INC Ransomware Chains Two SonicWall Zero-Days for Root Access…

Two zero-days in SonicWall SMA 1000 let INC Ransomware gain remote root access. Pre-disclosure exploitation began June 22, three weeks before patches.

INC Ransomware chained two zero-days in SonicWall SMA 1000 to achieve persistent root-level access on internet-facing VPN appliances, with pre-disclosure exploitation documented from June 22, 2026. The campaign, initially tracked by Volexity as UTA0533, hit victims in at least five countries — United States, Australia, United Arab Emirates, Colombia, and Switzerland — with victims posted to INC's data leak site between July 17 and August 1. SonicWall disclosed on July 14, 2026; CISA added both vulnerabilities to the Known Exploited Vulnerabilities catalog with a remediation due date of July 17.

Key Takeaways

CVE-2026-15409 (CVSS 10.0, pre-auth SSRF) and CVE-2026-15410 (CVSS 7.2, path traversal/code injection) form a chain that turns unauthenticated remote access into root code execution on SonicWall SMA 1000 appliances.
Pre-disclosure exploitation began June 22, 2026 — over three weeks before SonicWall's July 14 patch — with the ROOTRUN malware toolkit observed on disk that same day.
Rapid7 confirmed direct pivoting from compromised appliances to internal Active Directory via NTLM authentication, plus the attackers' ability to roll back patches to maintain access.

The Attack Chain: From Pre-Auth SSRF to Root via WebSocket and Path Traversal

The entry point is CVE-2026-15409, a pre-authentication Server-Side Request Forgery in the SonicWall SMA 1000 /wsproxy endpoint. Exploitation requires a specific User-Agent, "SMA Connect Agent," and the parameter bmID=-3389 to open a WebSocket tunnel to localhost-only services normally inaccessible from the internet.

From that foothold, the actor interacts with CouchDB on port 1050 to stage payloads in /tmp, then exploits CVE-2026-15410 in the ctrl-service remove_hotfix workflow (port 8188). The vector is a path traversal in POST /rollbackConfirm.action that enables code execution as root. The NVD record for CVE-2026-15409 lists CVSS 10.0 with vector AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H; CVE-2026-15410 carries CVSS 7.2 with vector AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H, per their respective official records with CISA-ADP assessment.

The documented post-exploitation malware toolkit includes ROOTRUN, a setuid backdoor first observed June 22, 2026; KNUCKLEBALL, a Python loader for injection into the appliance JVM; Suo5, an HTTP tunnel for covert communications; and ORANGETAIL, a Java web shell. The appliance's complex software stack — JVM, CouchDB, Erlang, NGINX Unit — expands the attack surface and complicates post-compromise forensics.

MFA Seed Theft and the Failure of Password Resets

Compromise of a boundary VPN appliance exposes not only active sessions but the credentials of the second-factor mechanism itself. Jacob Krell of Suzu Labs, quoted by SecurityWeek, stated verbatim: "The attackers stole session databases and the time-based one-time password (TOTP) seeds that generate one-time codes. Password resets don't evict them. Any user who authenticated through a compromised appliance needs full MFA re-enrollment from scratch."

This element transforms the incident's scope: the compromised appliance is no longer an isolatable entry point but a generator of valid credentials for the entire infrastructure. Rapid7 also confirmed direct pivoting to internal domain controllers via NTLM authentication, bypassing the need for a VPN connection to move laterally.

"We observed the threat actor maintaining persistence and rolling the newly applied patch back to a vulnerable state to maintain access. A comprehensive forensic review of the firewall is required to ensure complete eviction."
— Brett Deroche, director of incident response at Rapid7

Post-Patch Persistence: When Patching Is Not Enough

Rapid7's observation of attacker-driven patch rollback introduces a severe operational constraint: applying the patch without full forensic verification can create a false sense of security while the actor retains access. The implicit recommendation in the sources — never stated as a generic formula but deduced from documented evidence — is that internet-facing appliances require an assume-compromise stance: re-imaging from clean firmware, not mere in-place patching.

The finding aligns with the nature of the observed malware. ROOTRUN, as a setuid backdoor, survives many update procedures; KNUCKLEBALL operates at the JVM level, making detection difficult without process memory analysis. The combination suggests operators engineered persistence to withstand standard countermeasures.

INC Ransomware: Actors, Numbers, and Timeline

Douglas McKee, director of vulnerability intelligence at Rapid7, confirmed that "a single threat actor or coordinated group is responsible for discovering and exploiting this zero-day vulnerability," adding that "INC Ransomware has emerged as the dominant threat actor actively weaponizing this vulnerability chain." Resecurity's synthesis, reported by multiple sources, identifies INC as the dominant group in the campaign from mid-July 2026.

The 885 victims claimed by INC Ransomware on Ransomware.Live as of August 3, 2026 — reported by The Hacker News — represents the group's historical volume, not the specific count for this SonicWall campaign. The relationship between Volexity's UTA0533 cluster and INC Ransomware rests on TTP overlap; no infrastructure overlaps definitively linking the two clusters have emerged to date.

Immediate Actions

Apply SonicWall patches for CVE-2026-15409 and CVE-2026-15410 immediately; both have been in the CISA KEV catalog since July 14, 2026, with a remediation due date of July 17.
Assume compromise for every internet-facing SMA 1000 appliance: re-image from clean firmware rather than patch in-place, given confirmed attacker patch rollback.
Full MFA re-enrollment for all users who authenticated through a compromised appliance, regardless of any password resets performed.
Forensic verification of the appliance before considering it restored: hunt for ROOTRUN, KNUCKLEBALL, Suo5, and ORANGETAIL indicators, with attention to JVM and launchctl persistence.

The Takeaway: The VPN Paradox and Complexity as a Structural Vulnerability

The episode highlights an architectural contradiction: VPN appliances are designed as trust boundaries, yet their software complexity — multi-component stacks with JVM, NoSQL databases, Erlang runtimes — exposes them to exploit chains impossible to anticipate with threat modeling alone. The result is that the device meant to protect remote access becomes the vehicle for nullifying every perimeter control.

The lesson cannot be contained in a technical advisory: it demands a recalibration of how organizations manage the lifecycle of edge appliances. Patching without assume-compromise, in this scenario, is not defense but deferral.

Sources

Information verified against cited sources and current as of publication.

Sources

Sources and references