sign in--:--:--UTC

Incransom

Reports

48

First seen

May 12

Last seen

Jun 26

Motivation

extortion, financial, financial extortion

Targeting

Sectors

manufacturing ×12professional services ×6healthcare ×3financial services ×2other ×2technology ×2agriculture ×2media entertainment ×1

Victim regions

United States ×17Spain ×2Germany ×1Czechia ×1Türkiye ×1Switzerland ×1Romania ×1Australia ×1

Top ATT&CK techniques

T1005 Data from Local System ×2T1486 Data Encrypted for Impact ×2T1041 Exfiltration Over C2 Channel ×2T1110 Brute Force ×1T1078 Valid Accounts ×1T1021 Remote Services ×1T1567 Exfiltration Over Web Service ×1T1003 OS Credential Dumping ×1T1190 Exploit Public-Facing Application ×1

Indicators

domain ×77ip_v4 ×43url ×3hash_md5 ×2hash_sha1 ×1email ×1cve ×1

Indicator values are available on Pro and via the API.

Associated CVEs

CVE-2026-20131 (exploited)

Recent reports

Incransom claims new victim: callhorton.com

ransomware.liveJun 26 High

Incransom publishes johndufourlaw.com as new victim

ransomware.liveJun 26 High

Incransom ransomware gang publishes The Swanson Law Group as victim

ransomware.liveJun 26 High

Incransom publishes Life Bridges as ransomware victim

ransomware.liveJun 26 High

Incransom claims GSP Crop Science Pvt victim on ransomware.live

ransomware.liveJun 26 High

Incransom publishes horizoneye.com as ransomware victim

ransomware.liveJun 24 High

Incransom publishes Belpointe Asset Management as ransomware victim

ransomware.liveJun 23 Medium

Incransom publishes jktornel as ransomware victim

ransomware.liveJun 21 High

Incransom publishes Newspaper Media Group as ransomware victim

ransomware.liveJun 20 Critical

Incransom claims breach of Horizon Family Medical Group, 7TB exfiltrated

ransomware.liveJun 18 High

Incransom publishes NEUWOGES (Neubrandenburger Wohnungsgesellschaft) as ransomware victim

ransomware.liveJun 18 High

Incransom claims Jasper Plastics Solutions in ransomware extortion

ransomware.liveJun 16 High

Incransom claims Framesi Professional as new victim

ransomware.liveJun 16 High

Incransom publishes Smith and Associates CPA as ransomware victim

ransomware.liveJun 15 High

Incransom claims Kewaunee Scientific victim on ransomware.live

ransomware.liveJun 11 High

Incransom claims Signazon USA printing company as ransomware victim

ransomware.liveJun 11 Medium

Incransom publishes DISCOLABINDU as ransomware victim

ransomware.liveJun 11 High

Incransom publishes fineconsulting as new victim

ransomware.liveJun 11 High

Incransom publishes FIZA, Czech auditing firm, as ransomware victim

ransomware.liveJun 10 High

Incransom publishes kelmreuter.com as new victim

ransomware.liveJun 6 High

Incransom publishes O'Brien Engineering as ransomware victim

ransomware.liveJun 5 High

Incransom publishes Stuga Machinery as victim on ransomware.live

ransomware.liveJun 4 Medium

Incransom publishes new victim: pdcbodynits

ransomware.liveJun 4 High

Incransom claims new victim: CUSTOMSIGN

ransomware.liveJun 4 High

Incransom publishes Colina Financial Advisors as ransomware victim

ransomware.liveJun 3 High

Incransom claims breach of Öztuğ Otomotiv, Turkish automotive supplier

ransomware.liveJun 3 Medium

Incransom claims victim: trrac.net

ransomware.liveJun 2 High

Incransom publishes Bradley law firm as ransomware victim

ransomware.liveJun 1 High

Incransom publishes Champaign-Urbana Public Health District as ransomware victim

ransomware.liveJun 1 High

Incransom publishes Labexpress and Garonit Pharma breach: 200 GB exfiltrated

ransomware.liveMay 30

This page shows data on a 7-day delay. Free accounts get the full delayed feed; real-time reports, indicators, and the API start at $29/mo.

Sign up See plans