INC Ransomware's 885-Victim Run Traces Back to a SonicWall Zero-Day Pair

Summary

INC Ransomware has become the primary operator exploiting a two-bug chain in SonicWall Secure Mobile Access (SMA) 1000 series VPN appliances, tracked as CVE-2026-15409 and CVE-2026-15410. The pair allows an unauthenticated attacker to move from network exposure to root-level command execution on the appliance, after which credentials, session tokens, and TOTP MFA seeds are harvested for internal network access.

Pre-disclosure activity by a separate cluster, UTA0533, used a purpose-built toolset named KNUCKLEBALL, Suo5, and ORANGETAIL to establish covert, reboot-resistant access weeks before patches shipped. INC has since accelerated its use of the same vulnerability chain, listing hundreds of new victims on its leak site and pairing encryption with direct phone-call extortion.

Background

Volexity first identified exploitation of the SMA 1000 flaw pair during an incident response engagement, tracing unauthorized activity back to June 22, 2026, roughly three weeks before SonicWall issued fixes in mid-July 2026. Volexity assigned the operator behind this early activity the designation UTA0533 and noted the tradecraft resembled state-aligned intrusion patterns rather than an immediate ransomware deployment, since the actor prioritized credential collection and quiet persistence over encryption.

The malware component names, KNUCKLEBALL, Suo5, and ORANGETAIL, were assigned by Volexity's researchers during analysis; Suo5 is a pre-existing open-source proxy tool repurposed for this campaign, while KNUCKLEBALL and ORANGETAIL are custom components built specifically for SMA 1000 appliances. Rapid7 separately corroborated the technical overlap, concluding that a single actor or coordinated cluster likely discovered and weaponized the chain.

By early August 2026, Resecurity reported that INC Ransomware had shifted from opportunistic use of the flaw pair to becoming its dominant exploiter, sharply increasing the pace of victim postings on its data leak site. Ransomware.Live statistics place INC's cumulative claimed victim count at 885, with its most recent listing dated August 2, 2026. New victims added between July 17 and August 1, 2026, span private and government sector organizations in Australia, the United States, the United Arab Emirates, Colombia, and Switzerland, among other countries, indicating the campaign is not confined to a single region or sector.

The SMA 1000 series sits at the network perimeter as a remote access gateway, making any compromise a direct bridge into internal infrastructure. Both CVEs were added to CISA's Known Exploited Vulnerabilities catalog.

Vulnerability Details

CVE ID	CVSS Score	EPSS Score	Affected Products
CVE-2026-15409	10.0 (Critical)	78.44%	SonicWall SMA 1000 series: models 6210, 7210, and 8200v, firmware 12.4.3 and 12.5.0 branches
CVE-2026-15410	7.2 (High)	76.35%	SonicWall SMA 1000 series: models 6210, 7210, and 8200v, firmware 12.4.3 and 12.5.0 branches

Attack Methodology

1. 1. Initial Access via Vulnerability Exploitation. The threat actor (UTA0533) gains access by exploiting a "vulnerability pair" in the SonicWall SMA 1000 series VPN appliances, specifically CVE-2026-15409 and CVE-2026-15410.
2. 2. Chained Command Execution. These security flaws are chained together to facilitate arbitrary command execution, allowing the attacker to take over susceptible devices.
3. 3. Deployment of Custom Loader. The group deploys a Python script named KNUCKLEBALL, which serves as a loader for subsequent malicious tools.
4. 4. Proxy and Web Shell Injection. KNUCKLEBALL is used to launch Suo5, an open-source HTTP proxy, and ORANGETAIL, a custom Java web shell that mimics the Behinder framework.
5. 5. Persistent Credential Harvesting. Once a foothold is established, the actor extracts high-value credentials, active session databases, and Time-Based One-Time Password (TOTP) MFA seed configurations. This is done to ensure long-term, persistent access that can bypass multi-factor authentication.
6. 6. Lateral Movement. Using the stolen credentials and established tunnels, the threat actors move from the compromised appliance into the victim's internal corporate network.
7. 7. Ransomware Deployment and Extortion. The final stage involves the deployment of INC Ransomware to encrypt systems. The campaign is characterized by aggressive pressure tactics, including listing victims on a data leak site and contacting them via phone calls and emails.

Key Observation: CVE-2026-15409 alone requires no authentication and no user interaction, which means any internet-facing SMA 1000 appliance still running unpatched firmware should be treated as already compromised rather than merely exposed, since the SSRF-to-root chain leaves minimal forensic footprint when the device has been rebooted.

Indicators of Compromise (IOCs)

• ● Negotiation email: info@helprans[.]com
• ● Extortion contact number: +1 (304) 384-0401, caller identifying as "Andrew"
• ● Exploited entry path: /wsproxy

MITRE ATT&CK Mapping

Technique ID	Technique Name	Tactic
T1190	Exploit Public-Facing Application	Initial Access
T1203	Exploitation for Client Execution	Execution
T1505.003	Server Software Component: Web Shell	Persistence
T1059.006	Command and Scripting Interpreter: Python	Execution
T1090	Proxy	Command and Control
T1111	Multi-Factor Authentication Interception	Credential Access

Visual Attack Flow

Mitigation

1. 1. Patch immediately. Upgrade all SMA 1000 appliances to firmware 12.4.3-03453, 12.5.0-02835, or later; do not rely on interim hotfixes if a full version upgrade path is available.
2. 2. Treat unpatched devices as breached. Any SMA 1000 appliance that was internet-facing and unpatched between June 22 and mid-July 2026 should be assumed compromised until log review and integrity checks prove otherwise.
3. 3. Rotate all exposed credentials. Reset LDAP service account passwords, invalidate active session tokens, and reissue TOTP MFA seeds for any accounts authenticating through the affected appliance.
4. 4. Correlate external and internal activity. Cross-reference source IP addresses that hit /wsproxy with internal authentication and lateral-movement logs to identify accounts or systems touched after initial compromise.
5. 5. Prepare for extortion contact. Brief incident response and executive teams that INC affiliates may follow up encryption attempts with direct phone or email pressure tactics, and route any such contact through incident response rather than ad hoc negotiation.

Instantly Fix Risks with Saner Patch Management

Saner patch management is a continuous, automated, and integrated software that instantly fixes risks exploited in the wild. The software supports major operating systems like Windows, Linux, and macOS, as well as 550+ third-party applications.

It also allows you to set up a safe testing area to test patches before deploying them in a primary production environment. Saner patch management additionally supports a patch rollback feature in case of patch failure or a system malfunction.

Experience the fastest and most accurate patching software here.