Summary
- INC ransomware, responsible for nearly 900 victims across 71 countries since its discovery, is the most assertive group exploiting chained SonicWall zero-days CVE-2026-15409 and CVE-2026-15410.
- Exploitation began around 22 June — three weeks before SonicWall disclosed and patched the flaws on 14 July — though early attempts were largely unsuccessful.
- Post-disclosure, INC shifted to different infrastructure and moved rapidly from initial access to ransomware deployment, indicating a higher operational tempo than earlier attackers.
- Australian organisations are among alleged victims listed on INC’s data leak site, alongside entities in the US, UAE, Colombia, and Switzerland.
- Ten of the 17 SonicWall vulnerabilities added to CISA’s Known Exploited Vulnerabilities catalogue since late 2021 have been used in ransomware campaigns.
The threat actor in focus
INC ransomware has emerged as the dominant group exploiting a chained pair of SonicWall zero-days disclosed and patched on 14 July. Researchers at Rapid7 describe it as a ransomware-as-a-service operation that has claimed nearly 900 victims across 71 countries since it was first identified three years ago. Brett Deroche, Rapid7’s director of incident response, told CyberScoop: “Since public disclosure, INC ransomware has emerged as the most commonly named threat actor actively weaponizing this vulnerability chain.”
A timeline worth understanding
The two vulnerabilities — CVE-2026-15409 and CVE-2026-15410 — were being actively exploited for roughly three weeks before SonicWall disclosed them. Rapid7’s telemetry places the earliest observed exploitation at 22 June, though those initial attempts are described as largely unsuccessful. INC’s confirmed activity began after public disclosure, using different infrastructure and a noticeably faster operational pace. Deroche noted the group moved from initial access to ransomware deployment “in short order,” which he characterised as a meaningfully different skill level compared to the pre-disclosure activity.
Chaining vulnerabilities for full access
While INC was not the first group to probe these flaws, it has been the most deliberate in chaining both vulnerabilities together to gain full system access. Attribution across the full body of exploitation remains incomplete. As Deroche put it, “Attribution here isn’t a single clean answer.” Early exploitation traced to common hosted infrastructure, while INC’s post-disclosure operations used distinct infrastructure with a faster transition to payload delivery.
Australian organisations in scope
Security firm Resecurity reported that INC has listed multiple new alleged victims on its data leak site, including organisations and government agencies in Australia, the United States, the United Arab Emirates, Colombia, and Switzerland. Resecurity also noted that several victims received emails and phone calls from individuals claiming to represent the attackers, pressuring them to enter negotiations — a tactic that adds a social-engineering dimension to an already serious technical incident.
A pattern of SonicWall exposure
This incident is not an isolated event for SonicWall customers. Ten of the 17 SonicWall defects listed in CISA’s Known Exploited Vulnerabilities catalogue since late 2021 have been linked to ransomware campaigns. Separately, Huntress researchers identified an attack spree last week that compromised 30 SonicWall customers in under two days. A prior incident allowed a state-sponsored group to exfiltrate firewall configurations belonging to SonicWall customers broadly. The cumulative picture is one of persistent and varied targeting of this vendor’s product base.
Containment so far — but not complete
Rapid7 reports it has prevented data theft and encryption in the majority of recent cases where it has been engaged. However, ransomware was successfully deployed in at least one case within the firm’s observed set, and the researchers acknowledge their telemetry does not capture the full scope of impact. The total number of organisations affected by these specific zero-days has not been determined.
Why it matters
SonicWall appliances are a common fixture in enterprise and government network perimeters, and this incident reinforces a well-established pattern: edge devices with unpatched vulnerabilities become ransomware entry points quickly. The three-week gap between initial exploitation and vendor disclosure is a reminder that patch windows do not begin at the disclosure date. With Australian entities named among alleged victims and a capable ransomware-as-a-service group actively chaining these flaws post-disclosure, any organisation running SonicWall products should treat this as an active risk management issue, not a future consideration.
What to do now
- Apply SonicWall’s patches for CVE-2026-15409 and CVE-2026-15410 immediately if not already done; the vendor released fixes on 14 July.
- Review logs for suspicious activity dating back to at least 22 June to identify potential pre-disclosure compromise.
- Assess whether any SonicWall appliances in your environment were internet-exposed during the exploitation window and treat those as potentially compromised pending investigation.
- If you receive unsolicited contact — email or phone — from parties claiming to hold your data, do not engage without first conducting an internal investigation and involving legal and incident response counsel.
- Cross-reference your SonicWall product versions against CISA’s Known Exploited Vulnerabilities catalogue to identify any additional unpatched defects in your environment.
