All Articles

TL;DR for CISOs: The edge and the management plane both took hits. INC Ransomware is now the leading actor chaining two SonicWall SMA 1000 flaws to reach the inside of corporate networks, with 885 victims listed on its leak site and fresh activity through the start of August. In parallel, N-able confirmed active exploitation of a new N-central authentication bypass, and CISA added it to the Known Exploited Vulnerabilities catalog the same day. Two data-theft disclosures rounded out the day: biotech firm Amgen said patient health and proprietary data was stolen from third-party cloud systems, and the UK's Police National Legal Database confirmed staff and customer contact records surfaced on the dark web. The common thread is the remote-access layer, from VPN appliances to RMM consoles, and the cloud and third parties that sit behind it.

INC Ransomware becomes the dominant actor exploiting SonicWall SMA 1000 appliances

What happened

A remote-access appliance is a concentrated prize because it sits exactly where trust changes hands. It authenticates external users, stores the session material that keeps them logged in, and forwards approved traffic inward, so an attacker who takes one over inherits a warm path into the network rather than a cold start at the perimeter. That is why the shift in this story matters. What began as quiet, pre-disclosure exploitation of the SMA 1000 series in late June has now become the preferred entry point for a high-volume ransomware operation, and the window between a public fix in mid-July and widespread criminal use has closed to weeks.

The detail security leaders should sit with is what the intruders collected before deploying anything noisy. Harvesting credentials, live session databases, and one-time-password seed values is a deliberate move to defeat the controls most organizations lean on for remote access. Stolen session data can let an attacker resume an authenticated session, and a captured TOTP seed can let them generate valid second-factor codes at will, which blunts multi-factor authentication as a barrier once the appliance is compromised. The reports from Rapid7, Volexity, and Resecurity describe overlapping activity rather than competing accounts, which points to a coordinated effort to find and monetize this weakness rather than isolated opportunism.

Evidence

Two independent sources:

• The Hacker News: INC Ransomware Emerges as Dominant Actor Exploiting SonicWall SMA 1000 Flaws (August 3, 2026)
• Resecurity: From WSProxy to Root, INC Ransomware and SonicWall SMA Exploit Chain (researcher report)

What this means for your team

Reframe an SMA 1000 patch as an incident-response trigger, because a device that was reachable while these flaws were live should be presumed touched until you can show otherwise. Patching to the current firmware stops new exploitation, but it does nothing about credentials, session tokens, and one-time-password seeds that may already be in an attacker's hands, so the real work is rotation and hunting. Force a reset of account passwords and MFA enrollments tied to the appliance, invalidate active sessions, and re-provision the TOTP seeds rather than trusting the ones the device held. Then look inward, since the stated goal was lateral movement: review authentication and east-west traffic for the period the appliance was exposed, and pay attention to any interaction with the appliance's proxy paths or unusual parameters that Resecurity flagged. Finally, use this as evidence for a structural point with your board, which is that internet-facing remote-access appliances deserve the same monitoring rigor as domain controllers, because they now attract the same class of adversary.

N-able N-central bypass is confirmed exploited and lands in the CISA KEV catalog

What happened

This is the second day this story has earned space, and the reason is a change in status rather than a repeat of the same facts. What was a vendor investigation and an emergency hotfix has now hardened into confirmed exploitation with a federal deadline attached, because a KEV listing obliges federal civilian agencies to remediate on a set clock and gives every other organization a clear signal of urgency. The structural risk is unchanged and worth restating plainly: an RMM platform holds standing administrative reach into every device it manages, and when a managed service provider runs it, that reach crosses company lines, so one authentication bypass can become a set of intrusions at unrelated organizations. The persistence pattern of outbound tunnels planted on managed endpoints means cleaning the console alone does not end the incident.

Evidence

Two independent sources:

• BleepingComputer: N-able warns of N-central auth bypass flaw exploited in attacks (August 3, 2026)
• CISA: CISA Adds One Known Exploited Vulnerability to Catalog (August 3, 2026)

What this means for your team

Confirm the exact build first, because the safe version is specific: 2026.3.1.7 or later, and simply being on the 2026.3 line without the hotfix should be treated as still vulnerable. If a provider runs your endpoints, send them one direct question today, which is which N-central build they run and when it was applied, since their exposure becomes yours. Once the build is confirmed, hunt on the managed endpoints for the indicators N-able published, especially a Cloudflared service and a misplaced svchost.exe, because persistence lives below the console and survives a console cleanup. This is also the moment to press a control you may have deferred: privileged management platforms belong behind network restrictions and phishing-resistant multi-factor authentication, so a product-level bypass is not the only thing standing between an attacker and your fleet.

Amgen says patient and proprietary data was stolen from third-party cloud systems

What happened

The point of interest for security leaders is the location of the loss. The data left through cloud systems run by a third party, not through Amgen's own front door, which places the exposure in the seam between an enterprise and a vendor it depends on. That seam is where accountability tends to blur, because the data is regulated as the enterprise's responsibility while the controls that failed sit in someone else's environment. For a life-sciences organization the stakes are doubled, since the same breach can expose both patient health information under privacy law and the research and intellectual property that underpins the business. Amgen's careful phrasing, that it is still determining the full scope, is a reminder that early disclosures set a floor on the impact rather than a ceiling.

