What Changed
Resecurity says the INC Ransomware operation has become the “dominant threat actor” exploiting CVE-2026-15409 and CVE-2026-15410 in SonicWall Secure Mobile Access (SMA) 1000 appliances. The two flaws can be chained to run arbitrary commands and take over a device. SonicWall released fixes in mid-July 2026.
According to Ransomware.Live, INC has claimed 885 victims in total, the latest listed on August 2. Resecurity says new victims posted between July 17 and August 1 include private companies and government bodies in Australia, the U.S., the U.A.E., Colombia and Switzerland.
How The Chain Was Used Before Disclosure
Both flaws were exploited as zero-days. Volexity tied exploitation starting on June 22 to a cluster it tracks as UTA0533, which deployed a Python script called KNUCKLEBALL to launch the Suo5 HTTP proxy and a custom Java web shell, ORANGETAIL. Rapid7 says attackers took credentials, active session databases and TOTP MFA seed configurations to keep long-term access and move into internal networks.
Know what matters before your first meeting.
Weekday mornings. Five minutes. What changed in security, why it matters.
By subscribing you agree to our Privacy Policy.
Free. Weekday mornings. 5 minutes or less.
Rapid7’s Douglas McKee said the technical overlap points to a single actor or coordinated group finding the bug, and that “more recently, INC Ransomware has emerged as the dominant threat actor actively weaponizing this vulnerability chain.”
Pressure Tactics
Resecurity says many new victims received emails and phone calls from people claiming to help with ransomware. One caller, “Andrew”, said he was calling from a group of hackers and passed on the address info@helprans[.]com for negotiation.
What To Verify First
- Patch every SMA 1000 appliance to SonicWall’s fixed release.
- Because MFA seeds and session databases were targeted, re-enrol TOTP MFA and rotate appliance and directory credentials after patching.
- Find external addresses that reached
/wsproxyor used unusual parameters, and correlate them with internal logins and lateral movement, as Resecurity advises.
Source Context
This item was rebuilt from the following primary sources and original reporting:
Related In The Daily Brief
See this item in The 5-Minute Cyber Brief
Newer CyberExperts coverage on this topic
This article still works as background. If you want the current picture, start with the freshest related coverage below and today's brief.
Coder’s registry infrastructure compromised to push malicious modules
The Coder incident is a supply-chain lesson in miniature: once attackers can tamper with trusted module distribution, defenders are no longer verifying...
Attackers Turn Trusted Node.js Runtime Into Malware Delivery Tool in Targeted Attacks
The useful lesson in this campaign is not that Node.js is bad. It is that adversaries keep choosing legitimate runtimes defenders already...
HPE patches critical ArubaOS-CX remote code execution flaw
ArubaOS-CX deserves attention because switching software rarely gets treated with the same urgency as identity or edge security until exploitation arrives. A...
Monday’s brief: GlobalProtect logins without passwords, then SonicWall, AhsayCBS and NetScaler
The fastest way to catch up on what changed after this article was published.
Start your morning with the signal that matters.
Get the biggest cybersecurity developments, why they matter, and where to go deeper on CyberExperts.
By subscribing you agree to our Privacy Policy.
Free. Weekdays. Built for operators.
