Your VPN Was the Front Door. The Attackers Had the Keys for Three Weeks.

On June 22, someone walked through your VPN. Not metaphorically. A threat group tracked by Volexity as UTA0533 began exploiting two zero-day vulnerabilities in SonicWall's SMA 1000 series appliances — the same remote access devices that tens of thousands of organizations use to let employees work from home, connect branch offices, and reach internal systems.

SonicWall didn't publish its advisory until July 14. That's twenty-two days. Three full weeks of attackers moving through production environments before anyone on the vendor side said a word publicly.

I've been doing this long enough to know what twenty-two days means. It means credentials were harvested. Sessions were hijacked. And in a detail that should concern every executive reading this: the attackers extracted TOTP seed configurations — the underlying secrets that generate those six-digit multi-factor authentication codes your security team told you made everything safe.

When you steal the TOTP seed, you don't bypass MFA. You clone it. Every code your employee generates, the attacker generates simultaneously. The second factor becomes a shared factor.

Who's Doing This and Why It Matters

The group using this access most aggressively is INC, a ransomware-as-a-service operation that Resecurity and others have tracked since 2023. As of August 2, 2026, INC has listed 885 victims on its data leak site. That makes it the fourth most active ransomware group this year, behind Qilin, Akira, and The Gentlemen.

INC's targeting is deliberate. More than 65% of its victims are US-based. The top five sectors — legal services, manufacturing, technology, healthcare, and construction — share two things: regulatory sensitivity and cyber insurance policies. In one 48-hour window earlier this year, INC claimed ten law firms. That's not opportunism. That's a business plan.

The SonicWall exploit chain gave INC exactly what it needed: quiet, persistent access through devices that most security operations centers don't monitor with the same intensity as endpoints or cloud workloads.

The Exploit Chain, in Plain English

Two vulnerabilities, chained together.

CVE-2026-15409 scored a perfect 10.0 on the CVSS severity scale. It let an unauthenticated attacker — no credentials, no prior access — open a tunnel through the VPN appliance to services that were supposed to be reachable only from within the device itself. Think of it as discovering that the front door to your building has a hidden passage that leads directly to the security office, the key cabinet, and the alarm panel.

CVE-2026-15410 scored 7.2. Once inside, this flaw let the attacker escalate from a low-privilege service account to root — full administrative control of the appliance's operating system.

Chain them together and you go from "anonymous person on the internet" to "administrator of the VPN appliance" in a single sequence. Volexity, the firm that discovered the exploitation, documented custom malware — tools named ROOTRUN and KNUCKLEBALL — that the attackers injected directly into legitimate SonicWall processes running in memory. That's designed to survive standard forensic review.

What Your Board Should Be Asking

In Cyber Risk Is Business Risk, I walk through what I call the Three Questions — the ones every board should be asking about any material cyber risk:

What can go wrong? Your VPN appliance — the device that controls remote access to your entire network — was exploitable by anyone on the internet for at least three weeks before a patch existed. During that window, attackers stole credentials, hijacked live sessions, and cloned your MFA tokens.

What are we doing about it? CISA added these vulnerabilities to its Known Exploited Vulnerabilities catalog on July 14 and gave federal agencies until July 17 to patch — just three business days, which tells you how seriously the government took this. If your organization isn't a federal agency, there was no mandatory deadline. The question is whether your team patched anyway, and how quickly.

How do we know it's working? This is the one that separates organizations that manage cyber risk from organizations that just buy tools. Patching the appliance closes the front door. But if attackers were already inside — if they harvested credentials and TOTP seeds before the patch — then the patch alone changes nothing. You need to verify that no compromised credentials remain active, that TOTP seeds have been rotated, and that no persistent access mechanisms are sitting in memory on those appliances.

What to Ask Your CISO This Week

If your organization uses SonicWall SMA 1000 series appliances — the SMA6210, SMA7210, or SMA8200v — here's what the conversation should include:

Have we patched? The fixed firmware versions are 12.4.3-03453 and 12.5.0-02835 or later. If you haven't applied them, stop reading this and go do it. The exploit is public.

Did we check for compromise before patching? Patching a device that has already been breached locks the attacker out of the front door while leaving them in the house. Your team should have reviewed appliance logs, checked for unauthorized WebSocket tunnel activity, and looked for signs of credential extraction before or immediately after patching.

Have we rotated credentials and TOTP seeds? If there's any possibility those appliances were compromised between June 22 and the day you patched, every credential and MFA seed that flowed through them should be considered stolen. Rotating passwords without rotating TOTP seeds leaves the window open.

Do we monitor our edge devices the way we monitor our endpoints? Most organizations have EDR on every laptop and server. Far fewer apply the same scrutiny to VPN appliances, load balancers, and firewalls — the very devices that control access to everything else. If your security operations center can't tell you what happened on your SonicWall appliance last Tuesday, that's a gap worth closing.

This is one of those weeks where the incident is specific enough to act on. The vulnerability has a name. The attacker group has a name. The patch has a version number. The only missing variable is whether your organization has done anything about it.