INC Ransomware Emerges as Dominant Actor Exploiting SonicWall SMA 1000 Flaws

The INC Ransomware operation has become the dominant threat actor exploiting a series of zero-day vulnerabilities in SonicWall SMA 1000 VPN appliances. Since the beginning of August 2026, the group has been aggressively targeting victims globally, including private sector and government organizations, leveraging these vulnerabilities to gain persistent access and deploy tools like KNUCKLEBALL and ORANGETAIL. Resecurity advises immediate patching and enhanced threat hunting to mitigate the risk.