Loading malware…
INC Ransom is a ransomware family and ransomware-as-a-service operation active since 2023. Its developers maintain the encryption platform while affiliates compromise organizations and conduct extortion in exchange for a share of ransom payments. The operation uses double extortion, combining system encryption with threats to publish stolen information. It targets organizations internationally, with healthcare prominently affected alongside government, education, technology, manufacturing, and other critical-infrastructure sectors.
INC has Windows and Linux encryptors capable of multithreaded encryption, including attacks against files, directories, network shares, and virtualized infrastructure. Locker functionality includes configurable encryption modes, process and service termination, and interference with recovery mechanisms. The Windows variant can stop backup and database services, delete volume shadow copies, and establish an automatically starting service for safe-mode execution. Victim-specific builds contain individualized keys and identifiers. Ransom demands are delivered through notes and a Tor-based negotiation portal, and can also be printed on accessible network printers.
Affiliates obtain access through phishing, compromised accounts, exposed remote services, known vulnerabilities in enterprise remote-access and management products, and access purchased from initial access brokers. Documented exploitation includes Citrix NetScaler and Fortinet products, including CitrixBleed session hijacking. Post-compromise activity includes credential dumping, privilege escalation, Active Directory reconnaissance, lateral movement through remote administration tools, and persistence through services, scheduled tasks, and backdoors. Affiliates archive sensitive information and exfiltrate it using cloud-transfer utilities before deploying the encryptor. Defense-evasion activity includes clearing event logs, tampering with security services, and deleting recovery copies.
Microsoft tracks a significant INC affiliate as Vanilla Tempest, which adopted INC Ransom as its primary payload in August 2024. An observed deployment chain involved Gootloader providing access to Vanilla Tempest, followed by the Supper backdoor and INC ransomware.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
15 CVEs Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.
The content reports active exploitation of CVE-2026-0257 in PAN-OS GlobalProtect portal and gateway interfaces, including its use by Qilin and INC Ransom to obtain initial access before encrypting VMware ESXi environments. | Impact / Encryption Mass process termination and in-place .vmdk encryption Qilin.elf (Rust), INC_Linux_Ransomware (C/C++)
CVE-2024-57727 (SimpleHelp): Scans of 4,922 servers reportedly yielded 427 administrator passwords, with 242 unique IP addresses listed as impacted.
CVE-2026-35616 (FortiClient EMS): Records claimed 2,236 targets, 108 newly created administrator accounts and 4,140 managed endpoints.
CVE-2026-41940 (cPanel): Operators claimed more than 49 breaches of hosting providers.
Operator records show active exploitation of FortiClient EMS, SimpleHelp and cPanel/WHM, plus follow-on use of the Roundcube flaw CVE-2025-49113.
Documented entry points include CVE-2023-3519 in Citrix NetScaler — a remote code execution flaw patched in July 2023. | Microsoft Threat Intelligence tracks significant INC affiliate activity through a group it calls Vanilla Tempest, which adopted INC Ransom as its primary payload in August 2024.
Documented entry points include ... CVE-2023-48788, a SQL injection vulnerability in Fortinet Endpoint Management Server. | Microsoft Threat Intelligence tracks significant INC affiliate activity through a group it calls Vanilla Tempest, which adopted INC Ransom as its primary payload in August 2024.
INC Ransom also used CitrixBleed (CVE-2023-4966), a vulnerability in Citrix NetScaler ADC and Gateway appliances that lets threat actors bypass multifactor authentication and hijack legitimate user sessions. | Microsoft Threat Intelligence tracks significant INC affiliate activity through a group it calls Vanilla Tempest, which adopted INC Ransom as its primary payload in August 2024.
The following flaws have been exploited by INC affiliates: CVE-2023-27997 — Remote code execution vulnerability in Fortinet FortiGate / FortiOS SSL-VPN.
For SharePoint, CISA confirmed ransomware activity tied to CVE-2026-45659, a high-severity remote code execution flaw stemming from deserialization of untrusted data. It allows an attacker with low privileges to run arbitrary code on unpatched servers, and Microsoft has noted it can be exploited reliably in low-complexity attacks.
Separately, CISA linked ransomware activity to two SonicWall SMA1000 flaws (CVE-2026-15409 and CVE-2026-15410), including a maximum-severity server-side request forgery vulnerability.
Separately, CISA linked ransomware activity to two SonicWall SMA1000 flaws (CVE-2026-15409 and CVE-2026-15410), including a maximum-severity server-side request forgery vulnerability.
