INC Ransomware chains two SonicWall SMA 1000 zero-days in attacks

The INC Ransomware group is the most active threat group exploiting two SonicWall Mobile Access (SMA) 1000 vulnerabilities, with multiple new victims being posted on the INC data leak site.

In an Aug. 1 blog post by Resecurity, this finding was preceded by active, pre-disclosure exploitation observed by researchers at Volexity that started on June 22.

Volexity tracked the threat actor as UTA0533 and said the group chained both vulnerabilities to obtain root-level access to the targeted SonicWall SMA 1000 appliances.

The Resecurity report said subsequent analysis by Rapid7 identified significant tactics techniques, and procedure (TTP) overlap from what Volexity observed, and that INC Ransomware has since emerged as the dominant actor actively weaponizing the full chain.  

The Cybersecurity and Infrastructure Security Agency (CISA) added the two SonicWall SMA 1000 CVEs to its Known Exploited Vulnerabilities (KEV) catalog July 14, with a remediation due date of three days later.

According to Resecurity, the two chained zero-days were as follows:

Jeremiah Fowler, a cybersecurity researcher at Black Hills Information Security, said the recent SonicWall case highlights a disturbing shift in how ransomware groups operate: they have gone from compromising individual endpoints to targeting the network infrastructure and the overall enterprise edge.

Fowler said ransomware actors like INC aim to gain access deep inside corporate networks, including high-value targets such as VPN appliances, firewalls, and remote access gateways. Once these systems are compromised, Fowler said cybercriminals can attempt to avoid detection, disable security monitoring services, steal sensitive data, and target additional infrastructure assets before deploying ransomware.

“For SOC teams the priority is no longer simply preventing ransomware encryption — it’s detecting unauthorized activity during the narrow window between initial compromise and before the ransomware kill chain can be completed,” said Fowler. “With the evolving tactics and targets ransomware groups use, it’s safe to assume that all internet-facing infrastructure is at risk of being actively targeted.”

Fowler added that SOC teams should make it a priority to identify and contain compromises, apply patches, and monitor unauthorized access, credential abuse, lateral movement, and attempts to disable security tools. He said it’s also a good idea to isolate critical infrastructure and backups. 

Jacob Krell, senior director of secure AI Solutions and cybersecurity at Suzu Labs, added that INC exploited two SonicWall SMA 1000 vulnerabilities as zero-days starting June 22, over three weeks before SonicWall shipped patches on July 14. Krell said the chain lets an unauthenticated attacker open a WebSocket tunnel to internal services that should only accept local connections, then abuse the appliance's hotfix-removal process to escalate to root.

“Resecurity's report confirms INC as the dominant group running the full chain, with new victims from the U.S., Australia, UAE, Colombia, and Switzerland appearing on their leak site through early August,” said Krell.

Krell added that if teams have internet-facing SMA 1000 appliances, assume compromise, investigate, and re-image from clean firmware.

“The attackers stole session databases and the time-based one-time password (TOTP) seeds that generate one-time codes,” said Krell. “Password resets don't evict them. Any user who authenticated through a compromised appliance needs full MFA re-enrollment from scratch.”