The INC Ransomware group has emerged as the dominant attacker exploiting two critical vulnerabilities in SonicWall's Secure Mobile Access (SMA) 1000 series VPN appliances, according to research from cybersecurity firm Resecurity. The flaws, tracked as CVE-2026-15409 (CVSS 10) and CVE-2026-15410 (CVSS 7.2), let unauthenticated attackers open a WebSocket tunnel to restricted services and escalate privileges to root.
Attackers exploited the bugs as zero-days starting June 22, weeks before SonicWall shipped patches in mid-July. Since then, INC Ransomware has accelerated its campaign, listing new victims on its leak site through August 2 and pushing its total claimed victim count to 885, with organizations hit across the US, Australia, UAE, Colombia and Switzerland.
Beyond encrypting files, the attackers are extracting credentials, active session tokens and TOTP MFA seeds -- giving them a persistent foothold deep inside corporate networks even after passwords are reset. Security teams running SMA 1000 appliances are urged to patch immediately and rotate credentials.