INC Ransomware Exploits SonicWall SMA 1000 Vulnerabilities for Cyber Attacks

INC Ransomware has become the primary threat actor exploiting zero-day vulnerabilities in SonicWall SMA 1000 VPN appliances, enabling credential theft and lateral movement. The attacks leverage CVE-2026-15409 and CVE-2026-15410, with victims across multiple countries reported on ransomware data leak sites.

The INC Ransomware operation has emerged as the "dominant threat actor" exploiting the recently disclosed security flaws in SonicWall Secure Mobile Access (SMA) 1000 series VPN appliances.

In a report published over the weekend, Resecurity said it observed the INC Ransomware accelerating its activity since the beginning of August 2026, listing multiple victims on its data leak site. Per

Read original article