CVE-2025-5777 ... Authentication Bypass / Session Hijacking Citrix NetScaler ADC and Citrix Gateway 14.1 before 14.1-43.56 and 13.1 before 13.1-58.32 9.3 (Critical) 99.90% | INC Ransomware has rapidly evolved into one of the most active ransomware-as-a-service (RaaS) operations in 2026, claiming responsibility for more than 830 victims worldwide since its emergence in August 2023.
Security teams are advised to ... patch known vulnerabilities including ... CVE-2023-35082 ... IoCs ... CVE-2023-35082 SimpleHelp RMM vulnerability, used for initial access | INC ransomware has grown from a newcomer threat into one of the most dangerous ransomware operations worldwide. The group runs under a Ransomware-as-a-Service model. Both the Windows and Linux/ESXi encryptors have been fully rewritten in Rust.
Security teams are advised to ... patch known vulnerabilities including ... CVE-2024-4885 ... IoCs ... CVE-2024-4885 WhatsUp Gold RCE, used for initial access | INC ransomware has grown from a newcomer threat into one of the most dangerous ransomware operations worldwide. The group runs under a Ransomware-as-a-Service model. Both the Windows and Linux/ESXi encryptors have been fully rewritten in Rust.
7 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
Impact / Encryption Mass process termination and in-place .vmdk encryption Qilin.elf (Rust), INC_Linux_Ransomware (C/C++)
Microsoft Threat Intelligence tracks significant INC affiliate activity through a group it calls Vanilla Tempest, which adopted INC Ransom as its primary payload in August 2024.
An affiliate likely conducted at least five intrusions between February 2026 and April 2026, gaining initial access through internet-exposed FortiGate VPN appliances before deploying INC ransomware across VMware ESXi and Windows systems.
The affiliate mapped five SMB NAS shares to drive letters on a compromised Windows pivot and launched the Windows INC encryptor against those mapped drives.
The INC Ransomware operation has emerged as the "dominant threat actor" exploiting the recently disclosed security flaws in SonicWall Secure Mobile Access (SMA) 1000 series VPN appliances.
Microsoft revealed on Wednesday that its threat analysts have observed the financially motivated Vanilla Tempest threat actor using INC ransomware for the first time in an attack on the U.S. healthcare sector.
20 distinct techniques documented for this family, organized by ATT&CK tactic.
N-central panel pushes encryptor builds to endpoints
It calls CreateServiceW to register a service named dmksvc whose ImagePath ... points to the locker binary.
It calls CreateServiceW to register a service named dmksvc whose ImagePath ... points to the locker binary.
The INC locker hardcodes its ransom note in the executable as a base64-encoded string.
INC quiet mode restores last-write times
Toolhelp snapshot behind the encryptor proc option
Encryptor traversal with FindFirstFileW/FindNextFileW
N-central panel pushes encryptor builds to endpoints
SimpleHelp, MeshCentral and N-central agents
46 INC encryptor binaries were built for six victims
The Windows encryptor stops backup and database processes and services
Shadow-copy removal through IOCTL 0x0053C028
196 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Other indicator types observed in public reporting.
150 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
The content identifies a C/C++ Linux ransomware payload associated with attacks on ESXi hypervisors. It describes operators exploiting GlobalProtect authentication bypass to obtain initial access, compromise hypervisor credentials, terminate virtual machines, and encrypt virtual disks across shared storage.
Ransomware whose affiliates were linked to exposed servers containing stolen credentials, AI-assisted intrusion records and custom encryptors. Investigators recovered 46 builds prepared for six victims ahead of a planned October 1, 2026 deployment. A screenshot showed encryption activity on at least one victim workstation, but the report did not confirm that all six planned attacks occurred.
Rust-based ransomware tracked since August 2023. Investigators recovered 46 customized encryptors and observed evidence of live encryption on September 30, 2026. The Windows encryptor stops backup and database services, deletes shadow copies through direct driver calls, appends .INC, and drops INC-README.txt ransom notes. Three packages were staged for October 1 deployment, but their deployment was not confirmed.
Rust-based ransomware whose Windows encryptor stops backup and database services, deletes shadow copies through direct driver calls, appends .INC to encrypted files, and drops INC-README.txt ransom notes. Investigators recovered 46 customized builds; a September 30, 2026 screenshot showed live encryption, but deployment of the planned October 1 wave was unconfirmed.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.