Key Takeaways
INC ransomware is chaining CVE-2026-15409 (CVSS 10.0 SSRF) and CVE-2026-15410 to take over SonicWall SMA 1000 VPN appliances without authentication.
The group has claimed 885 victims since the campaign began, with new organizations still being added as of August 2, 2026.
Attackers extract session databases and TOTP MFA seeds, which means a patch alone does not close the door if credentials were harvested before you applied it.
SonicWall and CISA confirmed exploitation in mid-July, and CISA's remediation clock has already expired for federal agencies.
Any organization running SMA 1000 appliances should treat every credential and MFA seed on the device as burned, not just apply the patch.
A three-week-old patch, still an open door
SonicWall disclosed CVE-2026-15409 and CVE-2026-15410 on July 14, warning that both were already being exploited in the wild against its SMA 1000 series SSL VPN appliances. CVE-2026-15409 is a server-side request forgery flaw in the Workplace interface, rated a maximum CVSS 10.0 because it requires no authentication at all. CVE-2026-15410 is a code injection bug in the Appliance Management Console that does require credentials, but chains cleanly with the first to hand an attacker remote code execution on the box. CISA added both to its Known Exploited Vulnerabilities catalog the next day and gave federal agencies until July 17 to patch.
That deadline has come and gone, and the exploitation has not slowed down. According to a report published by The Hacker News on August 3 and corroborated by Tenable's original analysis, the INC ransomware group has turned these two flaws into its primary initial-access method for the summer. The group's leak site lists 885 claimed victims spanning Australia, the United States, the UAE, Colombia, Switzerland, and other countries, with the most recent addition dated August 2. For a VPN appliance category that is supposed to be the hardened front door of the network, three weeks between disclosure and a campaign of this scale is not a comfortable margin.
What INC actually does once it is inside
The initial foothold matters less here than what INC affiliates do immediately after gaining it. Researchers observed the group extracting high-value credentials, active VPN session databases, and time-based one-time password seed configurations directly from compromised SMA 1000 appliances. That last item matters more than it might seem: a stolen TOTP seed lets an attacker generate valid MFA codes indefinitely, which means multi-factor authentication stops functioning as a control the moment the appliance is compromised, not just for the duration of the breach.
For persistence and lateral movement, the group deploys a mix of custom and off-the-shelf tooling, including the KNUCKLEBALL Python script, the Suo5 HTTP proxy, and the ORANGETAIL Java web shell. Investigators recommend checking logs for external addresses that interacted with the appliance's /wsproxy endpoint or used unusual parameters, and correlating any hits against internal authentication and lateral-movement activity. That level of detail suggests INC affiliates are running a fairly standardized playbook across victims rather than improvising, which is consistent with a mass-exploitation campaign rather than a series of targeted intrusions.
Why patching alone will not fix this
The credential and TOTP seed harvesting is the detail security leaders should not skip past. Most vulnerability response processes end at "patch applied, ticket closed." That is insufficient here. If your SMA 1000 appliance was internet-facing between mid-July and whenever you patched it, you should assume any credentials and MFA seeds that touched that device during that window are compromised, whether or not you have direct evidence of exploitation on your instance. That means rotating VPN credentials, reissuing MFA seeds, and invalidating active sessions, not just installing the fix.
This also argues for treating remote-access appliances as a distinct risk tier with its own response runbook, separate from general patch management. A VPN gateway sits at the boundary between untrusted internet traffic and your internal network by design, and when it is compromised, the blast radius includes every credential that has ever authenticated through it. CISOs should be asking their teams right now whether SMA 1000 (or any SonicWall SMA appliance) is in the environment, whether it was patched before or after the exploitation window opened, and whether credential rotation has actually happened or just been assumed.
The pattern behind the pattern
This is not an isolated SonicWall problem. Edge and remote-access appliances, VPN gateways, firewall managers, secure file transfer tools, have become the preferred entry point for both ransomware crews and nation-state actors precisely because they are internet-facing by design and historically under-monitored compared to endpoints and cloud workloads. INC's 885-victim tally over a matter of weeks shows how quickly a single unpatched appliance category can scale into a volume campaign once a working exploit chain exists.
For PE-backed SaaS and retail-commerce organizations in particular, the exposure compounds through portfolio and franchise structures: a shared SonicWall deployment used by a portfolio company or a regional retail operator can turn one unpatched appliance into an entry point for dozens of connected environments. Vendor risk reviews and M&A due diligence checklists should explicitly ask which remote-access appliances are deployed, on what firmware version, and whether credential rotation has happened after any disclosed CVE, not just whether a patch was applied.
What to do this week
If you run SonicWall SMA 1000 appliances, confirm you are on the patched firmware for CVE-2026-15409 and CVE-2026-15410, and do not stop there. Rotate every credential and MFA seed associated with the appliance, terminate all active VPN sessions, and hunt for the indicators researchers have published: KNUCKLEBALL, Suo5, and ORANGETAIL artifacts, along with anomalous /wsproxy traffic. Cross-reference the timeline against when your patch was actually applied versus when SonicWall disclosed active exploitation on July 14.
More broadly, this is a good prompt to inventory every internet-facing remote-access appliance in your environment, not just SonicWall, and confirm each has an owner who is tracking vendor advisories on a cadence shorter than 30 days. INC's 885 victims did not all fail to patch out of negligence; many simply did not close the gap fast enough. In a threat environment where mass exploitation of a single CVE can produce hundreds of victims within weeks, the organizations that come out ahead are the ones that treat edge appliance patching as an hours-to-days problem, not a monthly maintenance window.
