INC Ransomware Linked to Post-Disclosure Exploitation of SonicWall Zero-Days
Summary
Researchers link INC to post-disclosure exploitation of two SonicWall zero-days, while cautioning that not all activity is attributable to the group. Rapid7 prevented theft and encryption in most observed cases but saw ransomware deployed in at least one.
Key points
- SonicWall vulnerabilities CVE-2026-15409 and CVE-2026-15410 were reportedly exploited for three weeks before the vendor disclosed and patched them on July 14.
- Rapid7 said the earliest activity it observed began June 22 and traced to common hosted infrastructure; those attacks were largely unsuccessful, and researchers could not attribute all exploitation to INC.
- Rapid7 observed INC activity after disclosure using different infrastructure and reported that the group chained both flaws for full access.
- Rapid7 said it prevented data theft and encryption in most recent cases it handled, but observed ransomware deployed in at least one case.
- Resecurity reported that INC listed multiple new alleged victims on its leak site. The article does not independently confirm those claims.
Article Details
- Event Type
- Ransomware group exploitation of two SonicWall zero-day vulnerabilities
- Impact
- INC ransomware reportedly chained CVE-2026-15409 and CVE-2026-15410 for full access. Researchers have not determined how many organizations were affected; Rapid7 observed ransomware deployment in at least one case and said it prevented data theft and encryption in most of its recent cases. INC listed multiple alleged victims, and Resecurity reported that some victims received calls and emails pressuring them to negotiate.
CVE
People
Threat Actors
Vendors
HuntressJust last week, Huntress researchers spotted an attack spree that compromised 30 SonicWall customers in less than two days.Rapid7Rapid7 observed attacks after disclosure using different infrastructure.Resecurityagencies in Australia, the United States, the United Arab Emirates, Colombia and Switzerland, Resecurity said in a blog post Saturday.SonicWallResearchers said INC ransomware has become the most active threat actor exploiting two recently disclosed SonicWall zero-days, chaining the flaws for full access soon after public disclosure.
Countries
Australiamultiple new alleged victims on its data leak site, including organizations and government agencies in Australia, the United States, the United Arab Emirates, Colombia and Switzerland, Resecurity said in a blog postColombiaorganizations and government agencies in Australia, the United States, the United Arab Emirates, Colombia and Switzerland, Resecurity said in a blog post Saturday.Switzerlandand government agencies in Australia, the United States, the United Arab Emirates, Colombia and Switzerland, Resecurity said in a blog post Saturday.United Arab Emiratesleak site, including organizations and government agencies in Australia, the United States, the United Arab Emirates, Colombia and Switzerland, Resecurity said in a blog post Saturday.United Statesvictims on its data leak site, including organizations and government agencies in Australia, the United States, the United Arab Emirates, Colombia and Switzerland, Resecurity said in a blog post Saturday.