INC Ransomware is Calling Victims – Pressure Tactics Post SonicWall Zero-Day Exploit

INC Ransomware is actively exploiting SonicWall SMA 1000 vulnerabilities (CVE-2026-15409, CVE-2026-15410) to gain initial access and deploy ransomware across organizations in multiple countries; operators are using phone calls and emails (domain HELPRANS.COM and phone +1 (304) 384-0401) as pressure tactics during extortion. Resecurity observed exploitation beginning in June 2026 and recommends immediate patching, credential rotation, threat hunting, and contacting law enforcement.