INC Ransomware Emerges as Dominant Actor Exploiting Sonic Wall SMA 1000 Flaws
Summary: INC Ransomware has become the dominant actor exploiting flaws in SonicWall SMA 1000 VPN appliances, with Resecurity reporting accelerated activity since early August 2026 and 885 victims claimed to date on Ransomware.Live. The attacks are suspected to chain CVE-2026-15409 and CVE-2026-15410, patched by SonicWall in mid-July 2026, to steal credentials, active session databases, and TOTP MFA seed configurations, with Volexity attributing pre-disclosure exploitation from June 22, 2026 to a cluster it tracks as UTA0533.
Bottom line: The stolen TOTP seed configurations mean MFA codes for these appliances can be generated by the attacker, so a second factor no longer distinguishes a legitimate session from theirs. Resecurity also reports victims receiving calls from someone named "Andrew" claiming to represent "a group of hackers" and directing negotiations to info@helprans[.]com, a pressure tactic that turns a technical compromise into a direct approach to your organization.
Read the original at The Hacker News ↗
- Topics
- Vulnerabilities & Patching
- Mentions
- CVE-2026-15409CVE-2026-15410
- Related