Loading malware…
INC Ransom is a ransomware-as-a-service operation active since mid-2023 and associated with a multi-extortion model that combines file encryption with data theft and leak-site pressure. The operation has been tracked under aliases including Gold Ionic and Tarnished Scorpius, and is widely described as a russophone cybercriminal ecosystem with affiliates. It has targeted organizations across North America, Europe, Latin America, and later the Asia-Pacific region, with repeated victimization of healthcare, education, government, manufacturing, industrial, business services, and professional services organizations, including a notable preference in some reporting for law firms and other legal-sector entities.
INC Ransom has been linked to rapid post-compromise operations, often moving from initial access to broad ransomware deployment in a short time frame. Reported access vectors include exploitation of public-facing applications, spearphishing, compromised VPN or RDP accounts, and access obtained through initial access brokers. In 2026, the operation was repeatedly associated with exploitation of SonicWall SMA 1000 vulnerabilities CVE-2026-15409 and CVE-2026-15410, using appliance compromise to obtain credentials, session data, and MFA seed material, then pivot for persistence and lateral movement. Separate reporting also linked the broader INC/Lynx ecosystem to downstream ransomware deployment following FortiGate credential-harvesting activity.
Operationally, INC Ransom relies heavily on legitimate administrative mechanisms and common post-exploitation tooling. Observed tradecraft includes Active Directory abuse, Group Policy-based propagation, Impacket-assisted deployment, remote administration tools, LOLBins, credential abuse, and scripts that disable or weaken Microsoft Defender and other security controls before launching the encryptor. The group has also been associated with tools and behaviors for network discovery, remote access, service termination, and defense evasion.
The malware family includes Windows, Linux, and ESXi variants. A documented Windows payload written in Rust appends a dedicated encrypted-file extension, drops a ransom note, and uses multithreaded encryption with a hybrid cryptographic design based on X25519 or Curve25519 with AES-CTR; other reporting also describes Windows payloads using Salsa20, AES, and Curve25519, while Linux and ESXi variants use X25519 ECDH with AES-128 CTR. The operation’s strength appears to lie less in uniquely advanced cryptography than in efficient orchestration, standardized affiliate workflows, rapid propagation, and consistent use of double extortion infrastructure.
INC Ransom is also notable for its mature negotiation and leak-site ecosystem, which supports victim communications, disclosure management, and publication of stolen data to coerce payment. Reporting and code-similarity analysis have repeatedly linked INC Ransom to the later Lynx ransomware operation, which is often characterized as an evolution or rebrand of the INC codebase and affiliate ecosystem.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
12 CVEs Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.
For SharePoint, CISA confirmed ransomware activity tied to CVE-2026-45659, a high-severity remote code execution flaw stemming from deserialization of untrusted data. It allows an attacker with low privileges to run arbitrary code on unpatched servers, and Microsoft has noted it can be exploited reliably in low-complexity attacks.
Separately, CISA linked ransomware activity to two SonicWall SMA1000 flaws (CVE-2026-15409 and CVE-2026-15410), including a maximum-severity server-side request forgery vulnerability.
Separately, CISA linked ransomware activity to two SonicWall SMA1000 flaws (CVE-2026-15409 and CVE-2026-15410), including a maximum-severity server-side request forgery vulnerability.
Il vise le groupe INC Ransom, opérateur de ransomware-as-a-service (RaaS) d’origine russophone.
CVE-2023-48788 ... SQL Injection Leading to RCE Fortinet FortiClient EMS 7.2.0 through 7.2.2 and 7.0.1 through 7.0.10 9.3 (Critical) 98.53% | INC Ransomware has rapidly evolved into one of the most active ransomware-as-a-service (RaaS) operations in 2026, claiming responsibility for more than 830 victims worldwide since its emergence in August 2023.
CVE-2025-5777 ... Authentication Bypass / Session Hijacking Citrix NetScaler ADC and Citrix Gateway 14.1 before 14.1-43.56 and 13.1 before 13.1-58.32 9.3 (Critical) 99.90% | INC Ransomware has rapidly evolved into one of the most active ransomware-as-a-service (RaaS) operations in 2026, claiming responsibility for more than 830 victims worldwide since its emergence in August 2023.
CVE-2024-57727 ... Path Traversal Leading to RCE SimpleHelp versions 5.5.7 and earlier 7.5 (High) 95.07% | INC Ransomware has rapidly evolved into one of the most active ransomware-as-a-service (RaaS) operations in 2026, claiming responsibility for more than 830 victims worldwide since its emergence in August 2023.
