INC Ransomware Emerges as Dominant Threat Actor Exploiting SonicWall SMA 1000 Flaws

INC Ransomware is actively exploiting recently disclosed SonicWall SMA 1000 VPN vulnerabilities in a rapidly accelerating, high-volume campaign; the group uses automated, zero-interaction exploitation to gain perimeter access, establish persistence, exfiltrate data (double extortion), and deploy ransomware across enterprise networks—putting healthcare, government, education, and manufacturing at elevated risk while urging immediate patching, credential rotation, log audits, isolation of exposed appliances, and incident response activation.