Cybersecurity News

Cybersecurity News: SonicWall VPN Flaws Fuel INC Attacks

Published August 4, 2026 · DNS Benchmark Pro Editorial · Reading time: 5 minutes

Cybersecurity news illustration showing a compromised enterprise VPN gateway appliance at the network edge, with cyan data pathways flowing from the public internet through the gateway into protected internal server infrastructure — *Illustration.* An SSL VPN appliance sits at the boundary by design: internet-facing on one side, implicitly trusted by the internal network on the other. That position is exactly what makes a server-side request forgery flaw on the device score CVSS 10.0.

TL;DR — The biggest cybersecurity news of the week is that INC Ransomware has become the dominant threat actor chaining two SonicWall SMA 1000 zero-day vulnerabilities, CVE-2026-15409 and CVE-2026-15410, into unauthenticated root access on internet-facing VPN gateways. Attackers are stealing administrator credentials, live session databases and TOTP multi-factor seeds — meaning a patch alone does not evict them. Exploitation predates the July 14 fix by roughly three weeks, and new victims were still being posted as of August 2.

If you run a self-hosted remote-access gateway, this week's cybersecurity news is not a headline you can defer to the next maintenance window. Over the weekend, threat intelligence firm Resecurity reported that the INC Ransomware operation has accelerated sharply since the start of August, and that its intrusion path runs straight through SonicWall Secure Mobile Access (SMA) 1000 series appliances. Rapid7's director of vulnerability intelligence, Douglas McKee, described INC as "the dominant threat actor actively weaponizing this vulnerability chain."

Public tracking on Ransomware.Live puts the group at 885 claimed victims to date, with the most recent listing dated August 2, 2026. Victims added between July 17 and August 1 span private-sector and government organisations in Australia, the United States, the U.A.E., Colombia and Switzerland — a geographic spread consistent with opportunistic internet-wide scanning rather than targeted espionage.

The zero-day vulnerability chain, in technical terms

SonicWall disclosed the pair on July 14 in advisory SNWLID-2026-0008. Individually, neither looks like a catastrophe. Chained, they collapse the entire authentication boundary of the appliance.

CVE	Class	CVSSv3
CVE-2026-15409	Server-side request forgery (SSRF) in the SMA 1000 Workplace interface	10.0
CVE-2026-15410	Code injection in the Appliance Management Console (AMC)	7.2

CVE-2026-15410 is the one that gives command execution, but on paper it requires an authenticated session. CVE-2026-15409 supplies that missing precondition. An SSRF on an internet-facing box lets an unauthenticated attacker make the appliance issue requests on their behalf — probing internal services, relaying authentication material, and reaching the management console from a network position the access-control model implicitly trusts. Stitch the two together and you have a fully remote, unauthenticated path to arbitrary OS command execution as root.

Why an SSRF earned a CVSS 10.0

Scoring a request-forgery bug at 10.0 surprises people who think of SSRF as a stepping stone rather than a destination. The score reflects context: the SMA 1000 sits at the edge by design, terminates VPN sessions, and holds a trusted view of the internal network behind it. Any flaw that lets an outsider borrow the appliance's own network identity is effectively a flaw that lets them originate traffic from inside the perimeter. This is the same structural reason edge devices dominate the exploited-in-the-wild statistics year after year.

Volexity attributed pre-disclosure exploitation beginning June 22, 2026, to a cluster it tracks as UTA0533. The toolkit is quiet and modern: a Python loader named KNUCKLEBALL, the open-source HTTP proxy Suo5 for tunnelling, and a Behinder-style custom Java web shell dubbed ORANGETAIL. None of it needs to touch a Windows endpoint, so EDR coverage on servers and laptops gives no early warning.

Stolen MFA seeds change the incident-response math

The detail that should worry IT security teams most is what the operators collected once they had root. Rapid7 observed theft of high-value credentials, the active session database, and — critically — the TOTP multi-factor authentication seed configuration.

Illustration of a zero-day vulnerability being used to siphon administrator credentials, VPN session tokens and TOTP multi-factor authentication seeds out of a compromised appliance database — *Illustration.* Credentials, active session records and TOTP seeds are the real payload. Encryption is increasingly the last step in a ransomware operation, not the objective — which is why patching alone does not close the incident.

A stolen TOTP seed is not a stolen code. It is the shared secret that generates every future code for that user, indefinitely. An organisation that patches the appliance, rotates passwords, and declares the incident closed has done roughly half the work: the attacker can still mint valid second factors and walk back in through the front door looking exactly like a legitimate employee. Seed re-enrolment for every affected user is the only clean remedy, and it is the step most likely to be skipped under time pressure.

