INC RansomThreat actor
- gold ionic
INC Ransom is a ransomware and data extortion threat group associated with the deployment of INC Ransomware that has been active since at least July 2023. INC Ransom has targeted organizations worldwide most commonly in the industrial, healthcare, and education sectors in the US and Europe.From MITRE ATT&CK
Last reported 3 days ago, by SecurityWeek10 reports
ATT&CK techniques
6 of 32 · each with the sentence it comes from- T1021.001Remote Desktop Protocol
“Lateral Movement - Remote Services/T1021.001, T1021.002”
- T1021.002SMB/Windows Admin Shares
“Remote Services: SMB/Windows Admin Shares (T1021.002)”
- T1059Command and Scripting Interpreter
“Command and Scripting Interpreter (T1059)”
- T1078.002Domain Accounts
“(T1078.002)”
- T1486Data Encrypted for Impact
“Data Encrypted for Impact (T1486)”
- T1003OS Credential Dumping
“Credential Access - OS Credential Dumping/T1003.001”
Reports per month
last 12 monthsOctober so far (hatched). Counted by report, not by story.
What the reports say
10 reports, newest first · the exact sentence from each-
High-Severity Flaws Exploited in Three Days as Ransomware Dominates Q3: Rapid7“INC Ransom was third with 99, followed by DeadLock (98), and Krybit (95).”
-
Grocery giant Ahold Delhaize confirms cyberattack forced US and European systems offline“INC Ransom claimed responsibility for the attack at the time and leaked some documents reportedly taken from the retailer's systems.”
-
Cyberattack Prompts Ahold Delhaize to Disconnect Systems“In April 2025, just as the INC Ransom ransomware group took credit for the incident, the company confirmed that data was stolen from its systems.”
-
Ransomware Attacks Reach Record High for 2026“Some of the other most prolific ransomware groups during the reporting period were Clop (89 attributions), Dire Wolf (43) and INC Ransom (43).”
-
The Tale of Two INC Ransom Notes: A Ransomware Timeline“The Tale of Two INC Ransom Notes: A Ransomware Timeline”
-
July 2026 Ransomware Trend Report“… groups such as The Gentlemen, DragonForce, Nova, Gunra, Everest, krybit, LockBit (LockBit 5.0), Qilin, Chaos, ShinyHunters, Morpheus, INC Ransom, and Coinbase Cartel continued their activities, while new data-stealing and ransomware groups—including Gammax, SECTION9, ExfilSquad,…”
-
Ransomware in 2026: Same Business, New Rules“INC Ransom”
-
A New Ransomware Threat Actor Emerges Every Week, Warns Report“This period was dominated by Qilin, which claimed 1358 victims, followed by Akira (749) INC Ransom (436), Play (422) and SafePay (324).”
-
The beginning of the end: the story of Hunters International“Group-IB’s Threat Intelligence analysis discovered that Hunters International, Lynx and INC Ransom have similarities in the infrastructure, but there is no evidence that could suggest these ransomware brands belong to the same operation.”
-
Investigating New INC Ransom Group Activity“Investigating New INC Ransom Group Activity”
Indicators in its reports
named in the reports above- throughoutes[.]netin 1 report
- 213.111.185[.]108in 1 report
- accd8bc0d0c2675c…37afc57c289cin 1 report
- 45.8.228[.]240in 1 report
- huntersinternational[.]suin 1 report
- 45.135.233[.]154in 1 report
- lynxblog[.]netin 1 report
- incblog[.]suin 1 report
- huntersinternational[.]bondin 1 report
- huntersinternational[.]ltdin 1 report
- huntersinternational[.]topin 1 report
- huntersinternational[.]vipin 1 report
- 193.106.175[.]48in 1 report
Copy these 13 indicators · defanged
Thanks — we review every report.