authentication and signs of lateral movement.

Source: The Hacker News