Zero-Day on SonicWall SMA 1000: INC Ransomware Exploits Flaws Since June, Now Using Phone Calls

The Exploited Vulnerabilities: CVE-2026-15409 and CVE-2026-15410

SonicWall Secure Mobile Access (SMA) 1000 appliances have been in the crosshairs of INC Ransomware for at least two months.
Malicious activity began in June 2026, well before the vendor published an advisory and official patches.
The two vulnerabilities exploited, CVE-2026-15409 and CVE-2026-15410, allow initial unauthorized access with elevated privileges.

The first enables privilege escalation to administrative control; the second allows theft of credentials and hijacking of active VPN sessions.
Both have been added to the CISA Known Exploited Vulnerabilities catalog, confirming active exploitation in real-world campaigns.
Organizations that have not yet applied the fixes face critical risk: direct access to internal networks, data theft, and subsequent ransomware deployment.

Multi-Channel Modus Operandi: Email, Phone Calls, and a Fake “Andrew”

INC Ransomware does not stop at encrypting data. After intrusion, the group escalates pressure with multi-channel extortion tactics.
On June 2, 2026, the domain helprans[.]com was registered through a Chinese registrar that accepts cryptocurrency payments.
From that point, an individual presenting as “Andrew” began contacting victims directly.

The number used is +1 (304) 384-0401, a US phone number with a West Virginia area code.
In communications, the operator provides the address info@helprans[.]com to start ransom negotiations.
The calls come after compromise, often while the IT team is still trying to contain the incident, aiming to force a quick decision under stress.
The combined use of email and voice calls represents an evolution beyond text-only ransom notes.

Global Impact and At-Risk Sectors

The attack wave has hit organizations in multiple countries: the United States, Australia, United Arab Emirates, Colombia, and Switzerland are among those already documented.
SMA 1000 appliances are widely deployed in enterprise and government environments for secure remote access, making every unpatched instance a prime entry point for an attacker.

Once administrative credentials are obtained, the group can move laterally, exfiltrate sensitive data, and prepare the ground for encryption.
The severity rating is critical precisely because access is total and silent, with logs often showing no obvious anomalies without in-depth analysis.

How to Defend: Patching, Threat Hunting, and Extortion Preparedness

The first action remains immediate application of the patches released by SonicWall for SMA 1000.
But patching alone is not enough: anyone whose appliance was exposed in recent months must verify whether the environment has already been compromised.

Threat hunting for post-exploitation activities and analysis of authentication logs are essential, looking for anomalous administrative access or credential theft.
All privileged passwords must be rotated and suspicious VPN sessions invalidated.

On the organizational front, incident response teams must prepare to receive phone calls or emails from self-styled “negotiators”.
In such cases, it is advisable not to initiate private negotiations and to involve law enforcement immediately, providing every collected element: calling number, domain, email addresses, and contact times.