Security teams are advised to ... patch known vulnerabilities including ... CVE-2023-35082 ... IoCs ... CVE-2023-35082 SimpleHelp RMM vulnerability, used for initial access | INC ransomware has grown from a newcomer threat into one of the most dangerous ransomware operations worldwide. The group runs under a Ransomware-as-a-Service model. Both the Windows and Linux/ESXi encryptors have been fully rewritten in Rust.
Security teams are advised to ... patch known vulnerabilities including ... CVE-2024-4885 ... IoCs ... CVE-2024-4885 WhatsUp Gold RCE, used for initial access | INC ransomware has grown from a newcomer threat into one of the most dangerous ransomware operations worldwide. The group runs under a Ransomware-as-a-Service model. Both the Windows and Linux/ESXi encryptors have been fully rewritten in Rust.
Security teams are advised to ... patch known vulnerabilities including ... CVE-2023-4966 ... IoCs ... CVE-2023-4966 Citrix Bleed (NetScaler), used for credential theft | INC ransomware has grown from a newcomer threat into one of the most dangerous ransomware operations worldwide. The group runs under a Ransomware-as-a-Service model. Both the Windows and Linux/ESXi encryptors have been fully rewritten in Rust.
This activity is significant as it may indicate an attempt to exploit CVE-2024-21378, where a custom MAPI form loads a potentially malicious DLL. If confirmed malicious, this could allow an attacker to execute arbitrary code, leading to further system compromise or data exfiltration.
The following analytic identifies remote code execution (RCE) attempts targeting F5 BIG-IP, BIG-IQ, and Traffix SDC devices, specifically exploiting CVE-2020-5902.
5 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
The INC Ransomware operation has emerged as the "dominant threat actor" exploiting the recently disclosed security flaws in SonicWall Secure Mobile Access (SMA) 1000 series VPN appliances.
INC Ransom is an active ransomware and data extortion group that has been operating since at least July 2023 and is associated with the INC Ransomware malware family.
Discovered in mid-2023, INC ransomware is another RaaS group that employs double extortion tactics... In its most recent iteration, both payloads are rewritten in Rust.
Microsoft revealed on Wednesday that its threat analysts have observed the financially motivated Vanilla Tempest threat actor using INC ransomware for the first time in an attack on the U.S. healthcare sector.
The ransomware-as-a-service (RaaS) group Tarnished Scorpius (aka INC Ransomware) has listed on its leak site an Israeli industrial machinery company, and replaced the company logo with a swastika.
27 distinct techniques documented for this family, organized by ATT&CK tactic.
For example, the domain name associated with one of these emails (used by threat actors to contact the victim organization) was registered shortly after the actual incident... At the end of the call, the individual provided the email address info@helprans[.]com for further negotiations
Monitor the use of Generic Accounts and where possible prevent administrators from using generic accounts.
Review your VPN settings, restricting what resources, servers and applications can be accessed while using the VPN.
Review Firewall for evidence of potentially suspicious IP’s, brute force attacks, vulnerability exploitation or port scanning that may indicate malicious activity.
User awareness training. Regularly educate staff on phishing, social engineering and other tactics used by ransomware operators. | INC attackers gain initial access to victim organizations through spear phishing, valid account credentials obtained from initial access brokers, and exploitation of vulnerabilities in public-facing applications.
Exfiltrated data from an Asia-Pacific manufacturing copmany revealed the attacker specifically targeted Active Directory DPAPI backup master keys, which would enable offline decryption of all domain-protected credentials... At the root of the loot directory are three files containing Active Directory DPAPI backup master keys.
Review Firewall for evidence of potentially suspicious IP’s, brute force attacks, vulnerability exploitation or port scanning that may indicate malicious activity.
By invoking the native GetSystemInfo Windows API, the binary retrieves the active dwNumberOfProcessors core count metric.
To maximize the scope of its deployment, the payload initiates a systematic discovery loop targeting all connected storage infrastructure... iterating sequentially through the alphabet... identifies active volumes, distinguishing between local fixed disks, removable media and mapped network shares.
Lock down all remote management tools, including TeamViewer and AnyDesk, for example.
INC Ransom affiliates deploy ransomware to encrypt data across compromised systems, rendering victim documents and, occasionally entire systems, inaccessible.
Analysis of the imported functions indicates the use of Windows Service Control Manager APIs... This suggests that the malware is capable of stopping services that could interfere with the encryption process, such as database servers, business applications, backup solutions, or security software.
109 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Other indicator types observed in public reporting.
116 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Ransomware group focused on double-extortion, especially against professional services and law firms, where sensitive client data provides strong leverage.
Ransomware operation focused on double-extortion, especially against professional services and law firms where sensitive client data provides strong leverage.
A ransomware operation reported as actively exploiting the SonicWall SMA1000 vulnerability chain to gain access and potentially deploy ransomware.
Named ransomware ecosystem whose affiliate was observed deploying DeadLock ransomware.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.