Follow us on Bluesky, Twitter (X), Mastodon and Facebook at @Hackread

Follow us on Bluesky, Twitter (X), Mastodon and Facebook at @Hackread

Anne Arundel County's government services are disrupted by a ransomware attack, part of a growing wave of cyber threats impacting Maryland.

È stata individuata una nuova campagna di distribuzione del ransomware INC, che sta colpendo realtà operative in Italia.  Questo malware,Leggi di più

Huntress (blog.huntress.com), publié le 23 septembre 2026. L'analyse porte sur une attaque INC ransomware détectée fin août 2026 sur une organisation cliente, après l'installation de l'agent Huntress en réaction à un incident en cours.

SonicWall’s SMA 1000 series was hit by two actively exploited zero-days, CVE-2026-15409 and CVE-2026-15410, which let attackers chain a pre-auth /wsproxy bypass and a path-traversal flaw to gain root access on exposed VPN appliances. The abuse was attributed to UTA0533 and later linked to INC Ransomware, with observed malware including ROOTRUN, KNUCKLEBALL, Suo5, and ORANGETAIL. #SonicWall #SMA1000 #CVE-2026-15409 #CVE-2026-15410 #UTA0533 #INCRansomware #ROOTRUN #KNUCKLEBALL #Suo5 #ORANGETAIL

Malware family ROOTRUN, KNUCKLEBALL, Suo5, ORANGETAIL Threat actor UTA0533 (pre-disclosure cluster, suspected link to INC Ransomware); INC Ransomware confirmed as current dominant operator Target Internet-facing SonicWall SMA 1000 series VPN appliances Delivery vector Unauthenticated exploitation of CVE-2026-15409 and CVE-2026-15410 Key capabilities Root compromise, memory-resident web shell, credential harvesting, persistence Source Resecurity, with corroboration from Volexity and Rapid7 TL;DR: A SonicWall SMA exploit chain lets an unauthenticated attacker reach root on SMA 1000 VPN appliances.

  The ransomware operation known as INC has grown into one of the most active cybercrime groups of 2026, with security researchers linking it to more than 830 victims since it first appeared in August 2023. According to researchers at Acronis, the group's rise coincided with disruptions affecting major ransomware brands such as LockBit and BlackCat. As affiliates sought alternative platforms, INC appears to have benefited from that shift. More than 65% of the victims listed by the group are based in the United States, with legal firms, healthcare providers, manufacturers, construction companies, and technology organizations among the most frequently targeted sectors. Researchers also observed major changes to the ransomware itself. INC's malware for Windows and Linux/VMware ESXi systems has been rewritten in Rust, a programming language increasingly adopted by malware developers because it supports multiple operating systems and can complicate reverse-engineering efforts. The group's toolkit has expanded as well. Recent attacks have involved a credential-stealing utility capable of extracting authentication data from newer Veeam backup deployments that use salted DPAPI encryption. Access to backup infrastructure can give attackers valuable credentials while also making recovery efforts more difficult for victims. Acronis noted that the sale of INC's Windows and Linux ransomware variants on underground cybercrime forums in May 2024 contributed to the appearance of related ransomware families, including Lynx and Sinobi. Researchers identified significant code similarities between the groups. Investigators found that INC affiliates rely on several entry points to compromise networks, including spear-phishing campaigns, credentials purchased from Initial Access Brokers (IABs), and the exploitation of publicly exposed systems running vulnerable versions of Citrix NetScaler, Fortinet EMS, and SimpleHelp software. Once inside a network, attackers harvest credentials, move between systems using legitimate administrative tools such as RDP and PsExec, and attempt to weaken security controls through a technique known as Bring Your Own Vulnerable Driver (BYOVD). Researchers observed the use of vulnerable drivers including filwfp.sys, filnk.sys, and fildds.sys. The group also deploys tools such as Cobalt Strike, AnyDesk, ScreenConnect, and TeamViewer to maintain access and control compromised environments. Before encryption begins, stolen files are collected and transferred using Rclone, often after being packaged into password-protected archives. The ransomware then encrypts systems using multithreading and partial-encryption techniques to speed up the process. When launched against VMware ESXi environments, the malware can also attempt to shut down virtual machines. Data from ZeroFox ranked INC as the fourth most active ransomware operation during the first quarter of 2026, recording more than 120 incidents. Researchers said the group's growth demonstrates how ransomware operators can build large-scale campaigns using widely available tools, stolen credentials, and unpatched systems rather than relying on highly specialized malware.

The Inc ransomware group claims to have compromised multiple organizations, posting a list of alleged victims that includes Conveyors, Inc. and Greenology Products. The allegedly exposed files include I-9 employee verification forms, internal employee lists and HR budgets, purchase orders, billing and delivery records, corporate agreements and NDAs, and internal memos....

Microsoft warns that a financially motivated threat actor is using INC ransomware in attacks aimed at the healthcare sector in the U.S.

Inc ransomware — one of the most popular among cybercriminals today — meets healthcare, the industry sector most targeted by RaaS.

Microsoft has observed the threat actor Vanilla Tempest targeting US healthcare organizations with INC ransomware.

​Microsoft says a ransomware affiliate it tracks as Vanilla Tempest now targets U.S. healthcare organizations in INC ransomware attacks.