{"data":{"id":2130,"lang":"en","title":"INC Ransomware Becomes Top Exploiter of Critical SonicWall VPN Flaws","summary":"INC Ransomware is now the leading exploiter of two critical SonicWall SMA 1000 VPN flaws, having breached 885 victims worldwide since the bugs were used as zero-days in June.","category":"technology","category_label":"Technology","published_at":"2026-08-04T14:01:44Z","updated_at":"2026-08-04T14:01:44Z","url":"https://techtools.cz/tools/news/article/2130-inc-ransomware-becomes-top-exploiter-of-critical-sonicwall-vpn-flaws","api_url":"https://techtools.cz/news-api/v1/articles/2130?lang=en","markdown_url":"https://techtools.cz/news-api/v1/articles/2130.md?lang=en","image_url":"https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEghC22v1WIfuZutm_-lxuOPzdipffNmYvZ5KA9l_AUg-8EgQr9Gy0ouYijU_Vab5m5aIpGChViq6kpC4_h1fZfjBw415YHCINhU9GXTkil94vJv_Ct241xptfhjyt34cV348Q5VHlRVlKSj32-uj1u0PocPhDf9CBYuhFfPhvLjiHTqPYOPZBpXUyhiAe5Q/s1700-e365/sonicwall-ransomware.jpg","word_count":154,"reading_time_minutes":1,"sources":[{"url":"https://thehackernews.com/2026/08/inc-ransomware-emerges-as-dominant.html","domain":"thehackernews.com"}],"translation":{"lang":"cs","id":2203,"title":"INC Ransomware se stal hlavním útočníkem zneužívajícím kritické chyby VPN SonicWall","url":"https://techtools.cz/tools/news/clanek/2203-inc-ransomware-se-stal-hlavnim-utocnikem-zneuzivajicim-kriticke-chyby-vpn","api_url":"https://techtools.cz/news-api/v1/articles/2203?lang=cs"},"content":"The INC Ransomware group has emerged as the dominant attacker exploiting two critical vulnerabilities in SonicWall's Secure Mobile Access (SMA) 1000 series VPN appliances, according to research from cybersecurity firm Resecurity. The flaws, tracked as CVE-2026-15409 (CVSS 10) and CVE-2026-15410 (CVSS 7.2), let unauthenticated attackers open a WebSocket tunnel to restricted services and escalate privileges to root.\n\nAttackers exploited the bugs as zero-days starting June 22, weeks before SonicWall shipped patches in mid-July. Since then, INC Ransomware has accelerated its campaign, listing new victims on its leak site through August 2 and pushing its total claimed victim count to 885, with organizations hit across the US, Australia, UAE, Colombia and Switzerland.\n\nBeyond encrypting files, the attackers are extracting credentials, active session tokens and TOTP MFA seeds -- giving them a persistent foothold deep inside corporate networks even after passwords are reset. Security teams running SMA 1000 appliances are urged to patch immediately and rotate credentials."}}