kyber.today

daily cyber × ai intelligence

← threat actors

threat actor

UTA0533

also tracked as inc ransomware 1

2 stories · 2 in the wild · July 18, 2026 – July 21, 2026

evidence: 2 observed

sectors

  • technology 1 · Jul 18

techniques

  • rce 1 · Jul 21
  • zero day 1 · Jul 21
  • ssrf 1 · Jul 18

attack phases seen

  • Execution 2 · Jul 21
  • Initial access 2 · Jul 21

what we reported, newest first, grouped by story

Jul 16 – July 21, 2026 · 2 reports

  • SonicWall SMA1000 zero-days were exploited for weeks before patching to deploy custom malware, Volexity's write-up confirms, tracking the actor as UTA0533 (earlier coverage). BleepingComputer, SecurityWeek. · Jul 21 · observed · Vulnerabilities & Exploits
  • SonicWall SMA exploitation attributed to UTA0533 and Inc ransomware — Volexity details root access, staged scripts, and webshell implants via chained zero-days; Horizon3 maps CVE-2026-15409/CVE-2026-15410 (SSRF + post-auth code injection) on SMA1000 (Volexity, Horizon3), with Inc Ransomware named as an exploiting actor (Dark Reading). Continues this week's SonicWall thread with fresh attribution. · Jul 18 · observed · as inc ransomware · Threat Activity