01
CriticalSonicWall SMA1000INC Ransomware
INC Ransomware is the dominant actor using the SonicWall SMA1000 zero-day chain to steal MFA seeds and session tokens before deploying ransomware
The chain was exploited for 22 days before SonicWall even knew about it. Attackers do not just use the foothold for ransomware — they extract the MFA seed database first, giving them the ability to generate valid one-time codes for every VPN user going forward. Patching closes the entry. It does not invalidate those seeds.
CVEsCVE-2026-15409
CVSS 10.0
CVE-2026-15410
CVSS 7.2
CVSS 10.0
CVE-2026-15410
CVSS 7.2
Exploited sinceJune 22, 2026
(zero-day)
(zero-day)
PatchedJuly 14, 2026
Active actorINC Ransomware
885 victims to date
885 victims to date
AffectsSMA1000 6210
7210, 8200v
7210, 8200v
What happened
Resecurity published a report on August 3 identifying INC Ransomware as the dominant threat actor exploiting CVE-2026-15409 and CVE-2026-15410 in SonicWall SMA1000 series appliances. INC Ransomware has claimed 885 victims across its operational history and added multiple new victims to its data leak site in the first days of August. The vulnerability pair was discovered by Rapid7's Managed Detection and Response team, which observed active zero-day exploitation beginning June 22, 2026, 22 days before SonicWall published its advisory and patch on July 14. CVE-2026-15409, rated CVSS 10.0, is a pre-authentication server-side request forgery in the SMA1000 WorkPlace WebSocket proxy that allows an unauthenticated remote attacker to open a tunnel to arbitrary internal services on the appliance. CVE-2026-15410, rated CVSS 7.2, is a path traversal and code injection flaw that allows an attacker with access to an internal localhost service to execute arbitrary commands as root through the appliance's hotfix management workflow. Chained together, the two vulnerabilities provide unauthenticated root-level remote code execution on internet-facing VPN gateways used by enterprises, government agencies, and managed security providers. Rapid7 documented that the attacks went significantly beyond initial access: attackers extracted high-value credentials stored on the appliance, active VPN session databases, and crucially, Time-Based One-Time Password MFA seed configurations. TOTP seeds are the shared secrets from which every future one-time code for enrolled users can be generated. An attacker in possession of those seeds can produce valid MFA codes for every enrolled VPN user indefinitely, independently of the appliance. CISA added both CVEs to its Known Exploited Vulnerabilities catalog on July 14 with a 72-hour patch deadline for federal agencies. Volexity separately attributed early zero-day exploitation to a previously untracked cluster designated UTA0533 that installed custom malware on compromised appliances before INC Ransomware became the dominant follow-on actor.
Why it matters
MFA seed theft is the critical detail in this attack chain and the one most likely to be missed in standard remediation. Patching CVE-2026-15409 and CVE-2026-15410 closes the remote code execution path through which the seeds were stolen. It does not invalidate the seeds themselves. An organization that patches and considers the incident closed has closed the door through which the attacker entered, but the attacker now holds the ability to generate valid MFA codes for every VPN user indefinitely. That capability persists until the TOTP seeds are rotated and every enrolled user re-registers their authenticator application.
Don't miss
SonicWall SMA1000 appliances are the third VPN or secure access gateway product to drive a major ransomware campaign this year following Ivanti Connect Secure and Palo Alto PAN-OS in earlier months. The pattern is structural: internet-facing gateways that aggregate credentials, session data, and access controls are the highest-value initial access targets available to ransomware operators because a single compromise provides the foothold and the lateral movement path simultaneously. The 22-day zero-day window before disclosure is also consistent with the broader trend this brief has tracked all year: exploitation begins substantially before the patch exists. Organizations with SMA1000 appliances should treat any device that was internet-accessible between June 22 and the patch date as potentially compromised and initiate forensic review accordingly.
Potential actions
- Apply the July 14 SonicWall patches immediately if not already done. Fixed versions are firmware 12.4.3-03453 or later on the 12.4 branch and 12.5.0-02835 or later on the 12.5 branch. Any SMA1000 6210, 7210, or 8200v still on an earlier version should be treated as actively compromised and patched or taken offline today.
- Rotate all TOTP MFA seeds for VPN users enrolled through the compromised SMA1000 appliances. Patching does not invalidate stolen seeds. Every user whose seed was stored on the appliance during the June 22 to July 14 window should re-register their authenticator application against a freshly generated seed.
- Review SonicWall's published indicators of compromise against appliance logs covering June 22 onward. If UTA0533 custom malware artifacts or INC Ransomware staging activity are found, treat the investigation as a full incident response, not a patch-and-close exercise. Rotate VPN credentials and session tokens and hunt for lateral movement that originated from the appliance after June 22.
The Sip
They took the MFA seeds. Patch the appliance and the door closes. The seeds still work. Every future one-time code for every enrolled user can still be generated by whoever extracted that database. Patch first. Then rotate every seed. Then check the logs from June 22 forward.