The SonicWall SMA 1000 zero-days we covered in July have resolved into a single-actor story. INC Ransom has emerged as the dominant threat actor exploiting CVE-2026-15409 and CVE-2026-15410, and the group’s leak site now lists 885 victims across the life of the operation, with a visible acceleration through August 2026.

The more consequential finding, from Resecurity’s exploit-chain analysis and Volexity’s incident work, is what the attackers took off the appliances before deploying ransomware: session databases and time-based one-time password (TOTP) seeds.

That single fact rewrites the remediation guidance for every organization that ran an exposed SMA 1000 this summer.

The chain

SonicWall released fixes for the vulnerability pair in mid-July 2026. Volexity observed exploitation beginning June 22, 2026 — roughly three weeks before a patch existed — attributed to a cluster it tracks as UTA0533.

The two flaws chain into arbitrary command execution and full device takeover. Resecurity’s writeup traces the path from the appliance’s WSProxy component through to root, at which point the adversary owns the VPN concentrator that sits at the network edge and terminates every remote employee session.

An SSL VPN appliance is an unusually rewarding place to land. It is internet-facing by design, it holds credentials for the workforce, it is frequently excluded from EDR coverage because it is an appliance rather than a server, and it is trusted by everything behind it.

Why the seeds change everything

Standard post-compromise guidance for an exploited edge device runs: patch the appliance, rotate credentials, review logs, move on.

TOTP seed theft breaks step two. A TOTP seed is the shared secret from which an authenticator app derives its rotating six-digit codes. It does not expire. It does not change when a user changes their password. Rotating a password while the attacker holds the seed produces an account that is exactly as compromised as it was before, because the second factor is still under adversary control.

Likewise, stolen session databases contain live authenticated sessions. Replaying a valid session token skips authentication entirely — no password, no code, no prompt.

The correct remediation for an organization that had an exposed, unpatched SMA 1000 between late June and mid-July is therefore substantially heavier than “install the update”:

  1. Patch the appliance — necessary, not sufficient.
  2. Invalidate every session on the appliance and force full reauthentication.
  3. Re-enroll every MFA token. Not reset — re-enroll, generating new seeds. Any user whose seed was in the stolen database needs a new secret.
  4. Rotate all credentials that traversed or were stored on the appliance, including service accounts and any LDAP or RADIUS bind accounts.
  5. Hunt for post-exploitation activity dating to June 22, 2026, not to the patch date.

Organizations that patched in July and declared the incident closed should treat that closure as provisional.

The victims, and the harassment

New victims listed on INC Ransom’s site between July 17 and August 1, 2026 include private-sector and government organizations in Australia, the United States, the United Arab Emirates, Colombia and Switzerland — a geographic spread consistent with opportunistic mass exploitation of an internet-exposed appliance rather than targeted selection.

Alongside the encryption and leak-site listings, victims reported an aggressive secondary pressure campaign. Multiple organizations received emails and phone calls from unknown parties claiming to offer ransomware recovery assistance. In some cases victims were contacted by an individual identifying himself as “Andrew” from the number +1 (304) 384-0401.

This is the same pattern we documented in the Ransom Busters investigation: purported incident-response and recovery outfits that are, in practice, either the extortion crew wearing a second mask or opportunists trading on the victim’s panic. An unsolicited inbound call offering ransomware help within days of an encryption event is not a coincidence and should be treated as part of the attack.

INC Ransom’s trajectory

INC Ransom has been operating since 2023 and has never shown much interest in the sectoral restraint some ransomware brands claim. We documented the group’s willingness to hit emergency alert infrastructure and its operational overlaps with Lynx following the FortiBleed campaign.

The SMA 1000 campaign fits the group’s established method precisely: wait for an edge-device vulnerability, exploit at scale before defenders finish patching, harvest authentication material on the way through, then monetize twice — once through encryption, once through leak-site extortion.

CISA has warned that the SMA 1000 vulnerabilities are being exploited to deploy ransomware. The vulnerabilities are in the Known Exploited Vulnerabilities catalog. The patches have existed since mid-July. The organizations still appearing on INC Ransom’s site in August were, in most cases, compromised before they patched — which is the entire argument for treating edge appliances as assume-breach infrastructure rather than as set-and-forget network furniture.

Sources