INC Ransomware Emerges as Dominant Actor Exploiting SonicWall SMA 1000 Flaws

The INC Ransomware operation has emerged as the "dominant threat actor" exploiting the recently disclosed security flaws in SonicWall Secure Mobile Access (SMA) 1000 series VPN appliances. In a report published over the weekend, Resecurity said it observed the INC Ransomware accelerating its activity since the beginning of August 2026, listing multiple victims on its data leak site. Per

According to multiple reports, the INC Ransomware operation is aggressively exploiting two SonicWall SMA 1000-series zero-day vulnerabilities (CVE-2026-15409 and CVE-2026-15410) to gain unauthenticated, root-level access to remote access gateways and deploy ransomware across enterprise networks.[2][5][9] The Hacker News article highlights that INC has become the dominant threat actor leveraging these flaws, with victims already appearing on its data leak site.[9][12] From a RealGround perspective, this demonstrates a critical AI supply chain and infrastructure risk: compromise of VPN/perimeter devices used to expose or protect AI agents and data pipelines can lead directly to credential theft, lateral movement, and downstream compromise of AI models, training data, and integrated SaaS services. Organizations should treat network-edge appliances as part of their AI supply chain, maintain an SBOM and rapid patching process for them, and ensure that access to AI systems and agents is never solely dependent on a single, potentially vulnerable remote access gateway.