← All threat actorsThreat actors

INC Ransom

1CVEs
28Techniques
15Tools
7Leak sites

Overview

INC Ransom is a prolific ransomware-as-a-service operation active since July 2023 that systematically targets healthcare, government, education, and manufacturing sectors in North America and Europe, having posted over 200 victims in 2025 alone with no sector off-limits.

What public reporting says

  • INC Ransom appeared in August 2023. Its source code was reportedly offered for sale in 2024 for USD 300,000, and the Lynx operation that followed shares large parts of its code and even registration details of its leak sites. Cyrillic comments in tooling hint at a possible Russian-speaking origin, which remains unproven.

BankInfoSecurity · SC Media

Geography: origin and targets

United States of America: 538Canada: 50Germany: 42United Kingdom: 39Australia: 26Brazil: 15Italy: 12France: 12Spain: 11Austria: 10Taiwan, Province of China: 9South Africa: 8Mexico: 8United Arab Emirates: 8Singapore: 8Netherlands: 7

No public attribution of origin. Lines are drawn only where public reporting places the operators; flags show where the group has claimed victims, sized by number of claims.

  1. United States of America538
  2. Canada50
  3. Germany42
  4. United Kingdom39
  5. Australia26
  6. Brazil15
  7. Italy12
  8. France12
  9. Spain11
  10. Austria10

Exploited vulnerabilities

VendorProductCVECategorySource
CitrixNetScaler ADC & GatewayCVE-2023-4966Virtualizationdoublepulsar.com, bleepingcomputer.com, therecord.media, secureworks.com, microsoft.com

ATT&CK techniques

Columns are ATT&CK tactics; each cell is a technique reported for this group in public sources. A technique appearing here means it has been reported for the group, not that it was used in any particular incident, and an empty cell is not evidence that the group does not use it.

Initial AccessExecutionPersistencePrivilege EscalationStealthDiscoveryLateral MovementCollectionExfiltrationCommand and ControlImpactResource DevelopmentDefense Impairment
Valid AccountsWindows Management InstrumentationValid AccountsValid AccountsMasquerading: Match Legitimate Resource Name or LocationNetwork Service DiscoveryRemote Services: Remote Desktop ProtocolData StagedTransfer Data to Cloud AccountApplication Layer ProtocolData Encrypted for ImpactObtain Capabilities: ToolDisable or Modify Tools
Exploit Public-Facing ApplicationCommand and Scripting Interpreter: Windows Command ShellIndicator Removal: File DeletionSystem Network Connections DiscoveryLateral Tool TransferArchive Collected Data: Archive via UtilityIngress Tool TransferFinancial Theft
PhishingSystem Services: Service ExecutionValid AccountsPermission Groups Discovery: Domain GroupsRemote Access Tools
Account Discovery: Domain Account
Network Share Discovery

