Prolific ransomware group behind SonicWall zero-day attacks

Researchers report INC ransomware as the primary actor actively weaponizing two recently disclosed SonicWall zero-days (CVE-2026-15409 and CVE-2026-15410), chaining them to gain full access and deploy ransomware; Rapid7 observed prevention in many cases but confirmed at least one deployment, and INC’s leak site lists multiple alleged victims across several countries.