INC ransomware becomes the main group exploiting SonicWall VPN appliances

Resecurity reports that the INC ransomware operation has become the dominant group exploiting two SonicWall SMA1000 VPN appliance flaws, accelerating its attacks since early August. The pair, CVE-2026-15409 and CVE-2026-15410, were exploited as zero-days before SonicWall patched them in mid-July, and can be chained to gain root on the appliance and extract credentials, session databases, and one-time-password data. Many appliances remain unpatched or already compromised, leaving footholds attackers can reuse. Victims listed recently span private and government organizations across several countries, and some reported follow-up emails and phone calls from people claiming to help with the ransomware.

Check

Confirm SonicWall SMA1000 appliances have the mid-July fixes, and because pre-patch exploitation was common, run a compromise assessment and rotate credentials, sessions, and one-time-password secrets the appliance handled.

Affected

Organizations running SonicWall SMA1000 appliances (CVE-2026-15409, CVE-2026-15410); INC ransomware is actively chaining the flaws to root devices, and unpatched or already-compromised appliances remain reusable footholds.

Fix

Patch, then re-image compromised appliances and reset all credentials and one-time-password tokens they processed, restrict management access, and treat unsolicited offers of ransomware help as part of the extortion.