Technique details

Initial Access (TA0001)
  • T1078 · Valid Accounts: INC Ransom has used compromised valid accounts for access to victim environments.
  • T1190 · Exploit Public-Facing Application: INC Ransom has exploited known vulnerabilities including CVE-2023-3519 in Citrix NetScaler for initial access.
  • T1566 · Phishing: INC Ransom has used phishing to gain initial access.
Execution (TA0002)
  • T1047 · Windows Management Instrumentation: INC Ransom has used WMIC to deploy ransomware.
  • T1059.003 · Command and Scripting Interpreter: Windows Command Shell: INC Ransom has used `cmd.exe` to launch malicious payloads.
  • T1569.002 · System Services: Service Execution: INC Ransom has run a file encryption executable via `Service Control Manager/7045;winupd,%SystemRoot%\winupd.exe,user mode service,demand start,LocalSystem`.
Persistence (TA0003)
  • T1078 · Valid Accounts: INC Ransom has used compromised valid accounts for access to victim environments.
Privilege Escalation (TA0004)
  • T1078 · Valid Accounts: INC Ransom has used compromised valid accounts for access to victim environments.
Stealth (TA0005)
  • T1036.005 · Masquerading: Match Legitimate Resource Name or Location: INC Ransom has named a PsExec executable winupd to mimic a legitimate Windows update file.
  • T1070.004 · Indicator Removal: File Deletion: INC Ransom has uninstalled tools from compromised endpoints after use.
  • T1078 · Valid Accounts: INC Ransom has used compromised valid accounts for access to victim environments.
Discovery (TA0007)
  • T1046 · Network Service Discovery: INC Ransom has used NETSCAN.EXE for internal reconnaissance.
  • T1049 · System Network Connections Discovery: INC Ransom has used RDP to test network connections.
  • T1069.002 · Permission Groups Discovery: Domain Groups: INC Ransom has enumerated domain groups on targeted hosts.
  • T1087.002 · Account Discovery: Domain Account: INC Ransom has scanned for domain admin accounts in compromised environments.
  • T1135 · Network Share Discovery: INC Ransom has used Internet Explorer to view folders on other systems.
Lateral Movement (TA0008)
  • T1021.001 · Remote Services: Remote Desktop Protocol: INC Ransom has used RDP to move laterally.
  • T1570 · Lateral Tool Transfer: INC Ransom has used a rapid succession of copy commands to install a file encryption executable across multiple endpoints within compromised infrastructure.
Collection (TA0009)
  • T1074 · Data Staged: INC Ransom has staged data on compromised hosts prior to exfiltration.
  • T1560.001 · Archive Collected Data: Archive via Utility: INC Ransom has used 7-Zip and WinRAR to archive collected data prior to exfiltration.
Exfiltration (TA0010)
  • T1537 · Transfer Data to Cloud Account: INC Ransom has used Megasync to exfiltrate data to the cloud.
Command and Control (TA0011)
  • T1071 · Application Layer Protocol: INC Ransom has used valid accounts over RDP to connect to targeted systems.
  • T1105 · Ingress Tool Transfer: INC Ransom has downloaded tools to compromised servers including Advanced IP Scanner.
  • T1219 · Remote Access Tools: INC Ransom has used AnyDesk and PuTTY on compromised systems.
Impact (TA0040)
  • T1486 · Data Encrypted for Impact: INC Ransom has used INC Ransomware to encrypt victim's data.
  • T1657 · Financial Theft: INC Ransom has stolen and encrypted victim's data in order to extort payment for keeping it private or decrypting it.
Resource Development (TA0042)
  • T1588.002 · Obtain Capabilities: Tool: INC Ransom has acquired and used several tools including MegaSync, AnyDesk, esentutl and PsExec.
Defense Impairment (TA0112)
  • T1685 · Disable or Modify Tools: INC Ransom can use SystemSettingsAdminFlows.exe, a native Windows utility, to disable Windows Defender.

Tools

Credential theft
  • Mimikatz
Discovery
  • AdFind
  • Advanced IP Scanner
  • SoftPerfect NetScan
Exfiltration
  • 7-Zip
  • BackBlaze
  • MEGA
  • RClone
  • Restic
  • WinRAR
  • s5cmd
Living off the land
  • Finger
  • PsExec
Networking and tunnelling
  • Bitvise SSH Client
Remote management tools
  • AnyDesk

Leak-site infrastructure

TitleTypeAddress (defanged)Seen online at snapshot
DisclosuresDLSincblog6qu4y4mm4zvw5nrmue6qbwtgjsxpw6b7ixzssu36tsajldoad[.]onionYes
—DLSincbackrlasjesgpfu5brktfjknbqoahe2hhmqfhasc5fb56mtukn4yd[.]onionNo
INC RansomDLSincapt[.]blogNo
Error Response PageDLSincapt[.]suNo
Error Response PageDLSincbackend[.]topNo
—DLSincbacg6bfwtrlzwdbqc55gsfl763s3twdtwhp27dzuik6s6rwdcityd[.]onionYes
INC RansomDLSincblog7vmuq7rktic73r4ha4j757m3ptym37tyvifzp2roedyyzzxid[.]onionNo

Sources and caveats

Group descriptions, ATT&CK mappings, tools and leak-site locations come from public ransomware tracking projects, including ransomware.live and Crocodyli. Exploited vulnerabilities come from the Ransomware-Vulnerability-Matrix by BushidoUK (licensed CC BY 4.0), supplemented where a group profile there is newer than the data we hold. Each CVE links to its original research source. Technical text is shown in English as published. Leak-site addresses are defanged and shown for blocking and detection; do not visit them. Nothing here is verified by ClairSec_ against a specific incident.

Data snapshot: 2026-10-11