Incransom is a prolific ransomware-as-a-service operation, having recorded 956 victims in 72 countries since its July 2023 activation, attacking sectors like healthcare, government, education, and manufacturing predominately in North America and Europe.
Who Incransom is
INC Ransom is a prolific ransomware-as-a-service operation active since July 2023 that systematically targets healthcare, government, education, and manufacturing sectors in North America and Europe, having posted over 200 victims in 2025 alone with no sector off-limits.
Recorded activity
Disclosures attributed to Incransom in this database run from January 2024 to October 2026, totalling 968 victims — 4.1% of everything tracked here. Incransom has listed victims in 72 countries in this database, most often United States, followed by Canada and Germany. The sectors appearing most in its listings are Business Services, Healthcare, Manufacturing.
How Incransom is documented to operate
Valid Accounts
T1078
Stealth
Persistence
Adversaries may obtain and abuse credentials of existing accounts as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Compromised credentials may be used to bypass access controls placed on various resources on systems within the network and may even be used for persistent access to remote systems and externally available services, such as VPNs, Outlook Web Access, network devices, and remote desktop. Compromised credentials may also grant an adversary increased privilege to specific systems or access to restricted areas of the network.
Mitigations:
Application Developer Guidance, User Training, Password Policies, User Account Management, Privileged Account Management, Multi-factor Authentication
MITRE ATT&CK reference
Exploit Public-Facing Application
T1190
Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network. The weakness in the system can be a software bug, a temporary glitch, or a misconfiguration. Exploited applications are often websites/web servers, but can also include databases (like SQL), standard services (like SMB or SSH), network device administration and management protocols (like SNMP and Smart Install), and any other system with Internet-accessible open sockets. On ESXi infrastructure, adversaries may exploit exposed OpenSLP services; they may alternatively exploit exposed VMware vCenter servers.
Mitigations:
Vulnerability Scanning, Limit Access to Resource Over Network, Filter Network Traffic, Network Segmentation, Privileged Account Management, Application Isolation and Sandboxing
MITRE ATT&CK reference
Phishing
T1566
Initial Access
Adversaries may send phishing messages to gain access to victim systems. All forms of phishing are electronically delivered social engineering. Phishing can be targeted, known as spearphishing. In spearphishing, a specific individual, company, or industry will be targeted by the adversary. More generally, adversaries can conduct non-targeted phishing, such as in mass malware spam campaigns. Adversaries may send victims emails containing malicious attachments or links, typically to execute malicious code on victim systems. Phishing may also be conducted via third-party services, like social media platforms.
Mitigations:
Network Intrusion Prevention, Restrict Web-Based Content, User Training, Antivirus/Antimalware, Software Configuration, Audit
MITRE ATT&CK reference
Windows Management Instrumentation
T1047
Execution
Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is designed for programmers and is the infrastructure for management data and operations on Windows systems. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model and Windows Remote Management. Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Mitigations:
Execution Prevention, Behavior Prevention on Endpoint, User Account Management, Privileged Account Management
MITRE ATT&CK reference
Network Service Discovery
T1046
Discovery
Adversaries may attempt to get a listing of services running on remote hosts and local network infrastructure devices, including those that may be vulnerable to remote software exploitation. Common methods to acquire this information include port, vulnerability, and/or wordlist scans using tools that are brought onto a system. Within cloud environments, adversaries may attempt to discover services running on other cloud hosts. Additionally, if the cloud environment is connected to a on-premises environment, adversaries may be able to identify services running on non-cloud systems as well.
Mitigations:
Network Intrusion Prevention, Network Segmentation, Disable or Remove Feature or Program
MITRE ATT&CK reference
System Network Connections Discovery
T1049
Discovery
Adversaries may attempt to get a listing of network connections to or from the compromised system they are currently accessing or from remote systems by querying for information over the network. An adversary who gains access to a system that is part of a cloud-based environment may map out Virtual Private Clouds or Virtual Networks in order to determine what systems and services are connected. The actions performed are likely the same types of discovery techniques depending on the operating system, but the resulting information may include details about the networked cloud environment relevant to the adversary's goals.
