Loading story…
The ransomware group INC Ransom has been linked to an attack on takethehop.com, the website of The HOP, a regional public transit system operated by the Hill Country Transit District in Texas. The incident was reported as a data breach and ransomware event, adding a public-sector transportation victim to the group’s growing list of targets as double-extortion campaigns continue to hit North American organizations.
MITRE ATT&CK describes INC Ransom as an intrusion set that commonly gains access through phishing, compromised valid accounts, and exploitation of public-facing applications including CVE-2023-3519 in Citrix NetScaler, then conducts discovery, lateral movement, data staging, exfiltration, and encryption. The group has been observed using tools such as AnyDesk, PuTTY, PsExec, MegaSync, Advanced IP Scanner, WMIC, 7-Zip, and WinRAR, while disguising activity and disabling defenses before deploying ransomware. A recent Cyble global threat report also identified INC Ransom among the major ransomware actors active in 2026, underscoring the continued scale of double-extortion operations worldwide.
TTPs, infrastructure, and targeting history in one profile.
2 events from the most recent confirmed update back to the earliest known activity.
A ransomware attack attributed to INC Ransom against takethehop.com was discovered on July 27, 2026, shortly after the reported breach time that same day. The affected organization was identified as The HOP, a regional public transit system operated by the Hill Country Transit District in Texas.
Cyble Research and Intelligence Labs published a report covering January through June 2026, stating that ransomware remained the dominant threat with 3,836 attacks globally. The report identified Qilin as the most prolific ransomware actor and highlighted major activity from groups including Akira, INC Ransom, Play, LockBit, CL0P, Dragonforce, and The Gentlemen.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.
5 references tracked. Mallory keeps watching after this page renders.
hookphish.com
Open sourcecyberveille.ch
Open sourceattack.mitre.org
Open sourceattack.mitre.org
Open sourceattack.mitre.org
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
INC ransomware has grown into one of the most active **ransomware-as-a-service** operations, with researchers attributing its rise to aggressive affiliate expansion, broad victim targeting, and effective use of established intrusion methods rather than novel exploits. The group, active since 2023 and linked to more than **800 claimed victims**, uses **double extortion** by encrypting systems and threatening to leak stolen data, with early concentration on healthcare and other high-pressure sectors now expanding into education, legal, manufacturing, construction, and technology organizations. Researchers said INC has upgraded both its **Windows** and **Linux/ESXi** encryptors by rewriting them in **Rust**, improving cross-platform operations and resilience while affiliates continue to rely on spearphishing, stolen credentials, and exploitation of known flaws including **Citrix Bleed 2**, **Citrix NetScaler**, **SimpleHelp RMM**, and **Fortinet EMS** vulnerabilities. Post-compromise activity has included abuse of legitimate remote administration tools, credential theft from **Veeam** environments, living-off-the-land lateral movement, use of EDR killers, and cloud-based exfiltration with tools such as **rclone**; analysts also linked INC code to related strains including **Lynx**, **Sinobi**, and **Knoba** after the group’s source code was reportedly sold to multiple parties.
Jul 23, 2026
Huntress reconstructed an INC ransomware intrusion affecting at least 175 endpoints, including domain controllers. Although the initial-access method could not be established because relevant EDR telemetry and logs had expired, surviving evidence showed persistence and RDP-based lateral movement before a 17-day pause in activity. Attackers later installed AnyDesk, deployed a bring-your-own-vulnerable-driver (BYOVD) toolkit and an EDR/antivirus-killer driver, and used Impacket `atexec.py` to distribute tools and launch INC ransomware across the environment. Two ransom notes were left; the second claimed data exfiltration and threatened to notify the victim's media contacts, employees, partners, and clients if no response was received within 48 hours. Huntress said the separated phases may indicate an initial-access broker handing off to an INC affiliate, though attribution remains unconfirmed.
Sep 21, 2026
Researchers published new intelligence on **INC Ransom**, outlining a victim negotiation platform allegedly exposed at `178.20.41.208:1002` and describing a stack built on **nginx**, **Yii/PHP**, and a **React/Redux/Socket.io** frontend. The reporting says the group’s infrastructure spans clear-web and onion sites with repeated overlap in Russian hosting, and that INC has operated since 2023, listed more than **870 victims**, and may share code or branding lineage with **Lynx** and possibly **Sinobi**. Separate technical reporting described INC as a **multi-extortion** operation that primarily targets healthcare, industrial, and education organizations in the U.S. and Europe, using living-off-the-land tools such as **NETSCAN.EXE**, **AnyDesk**, and `SystemSettingsAdminFlows.exe`, along with Defender tampering and a custom `av.exe` utility to disable EDR protections. At the same time, multiple new victim claims attributed to **incransom** surfaced, affecting organizations in nonprofit services, manufacturing, healthcare support, and other sectors across the **United States, Mexico, and Switzerland**. Reported victims included **Foundations to Freedom** in Florida, **DUCON** in Colorado, **minigrip.com.mx** in Mexico, **Della Casa Group AG** in Switzerland, and a Minnesota-based residential care provider associated with **eclmn.com**. The victim summaries describe unauthorized access to confidential files including client data, financial records, R&D material, and project information; in the Swiss case, the leak allegedly involved **86,332 files** in **15,359 folders** totaling about **240 GB**, underscoring INC Ransom’s continued emphasis on data theft and public leak pressure alongside encryption.
Jul 29, 2026