Home / Ransomware Intelligence / All groups / incransom

incransom Ransomware

🔔 Create alert

Also known as: Inc Ransom · Tracked since Aug 9, 2023

3

victims recorded

3

in the last 30 days

1

CVEs

1d

Last activity

In MITRE ATT&CK MITRE ATT&CK

Group profile: INC Ransom (G1032)

INC Ransom is a prolific ransomware-as-a-service operation active since July 2023 that systematically targets healthcare, government, education, and manufacturing sectors in North America and Europe, having posted over 200 victims in 2025 alone with no sector off-limits.

Vulnerabilities cited for this group

CVEs associated with the group by ransomware.live. Records not yet published here appear without a link.

CVE-2023-3519 Critical · 9.8 KEV Citrix NetScaler ADC and NetScaler Gateway Code Injection Vulnerability

Tactics and techniques (MITRE ATT&CK)

Initial Access

T1078 Valid Accounts T1190 Exploit Public-Facing Application T1566 Phishing

Execution

T1047 Windows Management Instrumentation T1059.003 Command and Scripting Interpreter: Windows Command Shell T1569.002 System Services: Service Execution

Persistence

T1078 Valid Accounts

Privilege Escalation

T1078 Valid Accounts

Stealth

T1036.005 Masquerading: Match Legitimate Resource Name or Location T1070.004 Indicator Removal: File Deletion T1078 Valid Accounts

Discovery

T1046 Network Service Discovery T1049 System Network Connections Discovery T1069.002 Permission Groups Discovery: Domain Groups T1087.002 Account Discovery: Domain Account T1135 Network Share Discovery

Lateral Movement

T1021.001 Remote Services: Remote Desktop Protocol T1570 Lateral Tool Transfer

Collection

T1074 Data Staged T1560.001 Archive Collected Data: Archive via Utility

Exfiltration

T1537 Transfer Data to Cloud Account

Command and Control

T1071 Application Layer Protocol T1105 Ingress Tool Transfer T1219 Remote Access Tools

Impact

T1486 Data Encrypted for Impact T1657 Financial Theft

Resource Development

T1588.002 Obtain Capabilities: Tool

Defense Impairment

T1685 Disable or Modify Tools

Observed tools

Credential Theft

Mimikatz

Discovery Enum

AdFind · Advanced IP Scanner · SoftPerfect NetScan

Exfiltration

7-Zip · BackBlaze · MEGA · RClone · Restic · WinRAR · s5cmd

LOLBAS

Finger · PsExec

Networking

Bitvise SSH Client

RMM-Tools

AnyDesk

Most affected countries (30 days)

United States1
India1
Brazil1

Most affected sectors (30 days)

Professional Services1
Financial Services1

Victims posted on leak sites, according to ransomware.live. Victim names are not displayed. · View on ransomware.live