Home / Threat actors / INC Ransom
INC Ransom G1032
Also known as: GOLD IONIC
Updated at source on Jul 31, 2026 · View on MITRE ATT&CK
1
associated CVEs
28
Techniques
8
Malware and tools
INC Ransom is a ransomware and data extortion threat group associated with the deployment of INC Ransomware that has been active since at least July 2023. INC Ransom has targeted organizations worldwide most commonly in the industrial, healthcare, and education sectors in the US and Europe.
Ransomware operations linked to this group ransomware.live
incransomExploited vulnerabilities
CVEs cited by MITRE ATT&CK for this group, with the source excerpt. Records not yet published here appear without a link.
CVE-2023-3519
Critical · 9.8
KEV Ransomware Citrix NetScaler ADC and NetScaler Gateway Code Injection Vulnerability
“INC Ransom has exploited known vulnerabilities including CVE-2023-3519 in Citrix NetScaler for initial access.”
Techniques by tactic
Resource Development
T1588.002 Tool Initial Access
T1078 Valid AccountsT1190 Exploit Public-Facing ApplicationT1566 Phishing Execution
T1047 Windows Management InstrumentationT1059.003 Windows Command ShellT1569.002 Service Execution Persistence
T1078 Valid Accounts Privilege Escalation
T1078 Valid Accounts Stealth
T1036.005 Match Legitimate Resource Name or LocationT1070.004 File DeletionT1078 Valid Accounts Defense Impairment
T1685 Disable or Modify Tools Discovery
T1046 Network Service DiscoveryT1049 System Network Connections DiscoveryT1069.002 Domain GroupsT1087.002 Domain AccountT1135 Network Share Discovery Lateral Movement
T1021.001 Remote Desktop ProtocolT1570 Lateral Tool Transfer Collection
T1074 Data StagedT1560.001 Archive via Utility Command and Control
T1071 Application Layer ProtocolT1105 Ingress Tool TransferT1219 Remote Access Tools Exfiltration
T1537 Transfer Data to Cloud Account Impact
T1486 Data Encrypted for ImpactT1657 Financial Theft © The MITRE Corporation. ATT&CK® content reproduced and distributed with the permission of The MITRE Corporation.