INC RansomwareMalware
INC Ransomware is a ransomware strain that has been used by the INC Ransom group since at least 2023 against multiple industry sectors worldwide. INC Ransomware can employ partial encryption combined with multi-threading to speed encryption.From MITRE ATT&CK
Last reported yesterday, by ransomware.live8 reports
ATT&CK techniques
6 of 18 · each with the sentence it comes from- T1021.001Remote Desktop Protocol
“They also employ remote desktop protocol (RDP) to expand their presence within the compromised network.”
- T1110Brute Force
“These include credential exposure, implementing brute force password attacks, exploiting virtual private network (VPN) access and exploiting vulnerabilities in edge device products.”
- T1219Remote Access Tools
“Inventory remote-access tools such as SimpleHelp, MeshCentral and N-central, patch them, restrict their use and block unauthorized software”
- T1027.002Software Packing
“SafePay actors typically disable security software to avoid detection, and have also been observed using software packing or virtual machine software protection to conceal their code.”
- T1027.006HTML Smuggling
“A separate delivery service supports phishing through malicious Word templates and HTML smuggling, persisting through a scheduled task named RealtekAudioSvc; its only recorded campaign was an internal self-test.”
- T1053.005Scheduled Task
“A separate delivery service supports phishing through malicious Word templates and HTML smuggling, persisting through a scheduled task named RealtekAudioSvc; its only recorded campaign was an internal self-test.”
Reports per month
last 12 monthsOctober so far (hatched). Counted by report, not by story.
What the reports say
8 reports, newest first · the exact sentence from each-
emperador lists JS Constructor, INC“emperador lists JS Constructor, INC Ransomware group emperador listed JS Constructor, INC on its leak site.”
-
SafePay Has Compromised 600 Critical Infrastructure Victims Worldwide, CISA Warns“It is believed that SafePay may be a rebrand of several other well-known groups – LockBit, ALPHV/BlackCat and INC Ransomware.”
-
Qilin and INC Ransomware Groups Exploit Palo Alto Networks Flaw to Bypass MFA“Qilin and INC Ransomware Groups Exploit Palo Alto Networks Flaw to Bypass MFA”
-
Qilin and INC Ransomware Groups Exploit Palo Alto Networks Flaw to Bypass MFA“Qilin and INC Ransomware Groups Exploit Palo Alto Networks Flaw to Bypass MFA”
-
INC and The Gentlemen Ransomware: Exposed AI Infrastructure“SOCRadar Threat Research Unit (STRU) has uncovered an AI-driven intrusion ecosystem run by affiliates of the INC Ransomware and The Gentlemen Ransomware groups.”
-
akira lists PIC GROUP, INC“akira lists PIC GROUP, INC Ransomware group akira listed PIC GROUP, INC on its leak site.”
-
Attack Behaviors“For example, consider Figures 4 and 5 of the LOLBin to INC Ransomware blog, published on May 1, 2024.”
-
LOLBin to INC Ransomware“LOLBin to INC Ransomware”
Indicators in its reports
named in the reports above- hxxps://webhook[.]sitein 1 report
- 36eb4290aa11a950…e1ea94f39445in 1 report
- fc39cca5d71b1a9e…0dba90847851in 1 report
- 45.227.254[.]43in 1 report
- trulitesupport[.]comin 1 report
- 45.227.254[.]45in 1 report
- api.iquickline[.]comin 1 report
Copy these 7 indicators · defanged
Thanks — we review every report.