Loading story…
Panama's Ministry of Economy and Finance (MEF) disclosed a cyber incident involving a compromised workstation, which was quickly contained according to official statements. The INC Ransom group has claimed responsibility, alleging theft of over 1.5 TB of sensitive data, including emails and financial documents, and has published samples as proof. MEF asserts that core systems remain unaffected and has not confirmed the extent of the data breach claimed by the attackers.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
1 event from the most recent confirmed update back to the earliest known activity.
Initial story creation
3 references tracked. Mallory keeps watching after this page renders.
securityaffairs.com
Open sourcescworld.com
Open sourcebleepingcomputer.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
The INC Ransom ransomware group claimed responsibility for a cyberattack on the Pennsylvania Office of the Attorney General, alleging the theft of 5.7 TB of data. Data samples purportedly stolen from the office were posted on INC's leak site, though the state has not confirmed the extent of the breach and has refused to pay the ransom. This incident is notable as the largest reported data theft from a U.S. government entity in 2025, according to security researchers. The attack highlights the growing threat posed by the INC Ransom group, which has targeted multiple high-profile organizations in recent months.
Jun 29, 2026
Researchers published new intelligence on **INC Ransom**, outlining a victim negotiation platform allegedly exposed at `178.20.41.208:1002` and describing a stack built on **nginx**, **Yii/PHP**, and a **React/Redux/Socket.io** frontend. The reporting says the group’s infrastructure spans clear-web and onion sites with repeated overlap in Russian hosting, and that INC has operated since 2023, listed more than **870 victims**, and may share code or branding lineage with **Lynx** and possibly **Sinobi**. Separate technical reporting described INC as a **multi-extortion** operation that primarily targets healthcare, industrial, and education organizations in the U.S. and Europe, using living-off-the-land tools such as **NETSCAN.EXE**, **AnyDesk**, and `SystemSettingsAdminFlows.exe`, along with Defender tampering and a custom `av.exe` utility to disable EDR protections. At the same time, multiple new victim claims attributed to **incransom** surfaced, affecting organizations in nonprofit services, manufacturing, healthcare support, and other sectors across the **United States, Mexico, and Switzerland**. Reported victims included **Foundations to Freedom** in Florida, **DUCON** in Colorado, **minigrip.com.mx** in Mexico, **Della Casa Group AG** in Switzerland, and a Minnesota-based residential care provider associated with **eclmn.com**. The victim summaries describe unauthorized access to confidential files including client data, financial records, R&D material, and project information; in the Swiss case, the leak allegedly involved **86,332 files** in **15,359 folders** totaling about **240 GB**, underscoring INC Ransom’s continued emphasis on data theft and public leak pressure alongside encryption.
Jul 29, 2026
A reported operational security failure by the **INC ransomware** group enabled incident responders to identify attacker infrastructure and recover data stolen from **12 U.S. organizations**. A forensic review of artifacts from an intrusion—initially detected when ransomware encryption activity hit a production **SQL Server**—revealed infrastructure that stored exfiltrated victim data beyond the single investigated case, allowing broader recovery efforts. Cyber Centaurs (DFIR) traced the intrusion to a *RainINC* ransomware variant staged and executed from the Windows `PerfLogs` directory, a location increasingly abused by threat actors for staging. Investigators found renamed binaries (e.g., `winupdate.exe`) and PowerShell tooling, including a script (`new.ps1`) containing Base64-encoded *Restic* commands and hardcoded environment variables (e.g., access keys, repository paths, and S3 passwords) tied to encrypted repositories; although *Restic* was not used in the specific attack, these remnants shifted the work from incident response to infrastructure analysis and ultimately exposed reusable attacker storage repositories linked to multiple victims.
Jun 29, 2026