INC Ransomware Emerges as Dominant Actor Exploiting SonicWall SMA 1000 Flaws

INC Ransomware has become the dominant threat exploiting critical zero-day vulnerabilities CVE-2026-15409 and CVE-2026-15410 in SonicWall SMA 1000 VPN appliances, leveraging these flaws for unauthorized command execution, credential theft, and lateral movement within corporate networks. SonicWall issued patches in mid-July 2026, but the group has accelerated attacks into August with nearly 885 victims claimed.

This Wire brief sits within Fusion42's coverage of Cybersecurity and Security Infrastructure.