Loading malware…
INC Ransom is a financially motivated, Russian-speaking ransomware-as-a-service operation active since mid-2023. It uses a double- and multi-extortion model, combining data theft, encryption, and threatened publication of stolen data through leak-site and negotiation infrastructure. The operation has targeted organizations internationally, with substantial activity against organizations in the United States and Europe. Frequently targeted sectors include professional services, particularly law firms, as well as healthcare, education, manufacturing, industrial organizations, government, and financial services.
INC Ransom affiliates obtain access through exploitation of internet-facing applications and remote-access appliances, compromised VPN or RDP accounts, and spearphishing. The operation has been linked to exploitation of SonicWall SMA 1000 vulnerabilities CVE-2026-15409 and CVE-2026-15410, which can be chained to compromise exposed appliances and facilitate credential theft, persistent access, and movement into internal networks.
INC Ransom operations emphasize rapid enterprise-wide deployment through Active Directory, Group Policy, remote administration tools, Windows management protocols, SMB shares, and post-exploitation tooling. Observed activity includes Active Directory and infrastructure enumeration, theft of credential material and cloud-hosted data, port forwarding, service and process termination, security-product tampering, removal of recovery data, and propagation to network shares and virtualization infrastructure. Its Rust-based encryptors support recursive encryption of local and network-accessible data. Windows payloads use hybrid cryptography involving Curve25519-family key exchange and symmetric encryption; Linux and VMware ESXi variants have also been observed.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
12 CVEs Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.
For SharePoint, CISA confirmed ransomware activity tied to CVE-2026-45659, a high-severity remote code execution flaw stemming from deserialization of untrusted data. It allows an attacker with low privileges to run arbitrary code on unpatched servers, and Microsoft has noted it can be exploited reliably in low-complexity attacks.
Separately, CISA linked ransomware activity to two SonicWall SMA1000 flaws (CVE-2026-15409 and CVE-2026-15410), including a maximum-severity server-side request forgery vulnerability.
Separately, CISA linked ransomware activity to two SonicWall SMA1000 flaws (CVE-2026-15409 and CVE-2026-15410), including a maximum-severity server-side request forgery vulnerability.
Il vise le groupe INC Ransom, opérateur de ransomware-as-a-service (RaaS) d’origine russophone.
CVE-2023-48788 ... SQL Injection Leading to RCE Fortinet FortiClient EMS 7.2.0 through 7.2.2 and 7.0.1 through 7.0.10 9.3 (Critical) 98.53% | INC Ransomware has rapidly evolved into one of the most active ransomware-as-a-service (RaaS) operations in 2026, claiming responsibility for more than 830 victims worldwide since its emergence in August 2023.
CVE-2025-5777 ... Authentication Bypass / Session Hijacking Citrix NetScaler ADC and Citrix Gateway 14.1 before 14.1-43.56 and 13.1 before 13.1-58.32 9.3 (Critical) 99.90% | INC Ransomware has rapidly evolved into one of the most active ransomware-as-a-service (RaaS) operations in 2026, claiming responsibility for more than 830 victims worldwide since its emergence in August 2023.
CVE-2024-57727 ... Path Traversal Leading to RCE SimpleHelp versions 5.5.7 and earlier 7.5 (High) 95.07% | INC Ransomware has rapidly evolved into one of the most active ransomware-as-a-service (RaaS) operations in 2026, claiming responsibility for more than 830 victims worldwide since its emergence in August 2023.
Security teams are advised to ... patch known vulnerabilities including ... CVE-2023-35082 ... IoCs ... CVE-2023-35082 SimpleHelp RMM vulnerability, used for initial access | INC ransomware has grown from a newcomer threat into one of the most dangerous ransomware operations worldwide. The group runs under a Ransomware-as-a-Service model. Both the Windows and Linux/ESXi encryptors have been fully rewritten in Rust.
Security teams are advised to ... patch known vulnerabilities including ... CVE-2024-4885 ... IoCs ... CVE-2024-4885 WhatsUp Gold RCE, used for initial access | INC ransomware has grown from a newcomer threat into one of the most dangerous ransomware operations worldwide. The group runs under a Ransomware-as-a-Service model. Both the Windows and Linux/ESXi encryptors have been fully rewritten in Rust.
