INC Ransomware Is Now the Main Group Exploiting SonicWall SMA 1000 Flaws, Researchers Say

The INC ransomware operation has become the “dominant threat actor” exploiting two recently patched flaws in SonicWall’s Secure Mobile Access (SMA) 1000 series VPN appliances, according to security researchers cited by The Hacker News.

In a report published over the weekend, Resecurity said INC has stepped up its activity since the start of August, listing new victims on its data leak site between July 17 and August 1. They include private companies and government organizations in Australia, the U.S., the U.A.E., Colombia and Switzerland. Ransomware.Live counts 885 victims claimed by the group so far, the most recent posted on August 2.

Zero-days first, then ransomware

The attacks are believed to chain CVE-2026-15409 and CVE-2026-15410, which together allow arbitrary command execution and takeover of vulnerable devices. SonicWall released fixes in mid-July. Rapid7 said the flaws were exploited as zero-days, with attackers pulling high-value credentials, active session databases and TOTP multi-factor authentication seed configurations to keep long-term access and move into internal networks.

Volexity traced exploitation back to June 22, before disclosure, and attributed it to a cluster it tracks as UTA0533. Those attackers deployed a Python script named KNUCKLEBALL to launch Suo5, an open-source HTTP proxy, along with a custom Java web shell called ORANGETAIL. Rapid7 told The Hacker News the campaign overlaps significantly with its own investigations.

“This strong technical correlation indicates that a single threat actor or coordinated group is responsible for discovering and exploiting this zero-day vulnerability,” said Douglas McKee, director of vulnerability intelligence at Rapid7. “More recently, INC Ransomware has emerged as the dominant threat actor actively weaponizing this vulnerability chain.”

Resecurity also said many new victims received emails and phone calls from unknown organizations offering to help with the ransomware, including a caller who said he was phoning “from a group of hackers” and then supplied an email address for negotiations. The company described these as pressure tactics often used by ransomware groups.

Three years of growth

INC started as a ransomware-as-a-service operation in 2023. “INC has evolved from an emerging ransomware-as-a-service (RaaS) operation into one of the most active ransomware groups in 2026, claiming more than 800 victims since 2023,” Acronis researchers wrote. After INC’s source code was sold in 2024, related families such as Lynx and Sinobi appeared with significant code overlap. U.S. organizations make up more than 65% of listed victims, with legal services, manufacturing, construction, technology and health care among the most targeted, and the absence of victims in the Commonwealth of Independent States suggests the operators are based there, according to Acronis.

Resecurity advises patching SMA 1000 appliances right away, along with threat hunting, credential rotation and integrity checks. “Identify external source addresses that interacted with /wsproxy or used unusual parameters, and correlate with internal authentication and lateral-movement activity,” it said.