MITRE ATT&CK reference
MITRE ATT&CK techniques attributed to Incransom across its recorded activity. They describe the group overall, not any single incident.
Vulnerabilities Incransom is recorded exploiting
2 of these 2 are in the CISA Known Exploited Vulnerabilities catalog, 2 of them recorded by CISA as used in ransomware campaigns. CVEs attributed to Incransom in threat intelligence reporting. Patching these does not by itself rule the group out, and their presence here is not evidence of how any single organisation was reached.
Tooling observed in Incransom operations
- Mimikatz
- AdFind
- Advanced IP Scanner
- SoftPerfect NetScan
- 7-Zip
- BackBlaze
- MEGA
- RClone
- Restic
- WinRAR
- s5cmd
- Finger
Software reported in use by Incransom. Most are legitimate administration or transfer utilities; their presence in an environment is a signal to investigate, not proof of compromise.
Indicators of compromise
- ef394149c8da3af730c37d550027df8639a3aaa6feaccea60112461ae6955829
- 753207ad5e72ddc6b13889132e5de18836b1a2acf954443655fea82b430e4c99
- 213.176.114.6
- 178.20.41.208
Showing a sample of 2 SHA256, 2 IP on file. Hashes and network indicators published for Incransom. Leak-site addresses are deliberately excluded. Indicators age quickly — treat a match as a starting point for investigation, and an absence of matches as no assurance.
YARA detection rules
Inc.yar
/*
Inc. ransomware
*/
rule Inc
{
meta:
author = "rivitna"
family = "ransomware.inc"
description = "Inc. ransomware Windows payload"
severity = 10
score = 100
strings:
$h0 = { 6A 00 6A 00 6A 18 8D [3-4] 5? 68 28 C0 53 00 }
$h1 = { 6A 00 68 80 00 00 00 6A 03 6A 00 6A 03 [0-16] 68 9F 01 12 00
[0-8] C7 44 24 ?? 2E 00 5C 00 }
$h2 = { 6A 20 FF 35 [4] FF 15 [8-12] 8A 4? 1F 80 2? F8 24 3F 0C 40
88 4? 1F }
$s0 = "\x00Q:\\\x00W:\\\x00E:\\\x00R:\\\x00T:\\\x00Y:\\\x00U:\\" wide
$s1 = "PGh0bWw+DQoJPGhlYWQ+DQoJCTx0aXRsZT5JbmMuIFJhbnNvbXdhcmU8" ascii
$s2 = "\\background-image.jpg\x00" wide
$s3 = "\x00--lhd\x00" wide
$s4 = "\x00--ens\x00" wide
$s5 = "\x00--sup\x00" wide
$s6 = " delete shadow copies from %c:/ " wide
$s7 = "\x00[+] Start encryption of" wide
$s8 = "[+] Encrypting: %s\n" wide
$s9 = "[+] Found drive: %s" wide
$s10 = " [+] Mounted %s\n" wide
$s11 = " [-] Failed to mount %s Error: %d\n" wide
$s12 = "[*] Count of arguments: %d\n" wide
$s13 = "[-] Please, add \"/\" to the end of directory!\n" wide
$s14 = "[*] Settings:\n" wide
$s15 = " [%s] Stop using process\n" wide
$s16 = " [%s] Encrypt network shares\n" wide
$s17 = " [%s] Load hidden drives\n\n" wide
$s18 = "[*] Loading hidden drives...\n" wide
$s19 = "[*] Starting full encryption in 5s" wide
$s20 = "[+] Start sending note to printers...\n" ascii
$s21 = "[+] Count of printers: %d\n" ascii
condition:
((uint16(0) == 0x5A4D) and (uint32(uint32(0x3C)) == 0x00004550)) and
(
(7 of ($s*)) or
((1 of ($h*)) and (3 of ($s*)))
)
}
Community-contributed rules for Incransom, reproduced as published. Test them against your own corpus before relying on them: rule quality and false-positive behaviour vary by author.
