INC Ransom

The original entry recorded SonicWall's confirmation that CVE-2026-15409/-15410 were being exploited as zero-days and directed emergency patching. Volexity has now published the reconstructed intrusion, attributed it to an actor it tracks as UTA0533, and shown that patching alone is insufficient; the delta below is the full kill chain, the on-appliance implants, and the compromise-response guidance the terse advisory did not carry (Volexity, 2026-07-17).

Volexity was engaged after suspect authentication and lateral movement were seen originating from SonicWall SMA 1000 appliances (models 6210/7210/8200v); the earliest sign of compromise was 2026-06-22, weeks before SonicWall's 2026-07-14 disclosure (Volexity, 2026-07-17). SonicWall's PSIRT confirms it "has investigated multiple cases indicating the active exploitation of the vulnerabilities described in this advisory" (SonicWall SNWLID-2026-0008, 2026-07-14), and Rapid7's MDR team independently found the same two zero-days under attack (Rapid7, 2026-07-16).

Initial access (T1190, T1133). CVE-2026-15409 is a pre-authentication server-side request forgery in the SMA 1000 /wsproxy endpoint. A crafted WebSocket-upgrade request establishes a tunnel from the unauthenticated external attacker straight to services that are supposed to be reachable only on the appliance's own loopback; Volexity confirms "no valid SMA session cookie was required during this process" (Volexity, 2026-07-17). Through the tunnel the actor reached the appliance's bundled CouchDB/Erlang services and a localhost-only control service; the shipped CouchDB carries hardcoded admin:admin credentials, and the control service's authentication password is derivable from a device UUID, so the SSRF turns both into part of the external attack surface.

Privilege escalation (T1068). CVE-2026-15410 is a path traversal in the hotfix-rollback workflow: the sysCtrl.execRemoveHotfix operation builds a rollback path from caller-controlled input and hands it to /usr/local/bin/remove_hotfix, which then executes it. A rollback name containing directory-traversal sequences resolves outside the intended rollback directory and runs an attacker-staged script as root.

Persistence and implants (T1055, T1505.003, T1090.003, T1037.004). With root, UTA0533 dropped a setuid helper and a Python loader Volexity calls KNUCKLEBALL, which injects two JAR archives into the appliance's legitimate workplace process: the open-source Suo5 HTTP proxy-forwarder and a Behinder-like Java webshell Volexity calls ORANGETAIL. Persistence was established by adding a call to the loader inside the appliance's workplace init script, and the NGINX Unit configuration was rewritten to add routes that proxy attacker-chosen (arbitrary) request paths to the injected webshell and proxy, so hunting for a fixed URL is the wrong shape; the behaviour is unexpected route entries in the appliance's own reverse-proxy configuration.

Credential access and lateral movement (T1040, T1059). The actor ran tcpdump from a script staged in the appliance's temp directory to capture unencrypted LDAP traffic (TCP 389), harvesting directory credentials off the wire (Volexity, 2026-07-17). Rapid7's engagement observed the actor then "quickly shifted to lateral movement, pivoting from the compromised appliance directly into the internal corporate network" (Rapid7, 2026-07-16). How far that onward movement reached differs across the two IR firms' cases: Volexity concludes that in the appliances it investigated, "available evidence suggests the threat actor was less successful moving laterally or gaining access to other systems" (Volexity, 2026-07-17), so treat a foothold on the appliance as a demonstrated launch point for internal movement, but not evidence that deep lateral movement always succeeds.

The earlier entry reconstructed UTA0533's appliance-to-network kill chain against SonicWall SMA 1000 and told readers to treat an exposed, unpatched appliance as compromised rather than merely vulnerable. That direction stands. Four things have moved since, and two of them change what "remediated" means.

Who is on the chain. Rapid7's director of vulnerability intelligence, Douglas McKee, told The Hacker News that "More recently, INC Ransomware has emerged as the dominant threat actor actively weaponizing this vulnerability chain", and that the technical correlation with the pre-disclosure cluster "indicates that a single threat actor or coordinated group is responsible for discovering and exploiting this zero-day vulnerability" (The Hacker News, 2026-08-03). Two limits belong with that quote. Rapid7 attributed this activity to INC Ransom on 2026-07-17, hours before this pipeline's 2026-07-18 entry, which did not carry it (Dark Reading, 2026-07-17), so the actor link is seventeen days old and the new element is only the dominance characterisation. And the overlap claim is Rapid7's alone: Volexity, which named the UTA0533 cluster, has published no INC link, so the wider framing that both firms made that connection is not supported.

A patch you applied is not necessarily a patch that is running. This is the finding with the most operational consequence, and no prior entry here has carried it. Rapid7's director of incident response, Brett Deroche, describes containment succeeding in most engagements but not all: "We observed the threat actor maintaining persistence and rolling the newly applied patch back to a vulnerable state to maintain access. A comprehensive forensic review of the firewall is required to ensure complete eviction." A root-level attacker resident on the appliance can undo remediation, which means the standard verification (check the version, close the ticket) reports success on a box that is still owned. Resecurity's DFIR work reaches the same conclusion from the artifact side: "Setuid binaries, Python injectors, modified init scripts, and NGINX Unit configuration changes can survive reboots and may persist after a superficial firmware upgrade if not remediated. A patched appliance that still contains ROOTRUN or KNUCKLEBALL remains compromised" (Resecurity, 2026-08-01).

