The INC Ransomware group has been identified as the leading threat actor actively exploiting the recently disclosed security vulnerabilities affecting SonicWall SMA 1000 series Secure Mobile Access appliances, rapidly expanding its operations and targeting organizations worldwide.
According to threat intelligence firm Resecurity, the ransomware operation significantly increased its activity throughout late July and early August 2026, adding numerous new victims to its data leak portal. Based on publicly available ransomware-tracking statistics, INC Ransomware has now claimed responsibility for hundreds of victims globally, making it one of the most active ransomware groups currently operating.
Exploitation of Critical SonicWall Vulnerabilities
The attacks are believed to leverage two recently patched SonicWall vulnerabilities:
- CVE-2026-15409
- CVE-2026-15410
When combined, these flaws can enable attackers to execute arbitrary commands and potentially gain complete control of vulnerable SMA 1000 appliances.
SonicWall released security updates addressing the vulnerabilities in July 2026. However, security researchers believe threat actors exploited the weaknesses before patches became publicly available, effectively turning them into zero-day attack vectors.
From Initial Access to Network-Wide Compromise
Investigations into the attacks indicate that attackers used the vulnerabilities to establish an initial foothold within target environments before harvesting valuable authentication and identity data.
Researchers found evidence that the threat actors were extracting:
- High-value user credentials
- Active session information
- Authentication databases
- Multi-factor authentication (MFA) configurations
- Time-Based One-Time Password (TOTP) seed data
The theft of these assets provides attackers with long-term persistence and significantly increases their ability to bypass security controls, maintain access, and move laterally through corporate networks.
Threat Activity Predates Public Disclosure
Further analysis by security researchers revealed that exploitation activity began weeks before the vulnerabilities became publicly known.
Threat researchers attributed the early attacks to a cluster they track as UTA0533, which was observed targeting vulnerable SonicWall devices beginning in June 2026.
The attackers deployed a Python-based tool known as KNUCKLEBALL, which was used to launch:
- Suo5, an open-source HTTP proxy framework
- ORANGETAIL, a custom web shell resembling Behinder-style malware
These tools allowed the attackers to establish remote access, tunnel traffic, and maintain persistent control over compromised environments.
Subsequent investigations found significant overlaps between multiple independent research efforts, suggesting that the same threat actor or a closely coordinated group was responsible for discovering and exploiting the vulnerabilities during the early stages of the campaign.
Global Organizations Targeted
New victims associated with the campaign span both government and private-sector organizations across multiple regions, including:
- United States
- Australia
- United Arab Emirates
- Switzerland
- Colombia
- Other international locations
Affected industries include:
- Government agencies
- Critical infrastructure
- Financial services
- Professional services
- Manufacturing
- Technology organizations
The broad geographic distribution of victims highlights the global nature of the campaign and the widespread deployment of SonicWall SMA appliances.
Psychological Pressure and Extortion Tactics
Researchers also uncovered aggressive social-engineering techniques used by the ransomware operators after compromising organizations.
In multiple incidents, victims reportedly received:
- Extortion emails
- Direct phone calls
- Negotiation demands from individuals claiming to represent the attackers
Some organizations were contacted by an individual identifying himself as "Andrew," who informed victims that their networks had already been compromised and instructed them to continue discussions through a dedicated negotiation email address.
These approaches appear designed to increase psychological pressure and accelerate ransom negotiations.
Security experts note that direct communication through phone calls has become an increasingly common tactic among modern ransomware groups seeking to intensify the sense of urgency among victims.
Recommended Defensive Actions
Security teams using SonicWall SMA 1000 appliances should immediately verify that all systems have been updated with the latest vendor patches.
In addition to patching, organizations are advised to:
- Perform comprehensive threat-hunting activities
- Rotate all administrative and privileged credentials
- Reset affected MFA configurations
- Review VPN and authentication logs
- Conduct integrity checks on critical systems
- Investigate unusual authentication activity
- Search for evidence of lateral movement
Security analysts also recommend examining network logs for suspicious interactions involving:
/wsproxy- Unusual connection parameters
- Unknown external IP addresses
- Authentication anomalies occurring after appliance access
Correlating these indicators with internal authentication events may help organizations identify whether attackers successfully gained access to internal systems.
Growing Risk to Remote Access Infrastructure
The campaign highlights the continued focus ransomware groups place on externally facing remote-access infrastructure. VPN appliances, secure remote-access gateways, and identity systems remain high-value targets because they often provide direct pathways into corporate environments.
The emergence of INC Ransomware as the primary actor exploiting these SonicWall vulnerabilities demonstrates how quickly threat groups can operationalize newly discovered flaws and transform them into large-scale ransomware campaigns.
Organizations that rely on SonicWall SMA 1000 devices should treat these vulnerabilities as high-priority risks and assume compromise is possible until thorough security validation has been completed.
Found this article interesting? Follow us on X(Twitter) ,Threads and FaceBook to read more exclusive content we post.
