INC Ransomware Exploits SonicWall SMA 1000 Vulnerability Chain

Since June 2026, threat actor UTA0533 and the INC Ransomware group have been observed exploiting two critical zero-day vulnerabilities (CVE-2026-15409 and CVE-2026-15410) in SonicWall SMA 1000 series VPN appliances. By chaining a pre-authentication WebSocket proxy bypass with a path traversal flaw, attackers gain unauthenticated root access to these perimeter devices. This allows for total system compromise, credential harvesting, and persistent lateral movement into internal corporate networks.

The campaign has targeted numerous private and government organizations globally. Impacted entities are often subjected to "pressure tactics," including phone calls and emails from actors posing as security assistants. Because these appliances manage sensitive identity and access data, this campaign represents a high-severity threat to enterprise security boundaries. Organizations must prioritize patching and perform thorough compromise assessments to identify persistent memory-resident implants.