sign in--:--:--UTC

INC

Also known as INC Ransom, INC Ransom Group

Reports

9

First seen

Aug 11

Last seen

Jun 18

Motivation

financial, ransomware

Targeting

Sectors

other ×2

Victim regions

United States ×1

Top ATT&CK techniques

T1486 Data Encrypted for Impact ×7T1562.001 Impair Defenses: Disable or Modify Tools ×5T1021.002 SMB/Windows Admin Shares ×4T1560.001 Archive via Utility ×3T1078 Valid Accounts ×3T1566 Phishing ×3T1567.002 Exfiltration Over Web Service: Exfiltration to Cloud Storage ×3T1567 Exfiltration Over Web Service ×3T1219 Remote Access Software ×3T1218 System Binary Proxy Execution ×2T1078.002 Valid Accounts ×2T1021 Remote Services ×2

Indicators

filename ×49cve ×5hash_sha256 ×5domain ×3url ×1

Indicator values are available on Pro and via the API.

Associated CVEs

CVE-2023-3519 (exploited)CVE-2023-48788 (exploited)CVE-2024-1709 (exploited)CVE-2024-57727 (exploited)CVE-2025-5777 (exploited)

Recent reports

INC Ransomware Emerges as Major RaaS Threat with 830+ Victims Since 2023

The Hacker NewsJun 18 Critical

Microsoft disrupts Fox Tempest malware-signing-as-a-service platform tied to ransomware gangs

The Record (Recorded Future News)May 19 High

Microsoft disrupts Fox Tempest code-signing service used by ransomware groups

CyberScoopMay 19 High

INC Ransomware Deployment: Data Exfiltration via Restic and EDR Bypass Techniques

Huntress BlogMar 12 Medium

Exposing Data Exfiltration: Techniques and Detection Challenges in Ransomware Attacks

Huntress BlogAug 19 High

Time to Ransom is Money: Analyzing Ransomware Deployment Timelines

Huntress BlogMay 13 High

Top 3 Cybersecurity Threats of 2024: RMM Abuse, BYOVD Attacks, and WebDAV Abuse

Huntress BlogOct 8 High

INC Ransomware Deployment Preceded by LOLBin Defense Evasion

Huntress BlogMay 1 High

Investigating New INC Ransom Group Activity

Huntress BlogAug 11

This page shows data on a 7-day delay. Free accounts get the full delayed feed; real-time reports, indicators, and the API start at $29/mo.

Sign up See plans