INC Ransomware Exploits SonicWall SMA 1000 Flaws to Expand Attacks
Cybersecurity experts warn of a new ransomware group targeting vulnerabilities in VPN devices.
1Critical Vulnerabilities in SonicWall SMA 1000
INC Ransomware has escalated attacks by exploiting CVE-2026-15409 and CVE-2026-15410 vulnerabilities in SonicWall Secure Mobile Access (SMA) 1000 series VPN devices. These flaws allow device takeover and arbitrary command execution. SonicWall released patches in mid-July 2026, but attackers were found using these as zero-days prior to fixes.
2Victims and Data Leaks
According to Ransomware.Live statistics, INC Ransomware has listed 885 victims to date. Recent additions as of August 2, 2026, include private and government organizations from the U.S., Australia, UAE, and Switzerland. Attackers publish stolen data on a leak site. Victims also receive calls from a person named 'Andrew' using +1 (304) 384-0401, demanding ransom payments.
3Attack Methods
Attackers deploy a Python script called KNUCKLEBALL to launch Suo5 HTTP proxy and a custom Java web shell named ORANGETAIL. These tools enable lateral movement within corporate networks. Rapid7 noted tactical overlaps with their investigations. Attackers steal high-value credentials, active session databases, and MFA seed configurations.
4Pressure Tactics
INC Ransomware contacts victims with emails and calls claiming to 'assist with ransomware issues.' A person named 'Andrew' claims to be 'from a hacker group' and states their network is compromised. Negotiations are directed to info@helprans[.]com. These are common pressure tactics used by ransomware groups to intimidate victims.
5Security Measures
SonicWall advises immediate patching of SMA 1000 devices to the latest version. Resecurity recommends comprehensive threat hunting, credential rotation, and integrity verification alongside patching. Monitoring external source addresses interacting with /wsproxy and unusual parameters can help detect attacks when correlated with internal activity.
6Industry Impact
These attacks pose a significant threat to organizations relying on VPN devices. Long-term access by attackers can lead to sensitive data leaks and operational disruptions. Ransom demands and data breaches may also damage reputations and create legal liabilities for affected companies.
7Future Risks
Cybersecurity experts warn that similar zero-day exploits may be used in the future. Attackers' increasingly sophisticated methods require organizations to adopt proactive security measures. Regular updates and monitoring of critical infrastructure components like VPN devices are vital to preventing such attacks.
8Conclusion and Recommendations
INC Ransomware's active exploitation of SonicWall SMA 1000 vulnerabilities raises alarms in cybersecurity. Organizations must apply urgent patches, conduct threat hunting, and train staff against social engineering. Reporting to authorities instead of paying ransoms can also undermine attackers' financial incentives.