Loading threat actor…
INC Ransom, also tracked as GOLD IONIC and Tarnished Scorpius, is a financially motivated ransomware-as-a-service operation active since 2023. Core operators maintain the ransomware platform, while affiliates conduct intrusions in exchange for a share of ransom payments. Its targets span healthcare, government, education, technology, financial services, hospitality, manufacturing, retail, and professional services. Significant affiliate activity is tracked separately as Vanilla Tempest; that name does not encompass the entire INC Ransom operation. Affiliates obtain initial access through compromised accounts, spearphishing, and exploitation of internet-facing enterprise and remote-access systems. Documented vulnerabilities include CVE-2023-3519 and CVE-2023-4966 in Citrix NetScaler, CVE-2023-48788 in Fortinet Endpoint Management Server, and CVE-2024-57727 in SimpleHelp. Exploitation of CitrixBleed enables authenticated-session hijacking and multifactor-authentication bypass. INC operators have also exploited authentication-bypass vulnerabilities in Palo Alto Networks remote-access infrastructure and zero-day vulnerabilities in SonicWall SMA 1000 appliances. Post-compromise activity includes network and domain discovery, credential dumping, creation of privileged accounts, and lateral movement using Windows Management Instrumentation, Impacket, and legitimate administrative tools. Affiliates collect sensitive business and personal information, archive or split it, and exfiltrate it using tools including Rclone, Restic, and MegaSync. Defense-evasion techniques include encoded commands, event-log clearing, file deletion, and abuse of legitimate service accounts. INC encryptors support Windows and Linux; observed Windows functionality includes stopping backup and database services and deleting shadow copies. INC Ransom conducts double extortion by encrypting systems and threatening publication of stolen information on its leak site. It also conducts encryption-free data-theft extortion. Additional pressure tactics include printing ransom notes through network printers and contacting victims' customers. Documented victims include healthcare organizations in Australia, New Zealand, Tonga, and the United Kingdom, the Pennsylvania Office of the Attorney General, and Ahold Delhaize's U.S. operations. INC-linked affiliates have also used commercial AI tools to assist human-approved intrusion planning, data analysis, and extortion preparation.
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Who, where, and (when attributed) which flag flies behind the operation. Pulled from open-source reporting and Mallory's analyst review.
Sectors the actor has been observed targeting.
Geographies tied to known operations.
Attributed origin per open-source reporting.
69 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
18 malware families attributed to this actor across reporting.
13 additional families tracked in Mallory.
20 CVEs this actor has used in observed campaigns. 20 of them exploited in the wild.
In July, the Inc ransomware gang launched zero-day attacks exploiting two flaws, CVE-2026-15409 and CVE-2026-15410, in SMA 1000 Series appliances.
In July, the Inc ransomware gang launched zero-day attacks exploiting two flaws, CVE-2026-15409 and CVE-2026-15410, in SMA 1000 Series appliances.
Documented entry points include CVE-2023-3519 in Citrix NetScaler — a remote code execution flaw patched in July 2023.
Documented entry points include ... CVE-2023-48788, a SQL injection vulnerability in Fortinet Endpoint Management Server.
INC ransomware is known to gain access to their target victims through spear phishing, valid account credentials from Initial Access Brokers (IAB) and exploitation of vulnerabilities in public-facing applications such as CVE-2023-3519 (Citrix Netscaler), CVE-2023-48788 (Fortinet EMS), CVE-2024-57727 (SimpleHelp RMM) and CVE-2025-5777 (Citrix Bleed 2).
15 more CVEs tied to this actor tracked in Mallory.
142 indicators attributed to this actor: domains, IPs, hashes, and other artifacts pulled from reporting. View more in app.
20 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Identified as exploiting a patched authentication bypass vulnerability affecting PAN-OS and Prisma Access to bypass MFA and establish unauthorized VPN connections. The excerpt provides no group-specific operational details.
Identified as a ransomware operator exploiting CVE-2026-0257 to gain corporate network access through unauthorized VPN connections and MFA bypass. The report collectively describes subsequent reconnaissance, lateral movement, credential harvesting, exfiltration, and ransomware deployment without assigning every observed action to INC specifically.
INC affiliates are linked to an AI-assisted intrusion environment exposed across seven adversary-controlled servers. Investigators recovered 46 customized INC encryptors for six victims, with packages staged for October 1, 2026; deployment against those intended targets remains unconfirmed. A September 30 screenshot separately showed live victim encryption. Operators used commercial AI models for reconnaissance, command generation, credential and data analysis, and extortion preparation, with human approval before actions. Evidence strongly connects the environment to INC operations, but does not establish a formal alliance with The Gentlemen. Exploitation counts are operator-reported and were not independently verified.
INC-affiliated operators used an exposed, AI-assisted intrusion environment to exploit internet-facing systems, steal credentials and data, and prepare ransomware deployment. Investigators recovered 46 customized INC encryptors for six victims, including packages staged for October 1, 2026. A September 30 screenshot showed live encryption, but deployment of the staged packages was not confirmed. The shared environment contained 62 named targets, including reconnaissance-only records; these should not all be treated as confirmed INC victims. Evidence strongly connects the environment to INC operations, but a formal alliance with The Gentlemen is not established.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.