INC Ransomware Launches SonicWall SMA1000 Exploit Campaign

INC ransomware is exploiting SonicWall SMA1000 vulnerabilities (wsproxy bypass, path traversal) with custom tools KNUCKLEBALL and ORANGETAIL. 885 victims, Q1 2026 ranking. Defenders must patch SMA 1000 and hunt for specific IoCs. Social engineering pressure tactics used.