INC ransomware has surged to the forefront of cyber threats this summer. The group now stands as the dominant actor exploiting a pair of critical flaws in SonicWall’s Secure Mobile Access appliances. But its story runs deeper than one exploit chain. From modest beginnings in 2023, the operation has claimed more than 885 victims. It has done so by sticking to fundamentals while capitalizing on rivals’ misfortunes.
The latest acceleration began in early August 2026. The Hacker News reported that INC listed multiple new victims on its data-leak site between July 17 and August 1. These targets spanned private companies and government entities across Australia, the U.S., the U.A.E., Colombia, Switzerland and beyond. Ransomware.Live statistics confirm the group’s total at 885 as of August 2. That figure reflects steady growth from the more than 800 victims tallied earlier this year.
Resecurity detailed the technical path in a weekend report. Attackers chain CVE-2026-15409, a pre-authentication bypass in the /wsproxy endpoint, with CVE-2026-15410, a path-traversal flaw in the remove_hotfix function. The combination grants root access on vulnerable SMA 1000 series devices. SonicWall issued fixes in mid-July. Yet many organizations lagged in deployment. Rapid7 had already flagged the activity as zero-day exploitation weeks earlier.
“This strong technical correlation indicates that a single threat actor or coordinated group is responsible for discovering and exploiting this zero-day vulnerability,” said Douglas McKee, director of vulnerability intelligence at Rapid7. “More recently, INC Ransomware has emerged as the dominant threat actor actively weaponizing this vulnerability chain.”
Once inside, operators deploy custom tooling. A Python script called KNUCKLEBALL launches an open-source HTTP proxy named Suo5 and a Behinder-like Java web shell dubbed ORANGETAIL. They extract credentials, active session data and TOTP MFA seeds. The goal is clear. Establish persistent access. Move laterally. Exfiltrate sensitive files. Then encrypt what remains. The group augments technical gains with old-school pressure. Victims report calls from a man identifying as “Andrew” at +1 (304) 384-0401. He claims the network belongs to a hacker collective and directs negotiations to info@helprans.com. Such tactics amplify the sense of inevitability.
INC did not invent these methods. It simply executes them with consistency. Dark Reading noted the group’s preference for sectors where downtime or data exposure creates acute pressure. Healthcare organizations top the list. Manufacturing, legal services, technology, construction and education follow. In the first quarter of 2026 alone, INC recorded 124 incidents. That placed it fourth globally behind Qilin with 338, Akira with 197 and The Gentlemen with 192. It edged out Clop.
Adam Darrah, vice president of intelligence at ZeroFox, observed the pattern. “INC’s trajectory, however, has been uneven — the contraction in late 2025 followed by a Q1 2026 surge probably reflects affiliate churn and re-consolidation rather than sustained organic growth,” he said. “And although INC doesn’t have that same technical profile on paper as let’s say Qilin, its Q1 2026 numbers suggest it’s attracting affiliate volume at a competitive rate regardless.”
The RaaS model underpins this scalability. INC emerged in mid-2023 as a semi-private operation. It sold its source code in 2024 for around $300,000 to a handful of buyers. Variants such as Lynx and Sinobi soon appeared with noticeable code overlap. Affiliates gained access to Rust-compiled encryptors for Windows, Linux and ESXi environments. These payloads use Curve25519 for key exchange and AES-128 for file encryption. They avoid system directories, print ransom notes to network printers and operate a dual-extortion system of private negotiation portals and public leak sites.
Acronis researchers traced the ascent. “INC has evolved from an emerging ransomware-as-a-service operation into one of the most active ransomware groups in 2026, claiming more than 800 victims since 2023,” their report stated. In the current year the group has added hundreds more. U.S. organizations represent over 65 percent of victims. Many sit in regulated industries where compliance deadlines and reputational risk force faster payments. Operators appear to avoid targets in the Commonwealth of Independent States, hinting at their possible geographic origin.
Earlier brushes with the group revealed operational sloppiness. In January 2026, BleepingComputer covered how a security lapse let researchers recover stolen data from a dozen American entities. Cyber Centaurs infiltrated INC infrastructure and reversed the damage. Such episodes have not slowed the outfit. If anything, they prompted tighter affiliate screening and renewed focus on proven entry vectors.
Initial access often starts with stolen credentials purchased from brokers or spear-phishing campaigns. When those fail, operators turn to unpatched remote services. Before SonicWall, they hit Citrix, Fortinet, SimpleHelp and other appliances. The playbook stays familiar. Ping sweeps, credential dumping via Base64-encoded scripts, lateral movement with tools such as LOBI, EDR evasion binaries and command-and-control frameworks favored by red teams. Nothing flashy. Everything functional.
Yet the volume adds up. Dragos tracked 52 industrial incidents tied to INC Ransom in the first quarter. Comparitech recorded the group among the top actors hitting government targets in the first half of the year, with six confirmed cases. Healthcare systems in Oceania felt the sting repeatedly. Australian and New Zealand clinics, along with a Tongan facility, suffered disruptions that cascaded into patient care delays.
The SonicWall campaign marks a refinement. Pre-patch exploitation dating to June 22 gave attackers a head start. Volexity attributed early activity to a cluster it calls UTA0533. Rapid7 and Resecurity both see strong overlap with INC’s later wave. The timing aligns with SonicWall’s July disclosure. Many administrators delayed upgrades. The result? A fresh pipeline of compromised perimeter devices feeding directly into ransomware operations.
Defenders face a compressed window. Patching remains the first imperative. But legacy appliances and complex supply chains complicate rollout. Resecurity urges immediate threat hunting for connections to /wsproxy with unusual parameters. Rotate credentials. Verify system integrity. Monitor for the specific user-agent strings and file artifacts left behind. KNUCKLEBALL, ORANGETAIL, ROOTRUN backdoors. These leave traces if teams know where to look.
Broader industry data paints an unrelenting picture. NordStellar found ransomware incidents rose 20 percent in the first half of 2026, reaching 5,275 attacks. Two rival RaaS programs drove much of the second-quarter spike to 2,581 incidents. Qilin and groups like INC have filled voids left by dismantled operations such as LockBit and BlackCat. Affiliate networks shift allegiance quickly. The barrier to entry stays low. The payout potential remains high.
INC proves that technical sophistication is not strictly required. Mastery of basics, timely exploitation of disclosed vulnerabilities and aggressive extortion combine into a potent formula. Its Rust payloads resist easy reverse engineering. Its leak site maintains pressure long after encryption completes. Its phone calls and follow-up emails turn technical breaches into personal confrontations.
Organizations cannot treat this as yesterday’s problem. The group has posted victims as recently as August 2. New claims continue to surface. Enterprises running SonicWall SMA 1000 gear must assume active targeting. Those in healthcare, manufacturing or legal services sit in the crosshairs by default. The question is not whether INC will strike again. It is which vector it will choose next and how quickly victims can respond.
Security teams that combine rapid patching with credential hygiene, network segmentation and behavioral monitoring stand the best chance. The rest risk joining the growing tally on INC’s leak portal. The ransomware economy shows no signs of contraction. Groups that adapt fastest to new opportunities, however modest the innovation, reap the largest rewards. For now, INC has positioned itself at the head of that pack.