Loading story…
INC ransomware has grown into one of the most active ransomware-as-a-service operations, with researchers attributing its rise to aggressive affiliate expansion, broad victim targeting, and effective use of established intrusion methods rather than novel exploits. The group, active since 2023 and linked to more than 800 claimed victims, uses double extortion by encrypting systems and threatening to leak stolen data, with early concentration on healthcare and other high-pressure sectors now expanding into education, legal, manufacturing, construction, and technology organizations.
Researchers said INC has upgraded both its Windows and Linux/ESXi encryptors by rewriting them in Rust, improving cross-platform operations and resilience while affiliates continue to rely on spearphishing, stolen credentials, and exploitation of known flaws including Citrix Bleed 2, Citrix NetScaler, SimpleHelp RMM, and Fortinet EMS vulnerabilities. Post-compromise activity has included abuse of legitimate remote administration tools, credential theft from Veeam environments, living-off-the-land lateral movement, use of EDR killers, and cloud-based exfiltration with tools such as rclone; analysts also linked INC code to related strains including Lynx, Sinobi, and Knoba after the group’s source code was reportedly sold to multiple parties.
TTPs, infrastructure, and targeting history in one profile.
9 events from the most recent confirmed update back to the earliest known activity.
A July 2026 analysis of exposed INC infrastructure reconstructed how the group automates ransomware deployment after gaining domain-level access, using Active Directory, Group Policy Objects, SYSVOL-hosted scripts, Impacket, and Windows LOLBins. The report also described operators disabling Microsoft Defender and UAC before downloading and executing the Rust-based payload across domain-joined systems, and published Sigma detection opportunities for these behaviors.
A new report said legal services had become INC ransomware's top targeting priority, ahead of manufacturing, technology, health care, and construction. The article said law firms are attractive targets because they hold highly sensitive documents that can increase extortion pressure if stolen and leaked.
Researchers found exposed INC affiliate servers in mid-June 2026 that contained a Rust-based Linux encryptor suite cross-compiled for 14 CPU architectures, including IBM POWER, SPARC64, s390x, and RISC-V. The finding indicated INC had expanded beyond previously documented x86-64 Linux and ESXi targeting toward enterprise and mainframe platforms.
Researchers reported that INC used a Veeam credential-stealing utility, BYOVD techniques, remote administration tools for persistence and evasion, and Rclone for data exfiltration before encryption. The report also described intrusion paths including spear-phishing, Initial Access Broker credentials, and exploitation of Citrix NetScaler, Fortinet EMS, and SimpleHelp systems.
Acronis reported that INC fully rewrote its Windows and Linux/ESXi ransomware variants in Rust. The change was described as improving cross-platform capability, operational reliability, and evasion in newer attacks.
Acronis researchers assessed INC as one of the most active ransomware-as-a-service groups in 2026, with more than 800 claimed victims. They attributed its growth to aggressive victim selection, rapid affiliate scaling, and reliance on proven intrusion methods.
ZeroFox placed INC in its global top five ransomware groups for the first quarter of 2026, citing 124 incidents. Analysts said the group's growth appeared uneven and may reflect affiliate churn and reconsolidation.
In 2024, INC's source code was reportedly sold to at least three parties. Researchers believe related ransomware strains such as Lynx, Sinobi, and Knoba show code overlap tied to that sale.
The references describe INC as a ransomware-as-a-service operation that emerged in 2023 and later grew into a major global ransomware group.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 46 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.
27 references tracked. Mallory keeps watching after this page renders.
ctrlaltintel.com
Open sourcemedium.com
Open sourceblog.knowbe4.com
Open sourcesecpod.com
Open sourceattack.mitre.org
Open sourceattack.mitre.org
Open sourceattack.mitre.org
Open sourceattack.mitre.org
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers published new intelligence on **INC Ransom**, outlining a victim negotiation platform allegedly exposed at `178.20.41.208:1002` and describing a stack built on **nginx**, **Yii/PHP**, and a **React/Redux/Socket.io** frontend. The reporting says the group’s infrastructure spans clear-web and onion sites with repeated overlap in Russian hosting, and that INC has operated since 2023, listed more than **870 victims**, and may share code or branding lineage with **Lynx** and possibly **Sinobi**. Separate technical reporting described INC as a **multi-extortion** operation that primarily targets healthcare, industrial, and education organizations in the U.S. and Europe, using living-off-the-land tools such as **NETSCAN.EXE**, **AnyDesk**, and `SystemSettingsAdminFlows.exe`, along with Defender tampering and a custom `av.exe` utility to disable EDR protections. At the same time, multiple new victim claims attributed to **incransom** surfaced, affecting organizations in nonprofit services, manufacturing, healthcare support, and other sectors across the **United States, Mexico, and Switzerland**. Reported victims included **Foundations to Freedom** in Florida, **DUCON** in Colorado, **minigrip.com.mx** in Mexico, **Della Casa Group AG** in Switzerland, and a Minnesota-based residential care provider associated with **eclmn.com**. The victim summaries describe unauthorized access to confidential files including client data, financial records, R&D material, and project information; in the Swiss case, the leak allegedly involved **86,332 files** in **15,359 folders** totaling about **240 GB**, underscoring INC Ransom’s continued emphasis on data theft and public leak pressure alongside encryption.
Jul 29, 2026
A reported operational security failure by the **INC ransomware** group enabled incident responders to identify attacker infrastructure and recover data stolen from **12 U.S. organizations**. A forensic review of artifacts from an intrusion—initially detected when ransomware encryption activity hit a production **SQL Server**—revealed infrastructure that stored exfiltrated victim data beyond the single investigated case, allowing broader recovery efforts. Cyber Centaurs (DFIR) traced the intrusion to a *RainINC* ransomware variant staged and executed from the Windows `PerfLogs` directory, a location increasingly abused by threat actors for staging. Investigators found renamed binaries (e.g., `winupdate.exe`) and PowerShell tooling, including a script (`new.ps1`) containing Base64-encoded *Restic* commands and hardcoded environment variables (e.g., access keys, repository paths, and S3 passwords) tied to encrypted repositories; although *Restic* was not used in the specific attack, these remnants shifted the work from incident response to infrastructure analysis and ultimately exposed reusable attacker storage repositories linked to multiple victims.
Jun 29, 2026
Huntress reconstructed an INC ransomware intrusion affecting at least 175 endpoints, including domain controllers. Although the initial-access method could not be established because relevant EDR telemetry and logs had expired, surviving evidence showed persistence and RDP-based lateral movement before a 17-day pause in activity. Attackers later installed AnyDesk, deployed a bring-your-own-vulnerable-driver (BYOVD) toolkit and an EDR/antivirus-killer driver, and used Impacket `atexec.py` to distribute tools and launch INC ransomware across the environment. Two ransom notes were left; the second claimed data exfiltration and threatened to notify the victim's media contacts, employees, partners, and clients if no response was received within 48 hours. Huntress said the separated phases may indicate an initial-access broker handing off to an INC affiliate, though attribution remains unconfirmed.
Sep 21, 2026