INC Ransomware Dominates Exploitation of SonicWall Zero-Day Vulnerabilities

Executive Summary

As of August 2026, the threat landscape has been significantly impacted by the rapid weaponization of zero-day vulnerabilities in SonicWall Secure Mobile Access (SMA) 1000 series appliances. Intelligence reports indicate that the INC Ransomware group has pivoted to become the dominant actor exploiting these flaws, specifically CVE-2026-15409 and CVE-2026-15410. Since early August, the group has accelerated its operations, targeting a diverse range of sectors across Australia, the U.S., the U.A.E., and Europe.

Threat Analysis

INC Ransomware is currently leveraging a sophisticated exploit chain to achieve arbitrary command execution on vulnerable VPN appliances. The campaign is characterized by high operational tempo and a clear focus on initial access brokering followed by rapid payload deployment. Security researchers have observed a strong tactical correlation between the exploitation of these specific zero-days and the subsequent activity attributed to INC, suggesting a coordinated effort to maximize impact before patches are fully implemented across the global infrastructure.

Technical Details

The attack chain involves the deployment of a Python script identified as 'KNUCKLEBALL'. This script is utilized to launch 'Suo5', an open-source HTTP proxy, which facilitates further lateral movement. Additionally, attackers deploy a custom Java web shell dubbed 'ORANGETAIL', which mimics the behavior of the well-known 'Behinder' tool. By chaining these components, the threat actors gain persistent, unauthorized access to the internal network, allowing for data exfiltration and the eventual deployment of ransomware payloads.

Attribution Assessment

While multiple actors may have access to the underlying vulnerability research, Resecurity and Rapid7 have identified INC Ransomware as the primary entity actively weaponizing this chain. The group has demonstrated a high level of technical proficiency in adapting their toolset to bypass traditional perimeter defenses. The rapid increase in victim listings on their data leak site—totaling 885 victims to date—confirms their status as a top-tier threat actor in the current ransomware ecosystem.

Implications

The exploitation of these VPN vulnerabilities poses a critical risk to organizations relying on remote access infrastructure. The ability of INC Ransomware to move from initial access to full system compromise using custom web shells like ORANGETAIL highlights the necessity for advanced endpoint detection and response (EDR) capabilities that can identify anomalous process execution and unauthorized proxy traffic.

Recommendations

Organizations utilizing SonicWall SMA 1000 series appliances must prioritize the immediate application of vendor-supplied patches. Security teams should conduct thorough threat hunting for indicators of compromise (IOCs) related to KNUCKLEBALL and ORANGETAIL. Furthermore, implementing strict egress filtering and monitoring for unusual HTTP proxy activity can help mitigate the risk of lateral movement if an initial breach occurs.