INC Ransom

Overview

INC Ransom is a ransomware and data extortion threat group associated with the deployment of INC Ransomware that has been active since at least July 2023. INC Ransom has targeted organizations worldwide most commonly in the industrial, healthcare, and education sectors in the US and Europe.

Naming & attribution

INC Ransom is tracked under 2 names across the industry. It uses 25 documented ATT&CK techniques — more than 59% of the 174 groups tracked here.

Distinctive techniques

Techniques this group uses that are rare across the other 173 tracked groups — these carry more signal than the near-universal ones.

• T1537 Transfer Data to Cloud Account — used by 3 of 174 groups

Closest groups by technique overlap

Computed from shared ATT&CK techniques. Overlap is not attribution — distinct actors converge on the same tradecraft — but a high share is a useful pivot.

• Medusa Group — 17 shared techniques (26% overlap)
• BlackByte — 15 shared techniques (26% overlap)
• Akira — 8 shared techniques (24% overlap)
• Chimera China — 15 shared techniques (22% overlap)
• menuPass China — 13 shared techniques (22% overlap)
• Play — 9 shared techniques (21% overlap)

Capabilities

• Exploitation of public-facing / client applications — ATT&CK T1190

TTPs — 25 techniques across 11 tactics

Tools & malware (8)

Tor · PsExec · Nltest · Rclone · AdFind · Net · esentutl · INC Ransomware

Reporting (3)

• GOLD IONIC DEPLOYS INC RANSOMWARE — Counter Threat Unit Research Team
• INC Ransom threatens to leak 3TB of NHS Scotland stolen data — Toulas, B
• Threat Alert: INC Ransomware — Cybereason Security Research Team