The INC Ransomware campaign now stands out as a leading cyber threat, leveraging newly revealed vulnerabilities in SonicWall's SMA 1000 series VPN devices. In a report released over the weekend, Resecurity revealed that it observed the INC Ransomware increasing its activity since early August 2026, posting details of multiple affected entities on their data leak site. According to statistics from Ransomware.Live, the group has claimed 885 victims thus far, with the most recent victim identified as recently as August 2nd, 2026.
SonicWall released fixes in mid-July 2026 for these vulnerabilities.
Rapid7 has identified them as zero-day threats, used to steal high-value credentials, access active session databases, and extract TOTP MFA seed configurations with the goal of achieving long-term, persistent access and lateral movement within the corporate network. The attacks involve deploying a Python script named KNUCKLEBALL to launch Suo5, an open-source HTTP proxy, and a custom Java web shell called ORANGETAIL resembling Behinder-like functionality. Resecurity reported that among the new victims listed on Inc Ransomware's site from July 17 to August 1, 2026, include private sector organizations and government entities across Australia, the United States, the UAE, Colombia, Switzerland, and other countries.
