{"id":2186,"date":"2026-08-03T18:35:02","date_gmt":"2026-08-03T18:35:02","guid":{"rendered":"https:\/\/thedigitalfortress.us\/?p=2186"},"modified":"2026-08-03T18:35:02","modified_gmt":"2026-08-03T18:35:02","slug":"inc-ransomware-emerges-as-dominant-actor-exploiting-sonicwall-sma-1000-flaws","status":"publish","type":"post","link":"https:\/\/thedigitalfortress.us\/?p=2186","title":{"rendered":"INC Ransomware Emerges as Dominant Actor Exploiting SonicWall SMA 1000 Flaws"},"content":{"rendered":"
\n

\ue804<\/i>Ravie Lakshmanan<\/span>\ue802<\/i>Aug 03, 2026<\/span><\/span>Vulnerability \/ Cybercrime<\/span><\/p>\n<\/div>\n

\n
<\/a><\/div>\n

The INC Ransomware operation has emerged as the \u00abdominant threat actor\u00bb exploiting the recently disclosed security flaws in SonicWall Secure Mobile Access (SMA) 1000 series VPN appliances.<\/p>\n

In a report published<\/a> over the weekend, Resecurity said it observed the INC Ransomware accelerating its activity since the beginning of August 2026, listing multiple victims on its data leak site. Per statistics<\/a> listed on Ransomware.Live, the group has claimed 885 victims to date, with the most recent victim listed on August 2, 2026.<\/p>\n

The attacks are suspected to involve the exploitation of CVE-2026-15409 and CVE-2026-15410, which could be chained to facilitate arbitrary command execution and take over susceptible devices. Fixes for the vulnerability pair were released by SonicWall in mid-July 2026.<\/p>\n

The two shortcomings are assessed to have been weaponized as zero-days, with Rapid7 noting that the attacks leveraged the foothold to extract high-value credentials, active session databases, and Time-Based One-Time Password (TOTP) multi-factor authentication (MFA) seed configurations with an aim to ensure long-term, persistent access and ultimately carry out lateral movement into the internal corporate network.<\/p>\n

\"\"<\/a><\/div>\n

In a follow-up report, Volexity attributed the pre-disclosure exploitation starting June 22, 2026, to a threat cluster it tracks as UTA0533. The attacks involve the deployment of a Python script named KNUCKLEBALL that’s used to launch Suo5, an open-source HTTP proxy, and a Behinder-like custom Java web shell dubbed ORANGETAIL.<\/p>\n

Rapid7 subsequently told The Hacker News that the campaign shares significant tactical overlaps with its own investigations.<\/p>\n

\u00abThis strong technical correlation indicates that a single threat actor or coordinated group is responsible for discovering and exploiting this zero-day vulnerability,\u00bb Douglas McKee, director of vulnerability intelligence at Rapid7, said. \u00abMore recently, INC Ransomware has emerged as the dominant threat actor actively weaponizing this vulnerability chain.\u00bb<\/p>\n

\n
\"Cybersecurity\"<\/a><\/div>\n<\/div>\n

Resecurity said the new victims listed on INC Ransomware’s site between July 17 and August 1, 2026, include private sector and government organizations from Australia, the U.S., the U.A.E., Colombia, Switzerland, and other countries.<\/p>\n

The cybersecurity company also revealed, \u00abmany of the new victims received emails, as well as phone calls from unknown organizations claiming to assist with ransomware issues.\u00bb In some cases, the victims are also said to have been contacted by an individual who went by the name \u00abAndrew\u00bb using the phone number +1 (304) 384-0401.<\/p>\n

\"\"<\/a><\/div>\n

\u00abHe claimed to be calling ‘from a group of hackers’ and stated that the victim’s network had been compromised,\u00bb the company noted. \u00abAt the end of the call, the individual provided the email address info@helprans[.]com for further negotiations and then ended the call. Such methods are frequently used by ransomware groups as ‘pressure tactics.'\u00bb<\/p>\n

Customers are advised to immediately patch SMA 1000 appliances to the latest version, if not already. Resecurity has also recommended comprehensive threat hunting, credential rotation, and integrity verification alongside patching to safeguard against the threat.<\/p>\n

\u00abIdentify external source addresses that interacted with \/wsproxy or used unusual parameters, and correlate with internal authentication and lateral-movement activity,\u00bb it added.<\/p>\n<\/div>\n","protected":false},"excerpt":{"rendered":"

\ue804Ravie Lakshmanan\ue802Aug 03, 2026Vulnerability \/ Cybercrime The INC Ransomware operation has emerged as the \u00abdominant threat actor\u00bb exploiting the recently disclosed security flaws in SonicWall Secure Mobile Access (SMA) 1000…<\/p>\n","protected":false},"author":1,"featured_media":2187,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1],"tags":[172,2864,1126,653,11,93,820,2538],"class_list":["post-2186","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-uncategorized","tag-actor","tag-dominant","tag-emerges","tag-exploiting","tag-flaws","tag-ransomware","tag-sma","tag-sonicwall"],"_links":{"self":[{"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=\/wp\/v2\/posts\/2186","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=2186"}],"version-history":[{"count":0,"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=\/wp\/v2\/posts\/2186\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=\/wp\/v2\/media\/2187"}],"wp:attachment":[{"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=2186"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=2186"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=2186"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}