incransom Ransomware
Também conhecido como: Inc Ransom · Monitorado desde 09/08/2023
3
vítimas registradas
3
nos últimos 30 dias
1
CVEs
1 d
Última atividade
No MITRE ATT&CK MITRE ATT&CK
Perfil do grupo: INC Ransom (G1032)
INC Ransom is a prolific ransomware-as-a-service operation active since July 2023 that systematically targets healthcare, government, education, and manufacturing sectors in North America and Europe, having posted over 200 victims in 2025 alone with no sector off-limits.
Vulnerabilidades citadas para este grupo
CVEs associadas ao grupo pelo ransomware.live. Fichas ainda não publicadas aparecem sem link.
- CVE-2023-3519 Crítica · 9.8 KEV Citrix NetScaler ADC and NetScaler Gateway Code Injection Vulnerability
Táticas e técnicas (MITRE ATT&CK)
Initial Access
T1078 Valid AccountsT1190 Exploit Public-Facing ApplicationT1566 Phishing Execution
T1047 Windows Management InstrumentationT1059.003 Command and Scripting Interpreter: Windows Command ShellT1569.002 System Services: Service Execution Persistence
T1078 Valid Accounts Privilege Escalation
T1078 Valid Accounts Stealth
T1036.005 Masquerading: Match Legitimate Resource Name or LocationT1070.004 Indicator Removal: File DeletionT1078 Valid Accounts Discovery
T1046 Network Service DiscoveryT1049 System Network Connections DiscoveryT1069.002 Permission Groups Discovery: Domain GroupsT1087.002 Account Discovery: Domain AccountT1135 Network Share Discovery Lateral Movement
T1021.001 Remote Services: Remote Desktop ProtocolT1570 Lateral Tool Transfer Collection
T1074 Data StagedT1560.001 Archive Collected Data: Archive via Utility Exfiltration
T1537 Transfer Data to Cloud Account Command and Control
T1071 Application Layer ProtocolT1105 Ingress Tool TransferT1219 Remote Access Tools Impact
T1486 Data Encrypted for ImpactT1657 Financial Theft Resource Development
T1588.002 Obtain Capabilities: Tool Defense Impairment
T1685 Disable or Modify Tools Ferramentas observadas
Credential Theft
Mimikatz
Discovery Enum
AdFind · Advanced IP Scanner · SoftPerfect NetScan
Exfiltration
7-Zip · BackBlaze · MEGA · RClone · Restic · WinRAR · s5cmd
LOLBAS
Finger · PsExec
Networking
Bitvise SSH Client
RMM-Tools
AnyDesk
Países mais afetados (30 dias)
- Estados Unidos1
- Índia1
- Brasil1
Setores mais afetados (30 dias)
- Professional Services1
- Financial Services1
Vítimas divulgadas em sites de vazamento, segundo o ransomware.live. Não exibimos nomes de vítimas. · Ver no ransomware.live