INC Ransom
Also known as Incransom, INC, Inc, INC ransomware, INC Ransom, INC Ransom Group, Lynx
Reports
207
First seen
Aug 11, 2023
Last seen
Oct 16, 2026
Motivation
Financial
Relationships
Filled ◆ = CVE exploited in the wild. Entities that appear together in Signalis reporting — co-mention, not confirmed collaboration. Reports naming many actors at once (weekly roundups) are excluded from relationship edges.
Targeting
Sectors
Victim regions
×2×64
United States×64
Germany×6
Brazil×6
Spain×4
Australia×3
Switzerland×3
Malaysia×3
South Africa×2
Victim country, only when stated. Corpus is predominantly English-language reporting, so US/EU coverage is overweighted relative to true victim distribution.
Top ATT&CK techniques
T1486 Data Encrypted for Impact ×16T1190 Exploit Public-Facing Application ×8T1041 Exfiltration Over C2 Channel ×8T1562.001 Impair Defenses: Disable or Modify Tools ×7T1110 Brute Force ×7T1078 Valid Accounts ×7T1005 Data from Local System ×6T1021.002 SMB/Windows Admin Shares ×6T1566 Phishing ×5T1219 Remote Access Software ×5T1133 External Remote Services ×5T1567 Exfiltration Over Web Service ×4
Indicators
domain ×283ip_v4 ×81filename ×54cve ×22hash_sha256 ×11url ×6hash_md5 ×6hash_sha1 ×5email ×1
Indicator values are available on Pro and via the API.
Associated CVEs
CVE-2026-15409 (exploited)CVE-2026-15410 (exploited)CVE-2022-40684 (exploited)CVE-2024-1709 (exploited)CVE-2024-57727 (exploited)CVE-2025-5777 (exploited)CVE-2026-20131 (exploited)CVE-2026-33825 (exploited)CVE-2026-35616 (exploited)CVE-2026-50751 (exploited)CVE-2026-50752CVE-2026-56155 (exploited)CVE-2026-56164 (exploited)CVE-2026-60137 (exploited)CVE-2026-63030 (exploited)CVE-2026-83548 (exploited)CVE-2026-83549 (exploited)CVE-2023-3519 (exploited)CVE-2023-48788 (exploited)
Recent reports
High