New ransomware variant leverages recently disclosed VPN vulnerabilities
The INC Ransomware operation has taken center stage in attacks against SonicWall Secure Mobile Access (SMA) 1000 VPN appliances, using newly disclosed flaws to encrypt data and demand ransoms. Resecurity reports a surge in activity since early August 2026.
The INC Ransomware operation has emerged as the dominant threat actor targeting SonicWall Secure Mobile Access (SMA) 1000 series VPN appliances. The group is exploiting recently disclosed security flaws that allow attackers to bypass authentication and gain full control of the device.
Since the beginning of August 2026, Resecurity has observed a noticeable acceleration in the ransomware’s activity. The organization has listed multiple victims on its data‑leak site, confirming that the attacks are ongoing and expanding.
Victims report that the malware encrypts critical files and presents a ransom note demanding payment in cryptocurrency. In many cases, the ransom demands have been set at $5,000 to $10,000, depending on the size of the affected network.
SonicWall has released firmware updates that patch the identified vulnerabilities. The company advises all users of the SMA 1000 series to apply the latest patches immediately and to verify that the firmware version in use is not affected.
Organizations that rely on the SMA 1000 series should also review their VPN access policies, enforce multi‑factor authentication, and monitor logs for unusual traffic patterns that could indicate exploitation attempts.
Resecurity’s analysis shows that the ransomware is delivered by exploiting the same authentication bypass that has been used in prior attacks on the device. The malware payload includes a custom encryption routine that targets file extensions commonly used in enterprise environments.
To mitigate the risk, security teams should conduct a rapid inventory of all SMA 1000 appliances, apply the vendor’s patches, and consider disabling unused services on the device.
In addition, administrators should ensure that only trusted users have VPN credentials and that those credentials are rotated on a regular basis.
Law enforcement agencies have not yet issued a formal warning about the ransomware, but the rapid escalation in reported incidents signals that the threat is now a priority for cybersecurity teams worldwide.
Moving forward, the security community will continue to monitor the evolution of the INC Ransomware operation and its tactics, techniques, and procedures. The organization’s continued focus on SonicWall vulnerabilities underscores the importance of timely patching and vigilant monitoring in the face of evolving ransomware threats.
The INC Ransomware operation has emerged as the dominant threat actor targeting SonicWall Secure Mobile Access (SMA) 1000 VPN appliances. The group is exploiting recently disclosed security flaws that allow attackers to bypass authentication and gain full control of the device.
Since the beginning of August 2026, Resecurity has observed a noticeable acceleration in the ransomware’s activity. The organization has listed multiple victims on its data‑leak site, confirming that the attacks are ongoing and expanding.
Victims report that the malware encrypts critical files and presents a ransom note demanding payment in cryptocurrency. In many cases, the ransom demands have been set at $5,000 to $10,000, depending on the size of the affected network.
SonicWall has released firmware updates that patch the identified vulnerabilities. The company advises all users of the SMA 1000 series to apply the latest patches immediately and to verify that the firmware version in use is not affected.
Organizations that rely on the SMA 1000 series should also review their VPN access policies, enforce multi‑factor authentication, and monitor logs for unusual traffic patterns that could indicate exploitation attempts.
Resecurity’s analysis shows that the ransomware is delivered by exploiting the same authentication bypass that has been used in prior attacks on the device. The malware payload includes a custom encryption routine that targets file extensions commonly used in enterprise environments.
To mitigate the risk, security teams should conduct a rapid inventory of all SMA 1000 appliances, apply the vendor’s patches, and consider disabling unused services on the device.
In addition, administrators should ensure that only trusted users have VPN credentials and that those credentials are rotated on a regular basis.
Law enforcement agencies have not yet issued a formal warning about the ransomware, but the rapid escalation in reported incidents signals that the threat is now a priority for cybersecurity teams worldwide.
Moving forward, the security community will continue to monitor the evolution of the INC Ransomware operation and its tactics, techniques, and procedures. The organization’s continued focus on SonicWall vulnerabilities underscores the importance of timely patching and vigilant monitoring in the face of evolving ransomware threats.