Loading story…
Researchers published new intelligence on INC Ransom, outlining a victim negotiation platform allegedly exposed at 178.20.41.208:1002 and describing a stack built on nginx, Yii/PHP, and a React/Redux/Socket.io frontend. The reporting says the group’s infrastructure spans clear-web and onion sites with repeated overlap in Russian hosting, and that INC has operated since 2023, listed more than 870 victims, and may share code or branding lineage with Lynx and possibly Sinobi. Separate technical reporting described INC as a multi-extortion operation that primarily targets healthcare, industrial, and education organizations in the U.S. and Europe, using living-off-the-land tools such as NETSCAN.EXE, AnyDesk, and SystemSettingsAdminFlows.exe, along with Defender tampering and a custom av.exe utility to disable EDR protections.
At the same time, multiple new victim claims attributed to incransom surfaced, affecting organizations in nonprofit services, manufacturing, healthcare support, and other sectors across the United States, Mexico, and Switzerland. Reported victims included Foundations to Freedom in Florida, DUCON in Colorado, minigrip.com.mx in Mexico, Della Casa Group AG in Switzerland, and a Minnesota-based residential care provider associated with eclmn.com. The victim summaries describe unauthorized access to confidential files including client data, financial records, R&D material, and project information; in the Swiss case, the leak allegedly involved 86,332 files in 15,359 folders totaling about 240 GB, underscoring INC Ransom’s continued emphasis on data theft and public leak pressure alongside encryption.
TTPs, infrastructure, and targeting history in one profile.
10 events from the most recent confirmed update back to the earliest known activity.
Harwal.net, identified as Harwal Group in the United Arab Emirates, was reported as a ransomware victim attributed to incransom. The report states the breach occurred on 2026-07-29 at 09:00 UTC, was discovered at 16:26 UTC, and involved 12 TB of data.
A Minnesota health and residential care organization associated with eclmn.com was reported as an incransom victim. The breach time was listed as 12:00 UTC and discovery at 13:26 UTC.
Della Casa Group AG in Switzerland was identified as a ransomware victim attributed to incransom. The report says the incident was discovered on July 28, 2026 and involved 86,332 files across 15,359 folders, including personal, client, finance, and project data.
Mexico-based manufacturer minigrip.com.mx was reported as a victim of incransom, with alleged access to client, R&D, and financial files. The breach was listed at 01:00 UTC and discovery at 02:01 UTC.
DUCON, a Colorado manufacturing organization, was reported as a victim of incransom with unauthorized access to confidential files including client, R&D, and financial data. The breach was listed at 01:00 UTC and discovery at 01:58 UTC.
Foundations to Freedom, a nonprofit in DeLand, Florida, was reported as a ransomware and data-breach victim attributed to incransom. The report lists the breach at 00:01 UTC and discovery at 01:03 UTC.
A threat-intelligence analysis reported that INC's negotiation panel was exposed at IP 178.20.41.208 on port 1002 and described its nginx, Yii/PHP, React, Redux, and Socket.io-based victim portal. The analysis also mapped overlapping clear-web and onion infrastructure and suggested possible links to Lynx and Sinobi.
A source states the INC ransomware project was advertised for sale on the RAMP forum in March 2024 for $300,000.
A published analysis described INC Ransom's targeting of healthcare, industrial, and education organizations and outlined its use of living-off-the-land tools, Windows Defender tampering, EDR-killing tooling, and encryption methods across Windows, Linux, and ESXi variants.
INC Ransomware was described as having operated since 2023, with one source more specifically stating the group has been active since July 2023.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 42 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.
9 references tracked. Mallory keeps watching after this page renders.
hookphish.com
Open sourcemalware.news
Open sourcepicussecurity.com
Open sourcehookphish.com
Open sourcehookphish.com
Open sourcehookphish.com
Open sourcehookphish.com
Open sourcehookphish.com
Open sourcetheravenfile.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
INC ransomware has grown into one of the most active **ransomware-as-a-service** operations, with researchers attributing its rise to aggressive affiliate expansion, broad victim targeting, and effective use of established intrusion methods rather than novel exploits. The group, active since 2023 and linked to more than **800 claimed victims**, uses **double extortion** by encrypting systems and threatening to leak stolen data, with early concentration on healthcare and other high-pressure sectors now expanding into education, legal, manufacturing, construction, and technology organizations. Researchers said INC has upgraded both its **Windows** and **Linux/ESXi** encryptors by rewriting them in **Rust**, improving cross-platform operations and resilience while affiliates continue to rely on spearphishing, stolen credentials, and exploitation of known flaws including **Citrix Bleed 2**, **Citrix NetScaler**, **SimpleHelp RMM**, and **Fortinet EMS** vulnerabilities. Post-compromise activity has included abuse of legitimate remote administration tools, credential theft from **Veeam** environments, living-off-the-land lateral movement, use of EDR killers, and cloud-based exfiltration with tools such as **rclone**; analysts also linked INC code to related strains including **Lynx**, **Sinobi**, and **Knoba** after the group’s source code was reportedly sold to multiple parties.
Jul 23, 2026
A reported operational security failure by the **INC ransomware** group enabled incident responders to identify attacker infrastructure and recover data stolen from **12 U.S. organizations**. A forensic review of artifacts from an intrusion—initially detected when ransomware encryption activity hit a production **SQL Server**—revealed infrastructure that stored exfiltrated victim data beyond the single investigated case, allowing broader recovery efforts. Cyber Centaurs (DFIR) traced the intrusion to a *RainINC* ransomware variant staged and executed from the Windows `PerfLogs` directory, a location increasingly abused by threat actors for staging. Investigators found renamed binaries (e.g., `winupdate.exe`) and PowerShell tooling, including a script (`new.ps1`) containing Base64-encoded *Restic* commands and hardcoded environment variables (e.g., access keys, repository paths, and S3 passwords) tied to encrypted repositories; although *Restic* was not used in the specific attack, these remnants shifted the work from incident response to infrastructure analysis and ultimately exposed reusable attacker storage repositories linked to multiple victims.
Jun 29, 2026
Crime Stoppers International has launched **Operation Silent Vector I**, a public bounty campaign seeking information that could identify and help arrest members and affiliates of the **INC Ransom** ransomware-as-a-service group. The organization said tips may cover identities, cryptocurrency wallets, infrastructure, command structure, and underground forum accounts, and it is offering rewards of up to **USD 22,000** for actionable intelligence. The appeal describes INC Ransom as a russophone operation active since mid-2023 that uses **double extortion**, reportedly shares about **75%** of ransom proceeds with affiliates, and had accumulated more than **800 recorded victims** by July 2026 across sectors including healthcare, education, government, financial services, and manufacturing. The bounty announcement comes as INC Ransom is linked in recent reporting to fresh victim claims in the United States, including **Samuels & Thornton**, a New Orleans law firm operating at `sslf.local`, and **Quantinuum**, a quantum computing company at `quantinuum.com`. Reporting on the group says it has expanded geographically beyond North America, Europe, and Latin America into Australia, New Zealand, and Pacific island nations, while relying on access methods such as exploitation of public-facing applications including `CVE-2023-3519`, spear phishing, and compromised valid accounts. Associated tooling cited in the public appeal includes **PsExec**, **Rclone**, **AnyDesk**, **Meterpreter**, and **GootLoader**, underscoring the group’s continued operational tempo as authorities and partners seek leads on its operators.
Aug 2, 2026