INC Ransomware Emerges as Dominant Actor Exploiting SonicWall SMA 1000 Flaws

Published:

3 augustus 2026 om 18:15:13

Alert date:

3 augustus 2026 om 19:01:09

Source:

thehackernews.com

Network Infrastructure, Ransomware & Malware, Zero-Day Vulnerabilities, Identity & Access, Data Breach & Exfiltration

The INC Ransomware group has been identified as the dominant threat actor exploiting recently disclosed vulnerabilities in SonicWall Secure Mobile Access (SMA) 1000 series VPN appliances. According to a report by Resecurity, INC Ransomware significantly accelerated its activity starting in August 2026, listing multiple new victims on its data leak site. The group is actively leveraging security flaws in the SonicWall SMA 1000 product line to gain unauthorized access to target networks. This campaign represents a sharp escalation in exploitation activity tied to these specific vulnerabilities. The SonicWall SMA 1000 series is widely used by enterprises for secure remote access, making this a high-impact threat to corporate environments. Organizations using affected SonicWall appliances are urged to apply patches and monitor for indicators of compromise immediately.

Technical details

INC Ransomware has been identified as the dominant threat actor exploiting two chained zero-day vulnerabilities (CVE-2026-15409 and CVE-2026-15410) in SonicWall SMA 1000 series VPN appliances. Pre-disclosure exploitation began as early as June 22, 2026, attributed by Volexity to threat cluster UTA0533. The attack chain involves deployment of a Python script named KNUCKLEBALL to launch Suo5 (an open-source HTTP proxy) and a Behinder-like custom Java web shell dubbed ORANGETAIL. The vulnerabilities can be chained to achieve arbitrary command execution and full device takeover. Attackers leveraged the foothold to extract high-value credentials, active session databases, and TOTP MFA seed configurations to ensure persistent access and enable lateral movement into internal corporate networks. Rapid7 confirmed significant tactical overlap between UTA0533 activity and INC Ransomware campaigns, suggesting a single actor or coordinated group. Victims received social engineering pressure tactics including phone calls and emails from individuals claiming to help with ransomware issues, with one caller identifying as 'Andrew' using phone number +1 (304) 384-0401 and providing email info@helprans[.]com for negotiations.

Mitigation steps:

1. Immediately patch SonicWall SMA 1000 appliances to the latest version (fixes released by SonicWall in mid-July 2026). 2. Perform comprehensive threat hunting across the environment. 3. Rotate all credentials, especially those that may have been accessible through the SMA 1000 appliance. 4. Perform integrity verification of affected systems. 5. Identify external source addresses that interacted with /wsproxy or used unusual parameters. 6. Correlate /wsproxy interactions with internal authentication and lateral-movement activity. 7. Review and revoke any active session databases that may have been exfiltrated. 8. Audit and reset TOTP MFA seed configurations that may have been compromised. 9. Be alert to unsolicited phone calls or emails from individuals claiming to assist with ransomware issues.

Affected products:

SonicWall Secure Mobile Access (SMA) 1000 series VPN appliances