INC Ransomware Chains SonicWall Zero-Days to Steal Credentials and TOTP Seeds Across 885 Victims
The ransomware group known as INC has become the dominant actor exploiting a pair of critical vulnerabilities in SonicWall Secure Mobile Access 1000 series VPN appliances, chaining the flaws to steal high-value credentials, active session databases, and Time-Based One-Time Password seeds in a campaign that has now claimed 885 victims across multiple continents.
Security researchers at Resecurity published a detailed analysis over the weekend showing that INC Ransomware accelerated its activity starting in early August 2026, with fresh victims appearing daily on the group's data leak site. The attacks exploit CVE-2026-15409 and CVE-2026-15410, a vulnerability pair that SonicWall patched in mid-July after they were weaponized as zero-days beginning June 22. The speed with which INC operationalized the exploit chain — from zero-day disclosure to mass victim enumeration in under six weeks — illustrates how quickly modern ransomware groups can weaponize perimeter vulnerabilities.
From Zero-Day to Ransomware Pipeline
The exploitation chain begins with the two SonicWall SMA 1000 flaws, which researchers say can be chained to achieve arbitrary command execution on unpatched appliances. Volexity attributed the pre-disclosure exploitation to a threat cluster it tracks as UTA0533, which deployed a Python script dubbed KNUCKLEBALL to launch Suo5, an open-source HTTP proxy, and a custom Java web shell named ORANGETAIL that resembles the Behinder framework. The web shell provides persistent remote access with a graphical interface for file management, command execution, and database interaction — essentially a full-featured administration panel in the hands of an intruder.
Rapid7 subsequently confirmed strong tactical overlaps between the UTA0533 activity and its own investigations. Douglas McKee, director of vulnerability intelligence at Rapid7, told The Hacker News that the correlation indicates a single threat actor or coordinated group discovered and exploited the zero-day chain before pivoting to ransomware deployment.
"This strong technical correlation indicates that a single threat actor or coordinated group is responsible for discovering and exploiting this zero-day vulnerability," McKee said. "More recently, INC Ransomware has emerged as the dominant threat actor actively weaponizing this vulnerability chain."
The technical details of the exploit chain reveal a sophisticated operation. CVE-2026-15409 is an authentication bypass in the WSProxy component of the SMA 1000 firmware, while CVE-2026-15410 is a command injection flaw in the same component. When chained, an unauthenticated attacker can reach the vulnerable endpoint, bypass authentication, and inject arbitrary commands that execute with root privileges on the underlying Linux-based appliance. The KNUCKLEBALL script automates this chain, then deploys Suo5 to create a reverse proxy tunnel that bypasses network segmentation, and finally installs ORANGETAIL for persistent interactive access.
Credential Harvesting at Scale
What distinguishes this campaign is the systematic theft of authentication material. Rapid7 analysis shows the attackers used their foothold on compromised VPN appliances to extract high-value credentials, active session databases, and critically, TOTP multi-factor authentication seed configurations. The goal appears to be ensuring long-term persistent access even after the initial vulnerability is patched, enabling lateral movement into internal corporate networks.
The theft of TOTP seeds is a major escalation in credential-harvesting tradecraft. Most organizations treat multi-factor authentication as a strong barrier against credential theft, but TOTP seeds — the shared secrets used to generate time-based one-time passwords — allow an attacker to generate valid second-factor codes indefinitely. Unlike session cookies or access tokens that expire, a stolen TOTP seed remains valid until the user explicitly resets their MFA enrollment, a step that many organizations do not perform after a breach.
Resecurity reported that new victims listed on INC Ransomware's leak site between July 17 and August 1 span private-sector and government organizations in Australia, the United States, the United Arab Emirates, Colombia, Switzerland, and other countries. The victim count of 885, tracked by Ransomware.Live, places INC among the most prolific ransomware operations of 2026. The geographic diversity suggests the group is not targeting a specific sector or region but rather scanning globally for unpatched SMA 1000 appliances and exploiting them opportunistically.
