INC ransomware exploits SonicWall SMA 1000 vulnerabilities

A ransomware group known as INC has become the primary actor exploiting a pair of critical vulnerabilities in SonicWall Secure Mobile Access (SMA) 1000 series appliances, accelerating a global campaign that has claimed hundreds of victims this year. The group has listed multiple new victims on its data leak site since mid-July, targeting private companies and government entities across the United States, Australia, the United Arab Emirates, Colombia, Switzerland, and other countries.

The attacks chain two vulnerabilities, tracked as CVE-2026-15409 and CVE-2026-15410, which together allow attackers to gain root access on unpatched devices. SonicWall released fixes in mid-July 2026, but many organizations had not applied the updates. Security researchers note the flaws were exploited as zero-days before the patches were available, with activity observed as early as June 22. Once inside a network, attackers deploy custom tooling, including a Python script called KNUCKLEBALL used to launch a proxy and a Java web shell named ORANGETAIL. The objective is to extract credentials, session data, and multi-factor authentication seeds to establish persistent access, move laterally, and...