INC Ransomware Dominates SonicWall SMA 1000 Zero-Day Exploitation as Victim Count Nears 900

Security researchers say the INC Ransomware operation has become the primary actor weaponizing a pair of critical zero-day flaws in SonicWall Secure Mobile Access appliances, with nearly 900 victims claimed since the vulnerability chain was first exploited in late June. The campaign represents one of the fastest transitions from zero-day discovery to widespread ransomware deployment observed in recent years.

The development marks a sharp escalation in a campaign that began as a targeted espionage operation before shifting into the hands of a ransomware crew that now operates a formal affiliate program. For organizations running exposed SMA 1000 series VPN gateways, the window to patch has effectively closed — active exploitation is widespread, and the threat actors are moving fast. Security teams that delayed patching now face the real possibility that their networks were already compromised during the silent exploitation window.

From Zero-Day to Ransomware Pipeline

SonicWall disclosed CVE-2026-15409 and CVE-2026-15410 in mid-July, but evidence shows the flaws were under active exploitation weeks earlier. Volexity attributed pre-disclosure activity starting June 22 to a threat cluster it tracks as UTA0533, describing a Python script dubbed KNUCKLEBALL that deployed an open-source HTTP proxy called Suo5 and a custom Java web shell named ORANGETAIL.

Rapid7 subsequently confirmed the campaign shares "substantial tactical overlaps" with its own investigations. Douglas McKee, the company's director of vulnerability intelligence, said the correlation points to a single threat actor or coordinated group responsible for discovering and exploiting the zero-day chain.

"More recently, INC Ransomware has emerged as the dominant threat actor actively weaponizing this vulnerability chain," McKee told The Hacker News.

The U.S. Cybersecurity and Infrastructure Security Agency added both flaws to its Known Exploited Vulnerabilities catalog on July 14, citing evidence of active exploitation. CVE-2026-15409 carries a maximum CVSS 10.0 score as a server-side request forgery bug in the SMA 1000 "Work Place" interface, while CVE-2026-15410 is a high-severity code injection flaw. When chained, they allow unauthenticated remote code execution on internet-facing appliances.

Credential Theft, TOTP Seeds, and Lateral Movement

According to Resecurity, which published a detailed analysis over the weekend, the attacks use the initial foothold to extract high-value credentials, active session databases, and Time-Based One-Time Password (TOTP) multi-factor authentication seed configurations. The goal is long-term persistent access and lateral movement into the internal corporate network. By stealing TOTP seeds, the actors can generate valid one-time passwords indefinitely, bypassing MFA protections even after the initial breach is detected.

INC Ransomware's victim count has swelled to 885 as of August 2, according to Ransomware.Live tracking data. New victims listed between July 17 and August 1 span private-sector and government organizations in Australia, the United States, the United Arab Emirates, Colombia, Switzerland, and other countries.

The group operates a double-extortion model: data is exfiltrated before encryption, and victims who refuse to pay within five to seven days have their files published on a leak site. Resecurity also documented an unusual pressure tactic — victims reported receiving phone calls from an individual identifying as "Andrew" using the number +1 (304) 384-0401, who claimed to be calling "from a group of hackers" and provided a negotiation email address. Such calls are a known coercion method to accelerate payment.

Affiliate Program and Conti Lineage

INC Ransomware traces its codebase to the Conti ransomware source code that leaked in 2022. The group launched a formal ransomware-as-a-service affiliate program on dark web forums in January 2026, offering affiliates a management panel, a configurable ransomware builder, cross-platform locker payloads, and structured documentation. The operation has also adopted the branding alias "Golden Community" to expand its reach. Affiliates receive access to a Tor-based negotiation portal and qTox contact channels, with ransom demands routinely exceeding ten million dollars per victim.

Researchers note the group recruits penetration testers and self-described ethical hackers as initial access brokers, offering a cut of ransom proceeds in exchange for enterprise network access. This blurring of legitimate security work and criminal enterprise is a growing trend in the ransomware ecosystem.

Attack chains documented by Resecurity and Rapid7 make heavy use of Impacket utilities — psexec.py and smbclient.py for SMB-based lateral movement, and secretsdump.py for credential dumping against compromised domain controllers. The actors delete system and network access logs, clear command history, and concentrate malicious activity between 10 p.m. and 6 a.m. local time to evade detection.

Data exfiltration from Microsoft OneDrive and SharePoint is handled by a custom executable named main.exe. In several cases, the group created compressed archives containing terabytes of data and uploaded them to the MEGA file-sharing service. Beyond business documents, the actors have accessed virtual desktop infrastructure environments used by IT personnel, harvesting network configuration details that facilitate deeper compromise.

Patching Alone Is Not Enough

SonicWall released patches for both vulnerabilities in mid-July. But Resecurity warns that patching alone is insufficient for organizations that may have already been compromised. The firm recommends comprehensive threat hunting, credential rotation, and integrity verification alongside updates. The advisory also urges administrators to review VPN logs for anomalous /wsproxy requests, rotate all credentials that may have been exposed, and verify the integrity of domain controller databases.

"Identify external source addresses that interacted with /wsproxy or used unusual parameters, and correlate with internal authentication and lateral-movement activity," Resecurity advised.

The CISA KEV listing triggers Binding Operational Directive 26-04 requirements for federal civilian agencies, mandating rapid remediation on publicly exposed assets. Private-sector operators of SMA 1000 appliances face the same urgency — the exploit chain is reliable, the actors are motivated, and the victim pool is growing.

A Familiar Pattern, A Harder Lesson

The INC Ransomware campaign follows a now-familiar arc: a critical VPN zero-day falls into criminal hands, patches arrive after weeks of silent exploitation, and a ransomware crew scales the impact through affiliates and pressure tactics. What makes this cycle different is the speed — from zero-day discovery to dominant ransomware operator in under two months — and the blend of technical sophistication with old-school coercion like phone calls to victims.

For security teams, the message is clear. VPN appliances remain a top-tier target. Asset inventory, rapid patching, network segmentation, and immutable off-site backups are not optional. They are the baseline. The speed of this campaign — from silent zero-day exploitation to dominant ransomware operator in under two months — should reset expectations for how quickly a vulnerability can cascade into a full-blown crisis.

According to CISA's Known Exploited Vulnerabilities catalog, both SonicWall flaws are actively exploited in the wild. Organizations running SMA 1000 series appliances should assume compromise is possible and act accordingly.

Related coverage: CISA Adds Four Known Exploited Vulnerabilities to Catalog | Ransomware.Live INC Ransomware statistics

Internal: Cybersecurity