Loading threat actor…
INC Ransom is a financially motivated ransomware operation active since at least 2023 and commonly tracked under aliases including INC, INCRansom, Gold IONIC, INC Ransomware, and INC Ransomware Gang. It is associated with the ATT&CK group identifier G1032. The operation has been described as part of the broader ransomware-as-a-service ecosystem, with reporting also linking affiliates in the INC ecosystem to later activity involving other ransomware brands such as Lynx and DeadLock. INC Ransom conducts ransomware and data-theft extortion operations against organizations in multiple countries, with especially strong activity in North America and a repeated preference for professional services targets, particularly law firms. Confirmed victim reporting also shows targeting of healthcare, technology, manufacturing or industrial organizations, and remote-access infrastructure exposed to the internet. The United States appears to be its most prominent target, with additional victimization reported in Canada, Brazil, the United Kingdom, and Australia. The group is linked to exploitation of public-facing systems for initial access, including SSL VPN appliances and SonicWall SMA1000 devices, and has been associated with exploitation of internet-facing enterprise software and remote access gateways that provide footholds into internal networks. Its operators or affiliates have also been connected to use of AdFind for Active Directory and directory-service reconnaissance. Observed behavior supports a typical enterprise ransomware intrusion lifecycle: initial access through exposed edge infrastructure, internal reconnaissance, persistence through remote access tooling or affiliate tradecraft, data theft, and ransomware deployment for extortion. Reporting also links affiliates associated with the INC ecosystem to double-extortion operations in related ransomware activity, although the strongest direct evidence for INC itself is ransomware-driven extortion with accompanying data breach activity. Public victim-count reporting places INC Ransom among the more active ransomware brands in 2026.
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Who, where, and (when attributed) which flag flies behind the operation. Pulled from open-source reporting and Mallory's analyst review.
Sectors the actor has been observed targeting.
Geographies tied to known operations.
Attributed origin per open-source reporting.
50 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
5 malware families attributed to this actor across reporting.
17 CVEs this actor has used in observed campaigns. 17 of them exploited in the wild.
Resecurity estimates that the exploitation of CVE-2026-15409 and CVE-2026-15410 could significantly aid Initial Access Brokers (IABs) in gaining unauthorized access to targets of interest. Both vulnerabilities have been added to the CISA Known Exploited Vulnerabilities Catalog.
Resecurity estimates that the exploitation of CVE-2026-15409 and CVE-2026-15410 could significantly aid Initial Access Brokers (IABs) in gaining unauthorized access to targets of interest. Both vulnerabilities have been added to the CISA Known Exploited Vulnerabilities Catalog.
INC ransomware is known to gain access to their target victims through spear phishing, valid account credentials from Initial Access Brokers (IAB) and exploitation of vulnerabilities in public-facing applications such as CVE-2023-3519 (Citrix Netscaler), CVE-2023-48788 (Fortinet EMS), CVE-2024-57727 (SimpleHelp RMM) and CVE-2025-5777 (Citrix Bleed 2).
INC ransomware is known to gain access to their target victims through spear phishing, valid account credentials from Initial Access Brokers (IAB) and exploitation of vulnerabilities in public-facing applications such as CVE-2023-3519 (Citrix Netscaler), CVE-2023-48788 (Fortinet EMS), CVE-2024-57727 (SimpleHelp RMM) and CVE-2025-5777 (Citrix Bleed 2).
INC ransomware is known to gain access to their target victims through spear phishing, valid account credentials from Initial Access Brokers (IAB) and exploitation of vulnerabilities in public-facing applications such as CVE-2023-3519 (Citrix Netscaler), CVE-2023-48788 (Fortinet EMS), CVE-2024-57727 (SimpleHelp RMM) and CVE-2025-5777 (Citrix Bleed 2).
12 more CVEs tied to this actor tracked in Mallory.
94 indicators attributed to this actor: domains, IPs, hashes, and other artifacts pulled from reporting. View more in app.
20 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Ransomware group specializing in professional services, especially law firms, using data sensitivity and double extortion leverage as its core strategy.
Ransomware group specializing in professional services, especially law firms, using double-extortion pressure centered on sensitive client data.
Conducting a ransomware attack and associated data breach against a law firm, with stolen data described as personal and medical cards of clients.
Conducting a ransomware attack resulting in a data breach involving project data, client data, and contract data against a UK-based organization.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.