INC ransomware is stealing the identity layer, not just the perimeter

Two vulnerabilities in SonicWall Secure Mobile Access 1000 series appliances have become one of the more consequential access problems of the summer. According to public reporting from SecurityWeek, The Hacker News, and threat research published by Resecurity, CVE-2026-15409 (CVSS 10.0) is a pre-authentication WebSocket proxy bypass reachable through the appliance’s /wsproxy endpoint, and CVE-2026-15410 (CVSS 7.2) is a path traversal in the hotfix-removal workflow. Chained, they take an unauthenticated attacker on the internet to root on the appliance. SonicWall published fixes on July 14, 2026, and CISA added both to its Known Exploited Vulnerabilities catalog in July. Public reporting indicates exploitation was already underway by June 22, roughly three weeks before the patch existed. The vulnerabilities are the part every advisory covers. What the operators did once they had root is the part that should change how you think about NAS security for the file estate sitting behind that VPN.

INC ransomware has since become the most visible operator working this chain. Resecurity reports that the group accelerated in early August, publishing multiple new victims on its data leak site between July 17 and August 1, spanning private-sector and government organizations in Australia, the United States, the United Arab Emirates, Colombia, Switzerland, and elsewhere. The Hacker News reports the group claims 885 victims to date, a leak-site figure worth treating as a claim rather than a count. Some victims were reportedly contacted by phone and email by parties offering to help with the ransomware situation, a pressure tactic dressed as assistance.

The edge device is the headline, but it is not the payload. According to the published research, once at root the operators ran tcpdump against unencrypted LDAP traffic on TCP/389 and read usernames and passwords straight off the wire. They extracted active session databases and time-based one-time password seed configurations. They installed persistence that survives reboot, including setuid binaries and modified service configuration, and deployed a small toolkit for tunneling traffic deeper into the network.

Read that inventory again. The attackers did not break authentication. They took possession of it. A harvested LDAP password is a real password. A copied session database is a real session. A TOTP seed lets you generate the same six digits the legitimate user’s phone shows. Every access that follows is authentic by every measure an identity provider has. This is not a case where multi-factor authentication was bypassed; it is a case where the second factor itself was stolen and can be reproduced on demand.

This is the practical limit of a Zero Trust posture that verifies hard at login and then stops verifying. Once the credential and the session are real, the gate opens. What does not become real is the behavior. An account belonging to a controls engineer who touches a few dozen CAD files a week does not suddenly enumerate and read a decade of drawings in an afternoon. A finance service account does not walk an entire records share. Those are the operations that follow this kind of access, and they happen over SMB, NFS, S3, and Web Drive against production file systems.

It is worth being precise about why the rest of the stack stays quiet here, because none of these tools is failing at the job it was built for. Endpoint detection watches processes on managed hosts, and this attacker arrives as an authenticated remote session rather than a process on a laptop. Network monitoring sees expected protocols carrying expected traffic from an appliance whose entire purpose is to carry exactly that. Identity providers and MFA gateways evaluate a credential that is genuine and a second factor the attacker can now generate. SIEM with user behavior analytics comes closest and is genuinely good once the events arrive, but it reasons over forwarded telemetry after aggregation, which makes it strong for the investigation and late for the interruption. Every one of them sits upstream of the operation that matters.

Attribute-based access control narrows the blast radius before the read happens, by evaluating user, host, application, and data attributes on every operation rather than trusting a group membership assigned years ago. A stolen credential is then confined to what that identity legitimately needs, at the file, per operation. That will not stop everything. It substantially reduces what one compromised session can reach, which is the difference between an incident and a disclosure event.

Behavioral detection in the data path closes the rest. Active Defense profiles normal access per user, host, and dataset and evaluates each file operation inline, so a session that departs from its own pattern of reads can be terminated while the staging is still in progress. That inline position matters here specifically: the attacker has already defeated the perimeter and the identity layer, so the storage layer is the last place where the anomaly is still observable.

Patch the appliances. That advice is correct and it is not sufficient, because the credential material harvested before the patch does not expire when the firmware updates. Password resets, session invalidation, and TOTP seed reissuance are the actual remediation, and they only work if you can scope who was exposed. That scoping question is answered by audit, and it has to be an audit the attacker could not edit.

An immutable, per-operation record of who read which file, from which host, at which second, is what turns "an appliance was compromised in June" into a specific list of what a specific session touched. Without it, the only defensible position is that everything reachable must be assumed read, and the reset list and the notification obligation both grow to match. Backups do not answer this question either. They restore what was there; they do not record what left.

That is the part of this campaign worth carrying into the next one. A firmware update closes the door. It does not take back the keys that walked out before it, and it does not tell you which doors they opened. Both of those jobs belong to the data path, and they have to already be running when the advisory lands.