Imncrew ransomware

Who Imncrew is

IMN Crew is a data extortion and ransomware group that emerged in late March 2025, primarily targeting financial services organizations in the US, Croatia, and Indonesia by exploiting exposed perimeter services such as firewalls and VPNs, claiming at least five victims.

Recorded activity

Disclosures attributed to Imncrew in this database run from May 2025 to September 2025, totalling 12 victims — 0% of everything tracked here. Imncrew has listed victims in 9 countries in this database, most often United States, followed by Mexico and Colombia. The sectors appearing most in its listings are Consumer Services, Manufacturing, Business Services.

Tooling observed in Imncrew operations

• LaZagne
• Restic

Software reported in use by Imncrew. Most are legitimate administration or transfer utilities; their presence in an environment is a signal to investigate, not proof of compromise.

YARA detection rules

/*
IMNCrew ransomware
*/

rule IMNCrew_Ransomnote
{
    meta:
        author = "ransomware.live"
        family = "ransomware.imncrew"
        description = "Detects IMNCrew ransomware ransom note or artifact"
        date = "2026-05-04"
        severity = 7
        score = 70

    strings:
        $name1 = "IMNCrew" ascii nocase
        $name2 = "IMNCREW" ascii
        $onion  = "imncrew.onion" ascii nocase

    condition:
        any of them
}

Community-contributed rules for Imncrew, reproduced as published. Test them against your own corpus before relying on them: rule quality and false-positive behaviour vary by author.