Pressure Tactics Extend Beyond Encryption
The operation has added a human element to its extortion playbook. Resecurity revealed that many new victims received emails and phone calls from unknown parties claiming to assist with ransomware recovery. In several cases, victims were contacted by an individual identifying himself as "Andrew" using the phone number +1 (304) 384-0401.
"He claimed to be calling 'from a group of hackers' and stated that the victim's network had been compromised," Resecurity noted. "At the end of the call, the individual provided the email address info@helprans[.]com for further negotiations and then ended the call. Such methods are frequently used by ransomware groups as pressure tactics."
This social-engineering layer — sometimes called "vishing" or voice phishing — adds psychological pressure on top of the technical encryption. Victims who might otherwise ignore a ransom note on a compromised system may respond differently to a direct phone call from someone claiming to be the attacker. The tactic also serves as a verification mechanism: if the victim engages, the attackers know they have a live target willing to negotiate.
Patching Alone May Not Suffice
SonicWall released fixes for both vulnerabilities in mid-July 2026, but researchers warn that patching the appliance does not automatically evict an attacker who has already harvested credentials and TOTP seeds. Resecurity recommends comprehensive threat hunting, credential rotation, and integrity verification alongside patching.
"Identify external source addresses that interacted with /wsproxy or used unusual parameters, and correlate with internal authentication and lateral-movement activity," the firm advised.
The Cybersecurity and Infrastructure Security Agency echoed this guidance in an advisory issued August 5, urging organizations to assume compromise if they operated unpatched SMA 1000 appliances during the exposure window. The agency recommended immediate rotation of all VPN credentials, regeneration of MFA seeds, and audit of active sessions for anomalies. The theft of TOTP seeds is particularly concerning because it allows attackers to generate valid second-factor codes indefinitely, bypassing MFA protections that many organizations consider a primary defense against credential theft.
Forensic investigators have also found evidence that the attackers used stolen VPN credentials to authenticate to other systems within the victim's environment, including identity providers, cloud consoles, and source-code repositories. In at least three cases documented by Resecurity, the initial VPN compromise led to full domain compromise within 48 hours through a combination of credential reuse and Kerberos delegation abuse.
A Broader Pattern of VPN Targeting
The INC campaign follows a well-established pattern of threat actors targeting edge network devices — VPN appliances, firewalls, and gateways — because they sit at the network perimeter, often lack the rigorous patching cadence of endpoints, and provide direct access to internal networks once compromised. Similar exploitation waves have hit Fortinet, Pulse Secure, and Citrix appliances in recent years, each spawning dedicated ransomware affiliates that specialized in the respective vulnerability.
The root cause is structural: edge devices are frequently managed by network teams rather than security teams, run proprietary operating systems with limited visibility, and are rarely covered by endpoint detection and response agents. When a vendor releases a patch, the deployment process often requires scheduled maintenance windows, change-control approvals, and careful testing to avoid disrupting remote access for legitimate users — all of which delay remediation.
For defenders, the lesson is that edge devices require the same visibility and response capability as core infrastructure. Network segmentation, zero-trust architectures, and continuous monitoring of VPN authentication logs can limit the blast radius when a perimeter device falls. Organizations should also maintain an inventory of all internet-facing appliances with their firmware versions, and subscribe to vendor security advisories for immediate notification of new vulnerabilities.
Our cybersecurity coverage tracks these evolving threats, and the robotics and drones desk follows the parallel rise of autonomous system vulnerabilities in critical infrastructure.
Source: The Hacker News — INC Ransomware Emerges as Dominant Actor Exploiting SonicWall SMA 1000 Flaws, August 3, 2026; Resecurity — From WSProxy to Root: INC Ransomware and SonicWall SMA Exploit Chain, August 2026; Volexity — SonicWall SMA Zero-Days Exploited, July 2026; CISA Advisory — SonicWall SMA 1000 Exploitation, August 5, 2026.
Keywords: INC Ransomware, SonicWall SMA 1000, CVE-2026-15409, CVE-2026-15410, VPN vulnerability, credential theft, TOTP seeds, ransomware, Resecurity, Rapid7, Volexity, UTA0533, KNUCKLEBALL, ORANGETAIL, CISA