Evidence

Two independent sources:

• BleepingComputer: Amgen says cloud data breach exposed patient health, proprietary info
• The Record: Biotech giant Amgen says patient data stolen from third-party cloud systems

What this means for your team

Use this as a prompt to map where your regulated and sensitive data actually lives outside your own tenancy, because you cannot defend a copy you have not located. For each third-party cloud system that holds patient, customer, or proprietary data, confirm who monitors it, how access is logged, and how quickly you would be told of unauthorized activity, then test that notification path rather than assuming it works. Where contracts allow, require breach-notification timelines and evidence of monitoring from data custodians, and make exfiltration detection a named control in the vendor relationship rather than an implied one. For life-sciences and healthcare teams specifically, treat intellectual property and research data as breach-worthy alongside protected health information, since attackers clearly value both.

UK Police National Legal Database confirms staff and customer contact data on the dark web

What happened

This breach carries lower data sensitivity than a health or credential leak, but higher targeting risk, because the exposed population is law enforcement and justice staff. Names paired with work email addresses are exactly the raw material for convincing phishing and impersonation aimed at people who handle sensitive casework, and the value to an adversary is the audience rather than the depth of the fields. The gap between the group's claimed record count and what PNLD has confirmed is a familiar feature of a live disclosure, and it is why the safer working assumption for potentially affected individuals is heightened vigilance rather than waiting for a final tally.

Evidence

Two independent sources:

• The Hacker News: PNLD Breach Exposes U.K. Police and Government Contact Details on Dark Web (August 3, 2026)
• The Register: Police National Legal Database confirms data theft after dark web leak (August 3, 2026)

What this means for your team

Even a contact-only leak deserves a targeted phishing-awareness prompt for the affected group, because attackers will pair the names and emails with current events to craft believable lures. If your organization operates a public-facing service that collects names and email addresses, treat this as a case study in scoping: separate the exposure to your own staff from the exposure to members of the public, since the response and the notification duties differ. Confirm that the platform behind any such service logs access and would surface bulk data extraction, and rehearse how you would communicate quickly and plainly if contact data for your people or your users appeared on a leak site.

Also notable

Ranked-but-lighter items from the day, with sources so you can judge freshness and relevance.

• Ruby on Rails patched CVE-2026-66066, a critical Active Storage flaw scored 9.5 that can let an unauthenticated attacker read files the app process can access, including secrets usable for remote code execution; proof-of-concept code went public ahead of schedule, so patch and rotate secrets. BleepingComputer (early August)
• Researchers reported custom-malware attacks abusing hotel and hospitality Wi-Fi to breach Microsoft 365 accounts, a reminder that travel networks remain a soft path to cloud identity. BleepingComputer (August 3)
• A random-number-generation flaw in COLDCARD hardware wallets was reported as likely linked to an $88 million Bitcoin theft, underscoring how cryptographic weaknesses in key generation can translate directly into loss. BleepingComputer (August 3)

FAQ

We patched our SonicWall SMA 1000 appliances. Are we done?

Not necessarily. Attackers exploiting CVE-2026-15409 and CVE-2026-15410 harvested credentials, active session databases, and TOTP MFA seeds before the fix. If a device was internet-facing while the flaws were live, treat it as a suspected intrusion, rotate the affected secrets and MFA seeds, invalidate sessions, and hunt for lateral movement rather than relying on the patch alone.

Is the 885-victim figure for INC Ransomware confirmed?

No. That count comes from INC Ransomware's own leak-site tally as tracked by public monitoring services and is a threat-actor claim, not an independently verified number. The confirmed facts are the vulnerabilities, their exploitation, and the researcher attribution to INC and to the UTA0533 cluster.

Which N-central build is safe, and does the KEV listing change our timeline?

Hotfix build 2026.3.1.7 or later is the safe version, and being on 2026.3 without the hotfix should be treated as still vulnerable. CISA's addition of CVE-2026-18577 to the Known Exploited Vulnerabilities catalog sets a remediation deadline for federal civilian agencies and is a strong urgency signal for everyone else.

Amgen said the data was in third-party cloud systems. What should we take from that?

That regulated and proprietary data held outside your own tenancy is still your responsibility even when the failing controls are a vendor's. Map where such data lives, confirm who monitors it and how fast you would be notified of unauthorized access, and make breach notification and exfiltration detection explicit obligations for data custodians.

What connects today's stories?

The remote-access and data-custody layers. VPN appliances and RMM consoles both grant standing reach into internal systems, and third-party cloud holds the data that reach protects. Each story shows an attacker converting access at that layer into credential theft, lateral movement, or data loss, so the priority controls are hardening and monitoring the access plane and rotating secrets after any suspected compromise.

Corrections and takedown requests: CISO Platform is committed to accuracy and fairness. If any detail in this briefing is inaccurate, or if you represent an affected organization and would like a correction or removal, please contact us at pritha.aash@cisoplatform.com and we will review your request promptly.