← threat actors
threat actor · not yet in the cluster map
inc-ransomware
also tracked as uta0533 1, lynx ransomware 1
3 stories · 3 in the wild · July 4, 2026 – August 4, 2026
evidence: 3 observed
how they got in
- exposed service 1 · Aug 4
sectors
- technology 2 · Aug 4
- energy 1 · Aug 4
- finance 1 · Aug 4
- government 1 · Aug 4
- healthcare 1 · Aug 4
- manufacturing 1 · Aug 4
techniques
- lateral movement 1 · Aug 4
- privilege escalation 1 · Aug 4
- ssrf 1 · Jul 18
attack phases seen
- Initial access 3 · Aug 4
- Lateral movement 1 · Aug 4
- Privilege escalation 1 · Aug 4
- Execution 1 · Jul 18
- Credential access 1 · Jul 4
what we reported, newest first, grouped by story
August 4, 2026
- INC Ransomware has become the dominant actor exploiting SonicWall SMA 1000 flaws. Resecurity reports INC accelerating sharply since the start of August, using the appliance bugs for root access and lateral movement and posting multiple victims to its leak site (The Hacker News, SecurityWeek).
· Aug 4 · observed · via exposed service · Vulnerabilities & Exploits
Jul 16 – July 18, 2026
- SonicWall SMA exploitation attributed to UTA0533 and Inc ransomware — Volexity details root access, staged scripts, and webshell implants via chained zero-days; Horizon3 maps CVE-2026-15409/CVE-2026-15410 (SSRF + post-auth code injection) on SMA1000 (Volexity, Horizon3), with Inc Ransomware named as an exploiting actor (Dark Reading). Continues this week's SonicWall thread with fresh attribution.
· Jul 18 · observed · as uta0533 · Threat Activity
July 4, 2026
- FortiBleed credential theft tied to INC and Lynx ransomware. An operator linked to FortiBleed infrastructure was found working negotiation panels for both groups, connecting mass FortiGate credential theft directly to ransomware deployment. The Hacker News
· Jul 4 · observed · as lynx ransomware · Threat Intelligence