INC Ransomware Exploits SonicWall SMA 1000 Vulnerability Chain
INC Ransomware has emerged as the dominant threat actor exploiting two recently disclosed flaws in SonicWall Secure Mobile Access (SMA) 1000 series VPN appliances, Resecurity reported. Ransomware.Live lists 885 victims claimed by the group, with the latest added on August 2, 2026.
The suspected entry route is a chain involving CVE-2026-15409 and CVE-2026-15410. Together, the vulnerabilities can enable arbitrary command execution and the takeover of susceptible appliances. SonicWall released fixes for both flaws in mid-July 2026.
Zero-day access exposed valuable authentication data
The two vulnerabilities are assessed to have been weaponized as zero-days. Rapid7 found that attackers used their foothold to extract high-value credentials, active session databases and Time-Based One-Time Password MFA seed configurations. The objective was to retain persistent access and move laterally into internal corporate networks.
Volexity attributed exploitation beginning on June 22, before disclosure, to a cluster it tracks as UTA0533. The activity included a Python script called KNUCKLEBALL, which launched the open-source Suo5 HTTP proxy and a Behinder-like custom Java web shell named ORANGETAIL.
Rapid7 said the campaign had significant tactical overlap with its investigations. Douglas McKee, the company's director of vulnerability intelligence, said the technical correlation pointed to one threat actor or a coordinated group discovering and exploiting the zero-day chain, with INC Ransomware becoming its dominant active user.
Victims face technical compromise and direct pressure
Resecurity said victims posted by INC Ransomware from July 17 through August 1 included private-sector and government organizations in Australia, the United States, the United Arab Emirates, Colombia, Switzerland and other countries.
Some victims also received emails and calls from unknown organizations offering assistance with ransomware issues. In reported cases, a caller using the name “Andrew” said he represented a group of hackers, stated that the network was compromised and supplied an email address for negotiations. Resecurity characterized such contact as a ransomware pressure tactic.
This use of direct outreach reinforces how ransomware pressure tactics built on borrowed trust can extend a technical intrusion into a broader effort to influence a victim's response.
What organizations should do now
Organizations running SMA 1000 appliances should upgrade immediately to the latest version. Patching alone may not remove access already established before remediation, so Resecurity also recommends comprehensive threat hunting, credential rotation and integrity verification.
Security teams should identify external source addresses that interacted with /wsproxy or supplied unusual parameters, then correlate those events with internal authentication and lateral-movement activity. For businesses, the practical implication is clear: treat affected appliances as potentially compromised, validate their integrity and investigate for persistence before returning them to trusted operation.