Actor Profile

INC Ransomware is a cybercrime operation conducting data extortion and ransomware attacks. The group has claimed 885 victims to date as of August 2, 2026, according to Ransomware.Live statistics. INC Ransomware has emerged as the dominant threat actor exploiting recently disclosed SonicWall Secure Mobile Access (SMA) 1000 series VPN appliance vulnerabilities, accelerating activity since early August 2026. The operation employs pressure tactics including direct phone calls to victims claiming to offer ransomware assistance, with individuals using names like "Andrew" and providing negotiation email addresses. The group maintains a data leak site where victims are publicly listed. Their motivation appears financial, leveraging zero-day exploitation for initial access followed by credential theft and lateral movement to maximize impact and extortion leverage.

TTPs (Tactics, Techniques, Procedures)

INC Ransomware exploits CVE-2026-15409 and CVE-2026-15410 in SonicWall SMA 1000 series VPN appliances, chaining these vulnerabilities for arbitrary command execution and device takeover. Initial exploitation began as zero-day attacks starting June 22, 2026, prior to vendor disclosure. Post-exploitation activities include deployment of Python script KNUCKLEBALL to launch Suo5 (open-source HTTP proxy) and ORANGETAIL (Behinder-like custom Java web shell). The operation extracts high-value credentials, active session databases, and TOTP MFA seed configurations to ensure persistent access. Attackers perform lateral movement into internal corporate networks. The group employs pressure tactics via phone calls and emails to victims, using social engineering to accelerate ransom negotiations. Key MITRE ATT&CK techniques likely include: T1190 (Exploit Public-Facing Application), T1059 (Command and Scripting Interpreter), T1505.003 (Web Shell), T1078 (Valid Accounts), T1556 (Modify Authentication Process), T1021 (Remote Services), T1486 (Data Encrypted for Impact).

Targets & Patterns

INC Ransomware targets organizations across multiple sectors and geographies. Between July 17 and August 1, 2026, new victims listed on their data leak site included private sector and government organizations from Australia, the United States, the United Arab Emirates, Colombia, Switzerland, and other countries. The targeting pattern suggests opportunistic exploitation of vulnerable SonicWall SMA 1000 series VPN appliances rather than sector-specific focus. The group appears to prioritize organizations with externally accessible VPN infrastructure, particularly those running unpatched SonicWall SMA 1000 devices. The inclusion of both government and private sector entities indicates broad targeting for financial gain. The rapid acceleration of victim listings since early August 2026 correlates with public disclosure of the exploited vulnerabilities, suggesting the group is racing to compromise remaining vulnerable systems before patching becomes widespread.

Historical Context

INC Ransomware has claimed 885 victims total as of August 2, 2026, according to Ransomware.Live tracking. The operation's exploitation of SonicWall SMA 1000 vulnerabilities represents an escalation in their activity, with accelerated victim listings beginning in early August 2026. The zero-day exploitation phase began June 22, 2026, attributed by Volexity to threat cluster UTA0533, with Rapid7 identifying strong tactical overlaps suggesting a single threat actor or coordinated group responsible for discovering and exploiting the vulnerability chain. The pre-disclosure exploitation period (June 22 - mid-July 2026) demonstrates sophisticated capability to identify and weaponize zero-day vulnerabilities. Post-disclosure, INC Ransomware emerged as the dominant actor exploiting these flaws, indicating either direct involvement in the initial zero-day campaign or rapid adoption of the exploit chain. The group's use of direct victim contact and pressure tactics aligns with broader ransomware industry trends toward aggressive negotiation methods.

Defensive Recommendations

  • Immediately patch SonicWall SMA 1000 series appliances to the latest version addressing CVE-2026-15409 and CVE-2026-15410
  • Conduct threat hunting to identify external source addresses that interacted with /wsproxy endpoint or used unusual parameters, correlating with internal authentication and lateral movement activity
  • Perform comprehensive credential rotation for all accounts accessible via compromised VPN appliances, prioritizing high-privilege accounts and service accounts
  • Verify integrity of TOTP MFA seed configurations and active session databases, re-enrolling MFA for users who authenticated through potentially compromised devices
  • Monitor for deployment of web shells (particularly Java-based shells like ORANGETAIL), Python scripts, and open-source proxy tools (Suo5) on VPN appliances and adjacent network segments
  • Implement network segmentation to limit lateral movement from VPN termination points into internal corporate networks