INC Ransomware Claims 885 Victims Exploiting SonicWall SMA1000: Patch Immediately

CVE-2026-15409 is a server-side request forgery vulnerability in the SMA1000 Work Place interface. SSRF vulnerabilities occur when a server processes attacker-controlled input without validating the destination, then makes requests on the attacker's behalf. In the SMA1000 case, the /wsproxy endpoint handles WebSocket proxy requests and constructs tunnel connections using client-supplied parameters. An attacker sends an unauthenticated HTTP upgrade request with three critical parameters: a User-Agent header set to "SMA Connect Agent", a bmID value of -3389 (a sentinel value that bypasses the appliance's standard client validation), and a serviceType/host/port combination pointing to internal-only services. The appliance tunnels the WebSocket session to localhost CouchDB on TCP/1050 or the ctrl-service on TCP/8188.

With the ctrl-service reachable, the attacker exploits CVE-2026-15410. The hotfix-removal workflow in the ctrl-service accepts a POST request to /rollbackConfirm.action with a hotfix parameter specifying which file to remove. The workflow concatenates the attacker-supplied value to a base directory path without input normalization. By supplying hotfix=../../../../../tmp/1234.sh, the attacker points the removal operation to an attacker-written script in /tmp/ that the ctrl-service then executes at root privilege. The entire chain from external internet to root command execution requires zero valid credentials.

Post-exploitation follows a consistent pattern across observed INC incidents. The attacker writes a staged script to /tmp/ via the CouchDB write interface, triggers it through the path traversal, and deploys four malware components: ROOTRUN (a setuid ELF backdoor at /usr/bin/xzfind), KNUCKLEBALL (a Python loader at /usr/lib/python3.11/site-packages/deploy_new.py), Suo5 (an open-source HTTP proxy tunneled into the appliance JVM), and ORANGETAIL (a Behinder-compatible Java web shell enabling AES-encrypted remote command execution). KNUCKLEBALL modifies /etc/init.d/workplace to relaunch these tools at boot, making persistence survive basic remediation attempts. Organizations that patch without re-imaging remain compromised.

INC Ransomware is a double-extortion ransomware group that emerged in 2023 and operates a data leak site where it publishes stolen files from victims who refuse to pay. The group has now claimed 885 total victims, with the most recent victim posted on August 2, 2026 -- two days ago. INC targets private sector organizations and government entities across multiple countries; confirmed victim geographies in the SMA1000 campaign include the United States, Australia, the United Arab Emirates, Colombia, and Switzerland.

The group's ransom negotiation infrastructure uses a dedicated contact number (+1 304 384-0401) where a representative named "Andrew" contacts victims and an email address (info@helprans.com) registered on June 2, 2026 -- just before the earliest confirmed exploitation of CVE-2026-15409 on June 22. The ransom negotiation domain runs on Cloudflare nameservers through registrar CNOBIN INFORMATION TECHNOLOGY LIMITED.

INC is not the only group that has used the SMA1000 exploit chain. Volexity tracked a separate cluster, designated UTA0533, that conducted pre-disclosure exploitation starting June 22 through at least July 13. UTA0533 activity used overlapping infrastructure from ASN 206092 (F.N.S Holdings Limited) with IP ranges across 45.131.194.0/24, 45.146.54.0/24, 63.135.161.0/24, and 173.239.211.0/24. INC affiliates accelerated their own campaigns after the patch and CISA KEV addition on July 14 -- a well-documented pattern where public disclosure of actively exploited vulnerabilities triggers a secondary wave of threat actor tooling.

Resecurity researchers note that INC has operationalized the full exploit chain into a repeatable playbook that moves from initial SMA1000 access to domain ransomware deployment in observed incidents, consistent with the group's history of extended dwell time and thoroughness before encryption.

The SMA1000 appliance series is a large-enterprise remote access product. Organizations running SMA6210, SMA7210, or SMA8200v as their primary SSL-VPN or remote desktop gateway face the highest direct exposure. These are common in environments that require certificate-based authentication, granular access control for large remote workforces, and compliance-aligned access logging -- making them prevalent in healthcare, financial services, government, and manufacturing sectors. All are targeted INC Ransomware sectors.

Any SMA1000 appliance running firmware versions 12.4.3-03245 through 12.4.3-03434 (12.4 branch) or 12.5.0-02283 through 12.5.0-02800 (12.5 branch) is vulnerable. SonicWall fixed the vulnerability in 12.4.3-03453 and 12.5.0-02835, released July 14. Any organization that applied an interim hotfix between those dates should confirm they applied the specific versions listed above -- multiple intermediate hotfixes existed that did not address these CVEs.

The risk is not limited to the SMA1000 appliance itself. Because SMA1000 appliances serve as SSL-VPN gateways, a compromised appliance gives attackers direct access to every internal host reachable through that VPN concentrator. The active session and TOTP seed theft means that even users who were authenticated at the time of compromise face ongoing credential exposure. Organizations that used the SMA1000 for certificate-based VPN access should audit all authentication events originating through the appliance for the 21-day zero-day window (June 22 through July 13) plus any period after patching was due but not applied.

See our original SonicWall SMA1000 zero-day analysis for the full vulnerability disclosure context and initial CISA BOD 26-04 guidance issued when the patch was released July 14.