The rotation scope is wider than passwords and MFA seeds. Rapid7 reports that the attacks used the appliance foothold to extract high-value credentials, active session databases and TOTP multi-factor-authentication seed configurations (The Hacker News, 2026-08-03); stolen session state and MFA seeds keep working after a password reset, which is why the rotation list matters more than it looks. The earlier entry told readers to reset account passwords and TOTP seeds. Resecurity's list of what the appliance processed or stored, and therefore what has to be replaced, extends to SMA administrator passwords, directory-service bind credentials for LDAP, RADIUS and Active Directory, user passwords for every account that authenticated during the exposure window, certificates and API keys configured on the appliance, and TOTP tokens and seeds. Bind credentials are the item most often missed, and they are the ones that grant standing directory access independent of the appliance. Where compromise is confirmed, Resecurity's guidance is to factory-reset, reimage on patched firmware and restore configuration from a backup pre-dating the vulnerable branches; a constraint SonicWall states independently in its own product notice, which limits usable backups to those predating 12.4.3-03245 and 12.5.0-02283 (SonicWall, 2026-07-14).

A new pressure layer at the extortion stage. Resecurity, which has run incident response for several victims, reports that "many of the new victims received emails, as well as phone calls from unknown organizations claiming to assist with ransomware issues", using infrastructure registered shortly after the intrusion. Whether this is the same operation or opportunists reading the leak site, the effect is the same: inbound offers of help with a ransomware problem the organisation has not made public are adversary contact, and the people receiving them are often outside the security team.

On victim geography, hold the claim loosely. Resecurity reports that INC's leak-site listings between 2026-07-17 and 2026-08-01 "include private sector and government organizations from Australia, the US, UAE, Colombia, Switzerland, and other countries", and SecurityWeek relays that INC "has emerged as the most active one" among actors chaining the two CVEs (SecurityWeek, 2026-08-03). No organisation is named, no victim or authority has confirmed any listing, and Resecurity does not state that any individual listing was reached through this exploit chain; the country list and the chain are separate claims in the same report. Treat it as an unverified criminal claim rather than evidence of a Swiss compromise.

Hunt.io's analysis, relayed at length by Security Affairs, links the 17 July 2026 cyberattack on the Borough Council of King's Lynn and West Norfolk (UK local government) (with moderate confidence) to a wider mass-exploitation campaign against CVE-2026-15409, materially broader than the UTA0533-attributed targeted intrusion the earlier updates above describe (Security Affairs, 2026-09-11). Hunt.io's AttackCapture system crawled an operator's own unauthenticated open directory the same day the council disclosed, recovering the complete toolchain and campaign scope: 250 target appliances, 168 with LDAP configurations exposed (534 Active Directory accounts across 160 domains), 9 environments losing SAM/LSA secrets, and 5 losing their entire domain database via full DCSync replication against 7 domain controllers, with confirmed credential theft in France, India, Italy and the US and a broader target list spanning the UK, Canada, Germany, Sweden, Poland, Hungary, South Korea and Hong Kong. OffSeq's Threat Radar, an AI-generated summary tracker, carries the same campaign statistics in its own posting on the report (OffSeq Threat Radar, 2026-09-10), a repost rather than independent verification, since it traces to the same Hunt.io findings rather than a separate observation.

The technique this wave adds: operators ran a standalone Linux build of Impacket's secretsdump directly on the compromised SonicWall appliance itself against internal Windows systems, extracting SAM and LSA secrets and, where the harvested LDAP credentials lacked sufficient privilege to run DCSync directly, falling back to pass-the-hash DCSync replication using machine-account NTLM hashes recovered from those LSA secrets (Security Affairs, quoting Hunt.io, 2026-09-11). Running the credential-theft tooling from the appliance's own operating system, rather than from a foothold on a monitored Windows or Linux host, is the operative choice: "By 16 July 2026, two days after SonicWall disclosed CVE-2026-15409, a threat actor was using modified, multithreaded tooling to identify vulnerable SMA 1000 appliances, extract and decrypt LDAP credentials, and automate follow-on credential theft against internal Active Directory environments" (Hunt.io, quoted by Security Affairs, 2026-09-11). Scripts recovered from the directory carried extensive Chinese-language comments, which Hunt.io states is insufficient on its own for attribution; no link to UTA0533 or to INC Ransom is asserted in this reporting, treat it as a separate, broader post-disclosure scanning wave rather than the same operator.

Defender takeaway (delta only): organizations typically have far less process, file and network visibility into a VPN/firewall appliance's own operating system than into EDR-monitored Windows and Linux hosts, this wave specifically exploited that gap by running its credential-theft tooling on the appliance itself. Triage: where forensic capability allows inspecting the appliance's own filesystem and process history (not just its network logs), an unexpected standalone binary or interpreter process on the appliance (distinct from its normal service processes) run against internal LDAP/AD infrastructure is the signature this wave adds to the existing detection guidance above.