Resecurity also documented an unusually aggressive pressure campaign. Victims reported inbound emails and phone calls from unknown parties offering to "assist" with the ransomware, ultimately steering negotiations to an address at helprans[.]com. Treat unsolicited recovery offers during an active incident as part of the extortion, not a way out of it.

Verified DNS Benchmark Pro screenshot showing DNS server performance results with average network latency and jitter across 31 public resolvers — Verified screenshot from the DNS Benchmark Pro engine. After a suspected edge-device compromise, re-measuring resolver behaviour from the affected network is a fast, no-install sanity check: unexpected latency shifts or a resolver answering that shouldn't be can indicate tampered DNS settings left behind by an intruder.

Why this cybersecurity news matters for your tech infrastructure

Three structural lessons sit underneath the headline, and all of them outlive this particular CVE pair.

The remediation clock is now shorter than most change-control processes. CISA added both CVEs to the Known Exploited Vulnerabilities catalog on July 14 — the same day they were published — with a federal remediation deadline of July 17. A three-day window is not an emergency exception any more; it is the emerging baseline for internet-facing appliances. Server infrastructure that cannot be patched inside 72 hours needs a compensating control in front of it.

Appliances are servers you cannot inspect. A hardened VPN appliance runs a full operating system, but you get a vendor console instead of a shell, and telemetry only where the vendor chose to expose it. When the appliance is the thing that is compromised, your forensic surface is whatever logs it happened to ship off-box beforehand. Centralised logging for edge devices is cheap insurance and is still routinely absent — and the same gap applies to cloud security posture, where hosted management planes are often monitored less closely than the workloads behind them.

Identity material is the real payload. Ransomware groups increasingly treat encryption as the last step, not the objective. Credentials, sessions and MFA seeds are what convert a single-appliance foothold into enterprise-wide lateral movement. That reframes the recovery question from "are we patched?" to "what secrets did this box hold, and have we rotated all of them?"

What system administrators should do this week

Patch immediately. Fixed builds are 12.4.3-03453 and later, or 12.5.0-02835 and later, covering SMA 1000 models 6210, 7210 and 8200v.
Assume compromise if the appliance was exposed before July 14. Exploitation ran as a zero-day from at least June 22.
Hunt on the proxy endpoint. Resecurity recommends identifying external source addresses that interacted with /wsproxy or supplied unusual parameters, then correlating those with internal authentication and lateral-movement activity.
Rotate everything the box could see — local admin credentials, service accounts, API keys, and every TOTP seed. Invalidate all active VPN sessions.
Verify integrity, not just version. Compare the appliance filesystem against vendor baselines and review the IoCs in the advisory before returning it to production.
Re-baseline outbound name resolution. Confirm that internal clients still resolve through the resolvers you intend them to. A lightweight network diagnostic tool that reports DNS server performance and network latency from the affected site will surface silently altered settings faster than a config audit will.

Network latency comparison chart from DNS Benchmark Pro ranking DNS over HTTPS response times for 31 public DNS resolvers including Quad9, Cloudflare and Google Public DNS — Full-field response-time comparison across 31 public resolvers, measured over DNS over HTTPS. Outliers like the red bar at the bottom illustrate why a single spot-check is unreliable — post-incident verification should compare the whole field, not one provider.

The edge is the perimeter now

SonicWall's SMA line has a long exploitation history — flaws from 2019, 2021, 2025 and now 2026 have all been weaponised in the wild, several by ransomware crews. That pattern is not unique to one vendor. Firewalls, SSL VPNs, SD-WAN orchestrators and secure-access gateways have become the highest-yield targets on the internet precisely because they are trusted, internet-facing, and slow to patch.

For network teams, the practical takeaway is that edge hardware deserves the same operational rigour as a domain controller: centralised logging, a documented emergency patch path measured in hours, tightly restricted management-plane exposure, and a rehearsed assumption that the device itself can be the intruder. The organisations that came through this campaign least damaged were not the ones with the best perimeter — they were the ones that could answer, quickly, what their perimeter device knew.

Curious how your own resolver stack is behaving right now? Run the free browser-based DNS speed test — no install, no account — or read how the benchmark measures DNS over HTTPS latency and jitter to understand what the numbers mean.

Sources

Published by Genext Information Systems · August 4, 2026. DNS Benchmark Pro is an independent tool and is not affiliated with SonicWall or any vendor named in this article. This report summarises publicly available vendor and researcher disclosures and is provided for informational purposes. Images marked Illustration are AI-generated conceptual artwork and do not depict real people, equipment or systems involved in this incident; benchmark screenshots are genuine captures from the DNS Benchmark Pro engine.