INC Ransomware Dominates Exploitation of SonicWall SMA 1000 Zero-Day Vulnerabilities

Executive Summary

As of August 2026, the INC Ransomware group has solidified its position as the dominant threat actor exploiting a pair of critical zero-day vulnerabilities in SonicWall Secure Mobile Access (SMA) 1000 series VPN appliances. These vulnerabilities, identified as CVE-2026-15409 and CVE-2026-15410, were weaponized as a chain to achieve arbitrary command execution and full device takeover. While patches were released in mid-July, the group continues to leverage the foothold for high-value data exfiltration and lateral movement.

Threat Analysis

Intelligence reports indicate that the exploitation campaign began as early as June 22, 2026. Initially attributed to a threat cluster tracked as UTA0533, the activity has since been co-opted by the INC Ransomware syndicate. The group has been observed targeting private and government sectors across Australia, the U.S., the U.A.E., Switzerland, and Colombia. The shift from initial access brokers to a major ransomware operator suggests a highly coordinated effort to maximize the impact of the vulnerability before organizations can complete their patching cycles.

Technical Details

The attack chain involves chaining CVE-2026-15409 and CVE-2026-15410 to bypass authentication and execute commands with root privileges. Once inside, attackers deploy a Python script named 'KNUCKLEBALL' to launch 'Suo5', an open-source HTTP proxy, and a custom Java web shell dubbed 'ORANGETAIL'. This toolkit allows the actors to extract sensitive credentials, active session databases, and Time-Based One-Time Password (TOTP) MFA seed configurations, ensuring long-term persistence even after initial appliance reboots.

Attribution Assessment

While the initial exploitation was linked to the UTA0533 cluster, the subsequent weaponization and data extortion activities are firmly attributed to INC Ransomware. The tactical overlap in the use of the KNUCKLEBALL script and the specific targeting of MFA seeds indicates a sophisticated, professionalized operation that prioritizes deep network penetration over simple disruption.

Implications

The exploitation of these VPN appliances represents a significant risk to enterprise infrastructure. By compromising the VPN gateway, attackers gain a 'trusted' entry point into the internal network, effectively bypassing perimeter defenses. The theft of MFA seeds is particularly concerning, as it renders traditional multi-factor authentication ineffective for the compromised accounts.

Recommendations

Organizations utilizing SonicWall SMA 1000 series appliances must ensure they are running the latest firmware versions provided by the vendor. Furthermore, security teams should conduct a thorough audit of VPN logs for signs of unauthorized access or the presence of the 'ORANGETAIL' web shell. If compromise is suspected, it is recommended to rotate all credentials and MFA seeds immediately, as these are likely to have been exfiltrated.