The patch arrived on July 14. The attackers had been inside since June 22.
That 22-day gap is the core of the INC ransomware SonicWall SMA 1000 campaign. Resecurity published its primary analysis this week documenting how a cluster tracked as UTA0533 exploited two SonicWall vulnerabilities as zero-days, pivoted to credential extraction, and then handed off access to INC for ransomware deployment. The story most organizations are missing: patching the VPN appliance does not undo what the attackers already took.
The vulnerability pair
CVE-2026-15409 carries a CVSS score of 10. The flaw allows an unauthenticated remote attacker to open a WebSocket tunnel to restricted internal services on the SMA 1000 appliance. CVE-2026-15410 (CVSS 7.2) chains to this, enabling privilege escalation from that tunnel connection to root. Together they give an unauthenticated internet attacker root access to the SMA appliance with no user interaction required. SonicWall released patches in mid-July; UTA0533 began exploitation on June 22.
From root to MFA seeds
Once UTA0533 had root access to the SMA appliance, they extracted the active session database and the TOTP MFA seed configurations. The TOTP seed is the shared secret that your authenticator app and the server both use to calculate one-time codes. On SonicWall SMA 1000 appliances, these seeds are stored in a database that a root-level attacker can read. Resecurity's report confirms that UTA0533 performed this extraction across multiple compromised appliances before handing access to INC ransomware for the final encryption payload.
Why this is worse than a stolen password
When an attacker steals a password, you change the password and the attacker loses access. TOTP seeds are different. A seed is a permanent shared secret. It cannot be "changed" in place. If an attacker has your TOTP seed, they can generate valid one-time codes for that account indefinitely, including after you patch the VPN appliance and change every password in the environment. The only remediation is to delete every TOTP enrollment and re-provision every user with a new seed on a clean authenticator device. This is not a trivial operation in enterprise environments, but it is the only path to confirmed remediation.
Scale of the campaign
As of August 2, 2026, INC has claimed 885 victims on its data leak site. The victims listed between July 17 and August 1, the period after public disclosure, include government and private sector organizations in Australia, the US, the UAE, Colombia, and Switzerland. The acceleration since August 1 is consistent with INC incorporating the published exploit chain into its standard playbook after SonicWall patched and public PoC code became available.
What to do now
If your organization runs SonicWall SMA 1000 appliances and did not patch before July 14, treat the appliance as fully compromised. Patch immediately if you have not. Separately, audit all TOTP MFA enrollments tied to accounts that authenticated through the appliance in the June 22 to July 14 window. Delete those enrollments and re-provision every affected user with a new seed. Do not assume that patching the VPN and resetting passwords is sufficient remediation when MFA seeds may already be extracted.
Gigia Tsiklauri is a Security Architect and founder of Infosec.ge. Get in touch if your organization is working through SonicWall SMA remediation and needs a second opinion on scope.