The following indicators come from Resecurity and Volexity incident response reporting published this week. Cross-check these against your SMA1000 access logs, network egress traffic, and endpoint telemetry for the period from June 22, 2026 to present. The attacker user-agent "Mozilla/6.0 (Windows NT 11.0; Win64; x64) AppleWebKit/1537.136 (KHTML, like Gecko) Chrome/149.0.0.1 Safari/1537.136" -- a spoofed next-generation browser string that does not correspond to any real Chrome release -- gates ORANGETAIL web shell access and should be blocked at your WAF if detected.

Check SMA1000 appliance logs specifically: extraweb_access.log for HTTP 101 responses on /wsproxy, HTTP 200 responses on /api/login or /api/logout (injected by ORANGETAIL), and POST requests to /rollbackConfirm.action. In ctrl-service.log, path traversal sequences in hotfix removal entries are definitive evidence of CVE-2026-15410 exploitation. If re-imaging, preserve these logs before wiping -- they are forensic evidence for incident response.

Source IP addresses associated with INC's infrastructure cluster (ASN 206092, F.N.S Holdings Limited) include the ranges 45.131.194.0/24, 45.146.54.0/24, 63.135.161.0/24, and 173.239.211.0/24. Individual confirmed IPs from the UTA0533 pre-disclosure phase are listed in the IOC table below. These IPs may have been rotated by INC in August 2026 campaign activity; treat them as historical indicators requiring corroboration with behavioral evidence rather than block-and-forget signatures.

No CVE-specific Sigma rule exists yet for CVE-2026-15409 or CVE-2026-15410 -- these vulnerabilities target SonicWall appliance OS internals, not Windows event logs. Detection of the post-exploitation phase is where Sigma coverage exists: INC affiliates consistently use Impacket tooling for lateral movement and DCSync for credential extraction once they establish internal network access through the compromised SMA1000 appliance.

The two Impacket rules below require Windows Event ID 4688 (process creation with command line logging enabled) on domain controllers and Windows servers. "HackTool - Potential Impacket Lateral Movement Activity" detects the characteristic command-line patterns of wmiexec, dcomexec, atexec, and smbexec -- all observed in INC's documented lateral movement. "HackTool - Impacket Tools Execution" catches named Impacket binaries including secretsdump, the tool INC uses for domain credential extraction.

The DCSync rule requires Windows Advanced Audit Policy configuration for "Audit Directory Service Access" and SACL settings on directory objects. It detects Event ID 4662 with access mask 0x100 on the Active Directory replication rights GUIDs from non-machine accounts -- the precise pattern produced by secretsdump's DCSync mode.

The first step is determining whether your appliance was compromised before you apply the patch. If you patch a compromised appliance without re-imaging, the KNUCKLEBALL boot persistence and ROOTRUN setuid backdoor remain active on the patched firmware. Remediation without compromise investigation creates a false sense of security.

Begin with log review on your SMA1000: pull extraweb_access.log and ctrl-service.log for the June 22 through today window. Search for HTTP 101 on /wsproxy, HTTP 200 on /api/login or /api/logout (not your normal authentication flow), and POST to /rollbackConfirm.action. Any of these is a high-confidence compromise indicator. Check /var/lib/unit/conf.json for routes you did not configure. Run SHA-256 hashes against /usr/bin/xzfind and any .jar files in /tmp/ against the IOC hashes above.

If no indicators are found, apply the firmware patch through MySonicWall and rotate all credentials that were ever authenticated through the appliance -- this covers the zero-day window. If indicators are found, re-image the appliance before applying patched firmware and treat the internal network as fully compromised: revoke all active sessions, invalidate all TOTP seeds, and begin domain-wide credential rotation. Any organization where authentication was captured by the LDAP tcpdump sniffer faces broad credential exposure across all LDAP-authenticated systems.

The INC ransomware attack on networks accessed through a compromised SMA1000 follows a predictable pattern documented in earlier campaigns against Qilin ransomware PAN-OS GlobalProtect exploitation: VPN initial access, credential harvesting, domain reconnaissance, and encryption. Interrupt the chain at the earliest stage -- patching the SMA1000 -- or you face the later stages under full attacker access.

Enterprise VPN appliances are among the highest-value initial access targets in ransomware operations because they provide authenticated tunnels into internal networks without triggering endpoint detection controls. A successful compromise of an SMA1000 gives INC affiliates the same access level as a legitimate remote employee, plus the credential theft infrastructure to escalate to domain administrator before any human operator detects the intrusion.

The zero-day exploitation window of 21 days -- June 22 through July 13 -- means that every organization with an internet-exposed SMA1000 should treat this as a potential prior compromise, not just a patching priority. The CISA BOD 26-04 federal deadline passed on July 17, and three weeks of post-patch INC acceleration confirms that unpatched private-sector appliances are actively targeted today. The 885-victim count as of August 2 represents organizations that have had ransomware deployed or data stolen -- not just organizations scanned.

The INC Ransomware SonicWall SMA1000 exploit chain is a case study in the VPN gateway exploitation pattern that has dominated enterprise ransomware initial access in 2026. The same playbook -- CVE exploitation against an internet-facing VPN appliance, credential harvesting, lateral movement to domain controllers, encryption -- has been documented in multiple separate campaigns this year. Patching the gateway closes the door; hunting for post-exploitation artifacts and rotating domain credentials ensures INC has not already passed through it.