Loading story…
Australia’s Cyber Security Centre, CERT Tonga, and New Zealand’s National Cyber Security Centre issued a joint advisory warning that INC Ransom’s ransomware-as-a-service affiliate model is enabling attacks on critical networks, particularly healthcare. The group, active since mid-2023 and also tracked as Tarnished Scorpion and GOLD IONIC, steals data and encrypts systems before threatening publication on a Tor-based leak site. ACSC handled 11 related incidents in Australia between July 2024 and December 2025; the advisory also details a disruptive attack on Tonga’s Ministry of Health in June 2025 and a New Zealand health-sector incident in May 2025 that resulted in leaked data. More than 200 alleged victims appeared on INC’s leak site by mid-2025, according to accompanying reporting, which also identified healthcare and government targets beyond the region.
Affiliates typically obtain access through spear-phishing, unpatched internet-facing systems, or compromised credentials, including credentials purchased through initial access brokers. They then escalate privileges, move laterally, and exfiltrate data using common tools before deploying ransomware. The advisory maps observed activity to MITRE ATT&CK and urges organizations to prioritize vulnerability remediation, phishing-resistant MFA, hardened remote access, and privileged access controls. Tested backups, network segmentation and traffic restrictions, limits on remote management tools, and centralized logging are key measures to reduce disruption and detect abuse. Reporting also highlights affiliate movement between ransomware brands and links between INC and Lynx ransomware, reinforcing the need to track attacker behaviors rather than rely solely on group names.
TTPs, infrastructure, and targeting history in one profile.
13 events from the most recent confirmed update back to the earliest known activity.
INC Ransom claimed responsibility for breaching the Pennsylvania Office of the Attorney General. The group claimed it stole more than five terabytes of data and suggested it had access to federal networks.
INC Ransom ranked as the most deployed ransomware in July 2025 based on victim postings.
INC Ransom claimed responsibility for the attack on Tonga's Ministry of Health through its dark-web data leak site.
A ransomware attack affected Tonga's Ministry of Health ICT environment, making core services inaccessible and disrupting the national healthcare network. An INC Ransom ransom note was found in the ministry's file system.
New Zealand's NCSC received a notification from a healthcare organization reporting that many servers and endpoints had been encrypted and a large amount of data stolen.
More than 200 victims had appeared on INC Ransom's data leak site by mid-2025.
Beginning in January 2025, ACSC observed INC Ransom affiliates targeting Australian healthcare entities using compromised accounts. Affiliates created administrator-level accounts and moved laterally within victim networks; some incidents involved theft of personal and medical information.
Vanilla Tempest adopted INC Ransom as its primary ransomware payload after previously using BlackCat, Quantum Locker, Zeppelin, and Rhysida.
INC Ransom emerged in mid-2023 and began compromising organizations worldwide through its ransomware-as-a-service affiliate network. The financially motivated group is also tracked as Tarnished Scorpion and GOLD IONIC.
ACSC, CERT Tonga, and New Zealand's NCSC issued a joint advisory detailing INC Ransom's affiliate model, regional healthcare attacks, and recommended mitigations. It reported 11 Australian incidents handled between July 2024 and December 2025 and identified Roman Khubov, also known as “blackod,” as controlling the data-exfiltration infrastructure used in the Tonga incident.
INC Ransom targeted Alder Hey Children's NHS Foundation Trust in the United Kingdom and claimed to have obtained patient records, donor reports, and procurement data.
The Pennsylvania Office of the Attorney General refused to pay the ransom following the breach claimed by INC Ransom.
INC Ransom claimed responsibility for the New Zealand healthcare incident reported to NCSC and published the stolen dataset on its data leak site.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.
2 references tracked. Mallory keeps watching after this page renders.
thecyberexpress.com
Open sourcecyber.gov.au
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Cybersecurity authorities in **Australia, New Zealand, and Tonga** issued a joint advisory warning that the **INC ransomware** operation is actively targeting organizations across Oceania, with a pronounced impact on **healthcare** and other critical networks. Reporting highlights serious disruptions affecting 24/7 patient-care environments and notes that INC has expanded its operations globally while increasing focus on the region, prompting coordinated guidance from the **ACSC**, **New Zealand NCSC**, and **CERT Tonga**. The advisory and follow-on analysis describe INC as a **Ransomware-as-a-Service (RaaS)** ecosystem that uses a distributed **affiliate model**, enabling multiple operators to deploy the ransomware while core actors manage extortion and payments. Defenders are urged to review the mitigation measures in the joint guidance, as the campaign reflects both the scale of INC’s affiliate-driven operations and the elevated risk to essential services—particularly healthcare providers—across Australia, New Zealand, and Pacific Island states.
Jun 29, 2026
INC ransomware has grown into one of the most active **ransomware-as-a-service** operations, with researchers attributing its rise to aggressive affiliate expansion, broad victim targeting, and effective use of established intrusion methods rather than novel exploits. The group, active since 2023 and linked to more than **800 claimed victims**, uses **double extortion** by encrypting systems and threatening to leak stolen data, with early concentration on healthcare and other high-pressure sectors now expanding into education, legal, manufacturing, construction, and technology organizations. Researchers said INC has upgraded both its **Windows** and **Linux/ESXi** encryptors by rewriting them in **Rust**, improving cross-platform operations and resilience while affiliates continue to rely on spearphishing, stolen credentials, and exploitation of known flaws including **Citrix Bleed 2**, **Citrix NetScaler**, **SimpleHelp RMM**, and **Fortinet EMS** vulnerabilities. Post-compromise activity has included abuse of legitimate remote administration tools, credential theft from **Veeam** environments, living-off-the-land lateral movement, use of EDR killers, and cloud-based exfiltration with tools such as **rclone**; analysts also linked INC code to related strains including **Lynx**, **Sinobi**, and **Knoba** after the group’s source code was reportedly sold to multiple parties.
Jul 23, 2026
Researchers published new intelligence on **INC Ransom**, outlining a victim negotiation platform allegedly exposed at `178.20.41.208:1002` and describing a stack built on **nginx**, **Yii/PHP**, and a **React/Redux/Socket.io** frontend. The reporting says the group’s infrastructure spans clear-web and onion sites with repeated overlap in Russian hosting, and that INC has operated since 2023, listed more than **870 victims**, and may share code or branding lineage with **Lynx** and possibly **Sinobi**. Separate technical reporting described INC as a **multi-extortion** operation that primarily targets healthcare, industrial, and education organizations in the U.S. and Europe, using living-off-the-land tools such as **NETSCAN.EXE**, **AnyDesk**, and `SystemSettingsAdminFlows.exe`, along with Defender tampering and a custom `av.exe` utility to disable EDR protections. At the same time, multiple new victim claims attributed to **incransom** surfaced, affecting organizations in nonprofit services, manufacturing, healthcare support, and other sectors across the **United States, Mexico, and Switzerland**. Reported victims included **Foundations to Freedom** in Florida, **DUCON** in Colorado, **minigrip.com.mx** in Mexico, **Della Casa Group AG** in Switzerland, and a Minnesota-based residential care provider associated with **eclmn.com**. The victim summaries describe unauthorized access to confidential files including client data, financial records, R&D material, and project information; in the Swiss case, the leak allegedly involved **86,332 files** in **15,359 folders** totaling about **240 GB**, underscoring INC Ransom’s continued emphasis on data theft and public leak pressure alongside encryption.
Jul 29, 2026