Prolific ransomware group behind SonicWall zero-day attacks

INC ransomware exploited two chained SonicWall zero-day vulnerabilities to gain full access to victim environments across government and private sectors, demonstrating how unpatched network edge devices remain a primary ransomware entry point. The fact that 10 of 17 SonicWall CVEs since late 2021 have been tied to ransomware campaigns reveals a deliberate, sustained targeting strategy against these devices. Zero-day exploitation leaves defenders with little reaction time, making proactive network segmentation and compensating controls critical when patches are unavailable. Organizations relying on perimeter appliances without defense-in-depth strategies are especially exposed when a single device is compromised.