[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fuA4x5IdXWkozi0mgQvlXi-bGTIC5uV3el_Md-USxmjo":3},{"article":4,"iocs":50,"watch_terms":61,"solutions":62,"lesson":161},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":29,"category":30,"article_tags":34},"538a53f9-df85-4796-a011-9937b07b9777","Prolific ransomware group behind SonicWall zero-day attacks","prolific-ransomware-group-behind-sonicwall-zero-day-attacks-6a1a58","INC ransomware wasn’t the first group to exploit the zero-days, but it’s been the most assertive and effective in chaining both vulnerabilities to steal and encrypt data for extortion. The post Prolific ransomware group behind SonicWall zero-day attacks appeared first on CyberScoop.","INC ransomware, a prolific RaaS operation, has emerged as the primary threat actor exploiting a pair of SonicWall zero-days (CVE-2026-15409 and CVE-2026-15410) disclosed in July, effectively chaining both vulnerabilities for full access and extortion. The group has claimed multiple new victims globally across government and private sectors. This follows a pattern of ransomware groups specifically targeting SonicWall products, with 10 of 17 SonicWall CVEs since late 2021 attributed to ransomware campaigns.","INC ransomware group actively exploits SonicWall zero-days for data theft and encryption","https:\u002F\u002Fcyberscoop.com\u002Finc-ransomware-sonicwall-zero-day-attacks\u002F","https:\u002F\u002Fcyberscoop.com\u002Fwp-content\u002Fuploads\u002Fsites\u002F3\u002F2026\u002F03\u002FGettyImages-2152310845.jpg","2026-08-04T15:20:06+00:00","2026-08-04T16:00:14.318123+00:00",9,[17,20,23,25,27],{"name":18,"type":19},"INC ransomware","threat_actor",{"name":21,"type":22},"SonicWall","vendor",{"name":24,"type":22},"Rapid7",{"name":26,"type":22},"Huntress",{"name":28,"type":22},"CISA","7d8b5ab8-ea0b-4ced-ae97-ec251b86993a",{"id":29,"icon":31,"name":32,"slug":33},null,"Ransomware","ransomware",[35,40,45],{"category":36},{"id":37,"icon":31,"name":38,"slug":39},"574f766a-fb3f-487c-8d2c-0720ae75471b","Zero-day","zero-day",{"category":41},{"id":42,"icon":31,"name":43,"slug":44},"80544778-fabb-4dcd-aa35-17492e5dcf4f","Vulnerabilities","vulnerabilities",{"category":46},{"id":47,"icon":31,"name":48,"slug":49},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[51,55,58],{"type":52,"value":53,"context":54},"cve","CVE-2026-15409","SonicWall zero-day vulnerability exploited by INC ransomware for initial access",{"type":52,"value":56,"context":57},"CVE-2026-15410","SonicWall zero-day vulnerability chained with CVE-2026-15409 by INC ransomware",{"type":59,"value":18,"context":60},"malware","RaaS operation exploiting SonicWall vulnerabilities; ~900 victims across 71 countries since discovery 3 years ago",[21,24,26],{"controls":63,"vendors":148},[64,92,120],{"slug":65,"name":66,"problem":67,"products":68},"vulnerability-management","Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",[69,77,85],{"vendor_slug":70,"vendor_name":71,"vendor_logo":72,"product_slug":73,"product_name":74,"url":75,"description":76},"holm-security","Holm Security","\u002Fvendor-logos\u002Fholm-security.png","holm-security-platform","Holm Security Platform","https:\u002F\u002Fwww.holmsecurity.com\u002F","Vulnerability scanning of systems, web applications, cloud and the external attack surface, plus phishing simulation.",{"vendor_slug":78,"vendor_name":79,"vendor_logo":80,"product_slug":81,"product_name":82,"url":83,"description":84},"tenable","Tenable","\u002Fvendor-logos\u002Ftenable.png","tenable-vulnerability-management","Tenable Vulnerability Management","https:\u002F\u002Fwww.tenable.com\u002Fproducts\u002Fvulnerability-management","Cloud-based vulnerability scanning and prioritisation, built on Nessus.",{"vendor_slug":86,"vendor_name":24,"vendor_logo":87,"product_slug":88,"product_name":89,"url":90,"description":91},"rapid7","\u002Fvendor-logos\u002Frapid7.png","insightvm","Rapid7 Exposure Command (InsightVM)","https:\u002F\u002Fwww.rapid7.com\u002Fproducts\u002Finsightvm\u002F","Vulnerability scanning and risk-based prioritisation; InsightVM is now part of Exposure Command, alongside attack surface and cloud risk.",{"slug":93,"name":94,"problem":95,"products":96},"patch-management","Automated patch management","Known holes get closed in days, not months.",[97,104,112],{"vendor_slug":98,"vendor_name":99,"vendor_logo":100,"product_slug":93,"product_name":101,"url":102,"description":103},"qualys","Qualys","\u002Fvendor-logos\u002Fqualys.png","Qualys