INC Ransomware Chains SonicWall Zero-Days for Full Network Access
Written by AI from the linked story. Not reviewed by an editor. How this works
INC ransomware exploited two chained SonicWall zero-day vulnerabilities to gain full access to victim environments across government and private sectors, demonstrating how unpatched network edge devices remain a primary ransomware entry point. The fact that 10 of 17 SonicWall CVEs since late 2021 have been tied to ransomware campaigns reveals a deliberate, sustained targeting strategy against these devices. Zero-day exploitation leaves defenders with little reaction time, making proactive network segmentation and compensating controls critical when patches are unavailable. Organizations relying on perimeter appliances without defense-in-depth strategies are especially exposed when a single device is compromised.
Tactical Insight
Immediate actions
- Apply SonicWall patches for CVE-2026-15409 and CVE-2026-15410 immediately, or isolate affected devices until patching is complete.
- Audit all internet-facing SonicWall appliances and restrict management interfaces to trusted IP ranges only.
- Review firewall and VPN logs for indicators of compromise associated with INC ransomware TTPs.
Long-term improvements
- Establish an emergency patching SLA (e.g., within 24–48 hours) specifically for critical internet-facing infrastructure vulnerabilities.
- Maintain a continuously updated inventory of all network appliances, firmware versions, and end-of-life status.
- Implement network segmentation so that a compromised perimeter device cannot provide direct lateral movement to sensitive internal systems.
Detection measures
- Deploy NDR or IDS rules tuned to detect exploitation patterns and anomalous traffic from edge devices.
- Enable centralized logging for all perimeter appliances and configure alerts for authentication anomalies or configuration changes.
- Subscribe to vendor security advisories (e.g., SonicWall PSIRT) and threat intelligence feeds to receive early warning of active exploitation.