INC Ransomware Emerges as Dominant Actor Exploiting SonicWall SMA 1000 Flaws

The INC Ransomware operation is now the primary threat actor exploiting security vulnerabilities in SonicWall's SMA 1000 series VPN appliances. This development comes after recently disclosed flaws in these appliances. Resecurity has reported that INC Ransomware activity has increased since early August 2026. The group has listed multiple victims on its data leak site, indicating successful exploitation of the vulnerabilities. INC Ransomware's accelerated activity suggests it is actively targeting these flaws. The vulnerabilities are being used to compromise SonicWall Secure Mobile Access appliances.