Security teams are advised to ... patch known vulnerabilities including ... CVE-2023-4966 ... IoCs ... CVE-2023-4966 Citrix Bleed (NetScaler), used for credential theft | INC ransomware has grown from a newcomer threat into one of the most dangerous ransomware operations worldwide. The group runs under a Ransomware-as-a-Service model. Both the Windows and Linux/ESXi encryptors have been fully rewritten in Rust.
This activity is significant as it may indicate an attempt to exploit CVE-2024-21378, where a custom MAPI form loads a potentially malicious DLL. If confirmed malicious, this could allow an attacker to execute arbitrary code, leading to further system compromise or data exfiltration.
The following analytic identifies remote code execution (RCE) attempts targeting F5 BIG-IP, BIG-IQ, and Traffix SDC devices, specifically exploiting CVE-2020-5902.
6 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
The affiliate mapped five SMB NAS shares to drive letters on a compromised Windows pivot and launched the Windows INC encryptor against those mapped drives.
The INC Ransomware operation has emerged as the "dominant threat actor" exploiting the recently disclosed security flaws in SonicWall Secure Mobile Access (SMA) 1000 series VPN appliances.
INC Ransom is an active ransomware and data extortion group that has been operating since at least July 2023 and is associated with the INC Ransomware malware family.
Discovered in mid-2023, INC ransomware is another RaaS group that employs double extortion tactics... In its most recent iteration, both payloads are rewritten in Rust.
Microsoft revealed on Wednesday that its threat analysts have observed the financially motivated Vanilla Tempest threat actor using INC ransomware for the first time in an attack on the U.S. healthcare sector.
The ransomware-as-a-service (RaaS) group Tarnished Scorpius (aka INC Ransomware) has listed on its leak site an Israeli industrial machinery company, and replaced the company logo with a swastika.
27 distinct techniques documented for this family, organized by ATT&CK tactic.
For example, the domain name associated with one of these emails (used by threat actors to contact the victim organization) was registered shortly after the actual incident... At the end of the call, the individual provided the email address info@helprans[.]com for further negotiations
Monitor the use of Generic Accounts and where possible prevent administrators from using generic accounts.
Review your VPN settings, restricting what resources, servers and applications can be accessed while using the VPN.
Review Firewall for evidence of potentially suspicious IP’s, brute force attacks, vulnerability exploitation or port scanning that may indicate malicious activity.
User awareness training. Regularly educate staff on phishing, social engineering and other tactics used by ransomware operators. | INC attackers gain initial access to victim organizations through spear phishing, valid account credentials obtained from initial access brokers, and exploitation of vulnerabilities in public-facing applications.
Exfiltrated data from an Asia-Pacific manufacturing copmany revealed the attacker specifically targeted Active Directory DPAPI backup master keys, which would enable offline decryption of all domain-protected credentials... At the root of the loot directory are three files containing Active Directory DPAPI backup master keys.
Review Firewall for evidence of potentially suspicious IP’s, brute force attacks, vulnerability exploitation or port scanning that may indicate malicious activity.
By invoking the native GetSystemInfo Windows API, the binary retrieves the active dwNumberOfProcessors core count metric.
To maximize the scope of its deployment, the payload initiates a systematic discovery loop targeting all connected storage infrastructure... iterating sequentially through the alphabet... identifies active volumes, distinguishing between local fixed disks, removable media and mapped network shares.
Lock down all remote management tools, including TeamViewer and AnyDesk, for example.
INC Ransom affiliates deploy ransomware to encrypt data across compromised systems, rendering victim documents and, occasionally entire systems, inaccessible.
Analysis of the imported functions indicates the use of Windows Service Control Manager APIs... This suggests that the malware is capable of stopping services that could interfere with the encryption process, such as database servers, business applications, backup solutions, or security software.
129 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Other indicator types observed in public reporting.
119 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Named as one of the five most common ransomware-as-a-service brands in Sophos's ransomware observations.
Ransomware operation included in NCC Group's July activity rankings.
Ransomware group focused on double-extortion, especially against professional services and law firms, where sensitive client data provides strong leverage.
Ransomware operation focused on double-extortion, especially against professional services and law firms where sensitive client data provides strong leverage.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.