Patch Management","https:\u002F\u002Fwww.qualys.com\u002Fapps\u002Fpatch-management\u002F","Patch deployment for operating systems and third-party applications, linked to vulnerability findings.",{"vendor_slug":105,"vendor_name":106,"vendor_logo":107,"product_slug":108,"product_name":109,"url":110,"description":111},"manageengine","ManageEngine","\u002Fvendor-logos\u002Fmanageengine.png","patch-manager-plus","ManageEngine Patch Manager Plus","https:\u002F\u002Fwww.manageengine.com\u002Fpatch-management\u002F","Patch management for operating systems and third-party applications, on premises or in the cloud.",{"vendor_slug":113,"vendor_name":114,"vendor_logo":115,"product_slug":116,"product_name":117,"url":118,"description":119},"ninjaone","NinjaOne","\u002Fvendor-logos\u002Fninjaone.png","ninjaone-patch-management","NinjaOne Patch Management","https:\u002F\u002Fwww.ninjaone.com\u002Fpatch-management\u002F","Automated patching of operating systems and third-party applications from the cloud.",{"slug":49,"name":121,"problem":122,"products":123},"Threat intelligence","Attack campaigns reach your sector, suppliers or software before your team hears about them.",[124,132,140],{"vendor_slug":125,"vendor_name":126,"vendor_logo":127,"product_slug":128,"product_name":129,"url":130,"description":131},"google","Google","\u002Fvendor-logos\u002Fgoogle.png","google-threat-intelligence","Google Threat Intelligence","https:\u002F\u002Fcloud.google.com\u002Fsecurity\u002Fproducts\u002Fthreat-intelligence","Threat intelligence from Mandiant's frontline investigations, Google's threat analysts, open sources and Google's own visibility, in one service.",{"vendor_slug":133,"vendor_name":134,"vendor_logo":135,"product_slug":136,"product_name":137,"url":138,"description":139},"recorded-future","Recorded Future","\u002Fvendor-logos\u002Frecorded-future.png","recorded-future-cyber-operations","Recorded Future Cyber Operations","https:\u002F\u002Fwww.recordedfuture.com\u002Fproducts\u002Fcyber-operations","Threat intelligence built into security operations workflows, to prioritise alerts and act on threats before they arrive.",{"vendor_slug":141,"vendor_name":142,"vendor_logo":143,"product_slug":144,"product_name":145,"url":146,"description":147},"dataminr","Dataminr","\u002Fvendor-logos\u002Fdataminr.png","agentic-threat-intelligence-platform","Agentic Threat Intelligence Platform","https:\u002F\u002Fwww.dataminr.com\u002Fproducts\u002Fcyber-defense\u002Fagentic-threat-intelligence-platform\u002F","Threat intelligence platform, formerly ThreatConnect TI Ops, that collects, scores and structures intelligence and pushes it into security tools.",[149,154,156],{"slug":150,"name":26,"logo_path":151,"roles":152},"huntress","\u002Fvendor-logos\u002Fhuntress.png",[153],"reported_by",{"slug":86,"name":24,"logo_path":87,"roles":155},[153],{"slug":157,"name":21,"logo_path":158,"roles":159},"sonicwall","\u002Fvendor-logos\u002Fsonicwall.png",[160],"affected",{"slug":162,"title":163,"body":164,"framework_refs":165,"framework_notes":175},"inc-ransomware-chains-sonicwall-zero-days-for-full-network-access","INC Ransomware Chains SonicWall Zero-Days for Full Network Access","INC ransomware exploited two chained SonicWall zero-day vulnerabilities to gain full access to victim environments across government and private sectors, demonstrating how unpatched network edge devices remain a primary ransomware entry point. The fact that 10 of 17 SonicWall CVEs since late 2021 have been tied to ransomware campaigns reveals a deliberate, sustained targeting strategy against these devices. Zero-day exploitation leaves defenders with little reaction time, making proactive network segmentation and compensating controls critical when patches are unavailable. Organizations relying on perimeter appliances without defense-in-depth strategies are especially exposed when a single device is compromised.",[166,167,168,169,170,171,172,173,174],"CIS Control 7: Continuous Vulnerability Management","CIS Control 12: Network Infrastructure Management","CIS Control 13: Network Monitoring and Defense","NIST SP 800-40: Guide to Enterprise Patch Management","NIST CSF RS.MI-3: Newly identified vulnerabilities are mitigated","NIST SP 800-41: Guidelines on Firewalls and Firewall Policy","NIST SP 800-171 3.13.1: Network Segmentation","ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities","ITIL: Change Management \u002F Emergency Change procedures",{}]