INC Ransom — Ransomware Profile
INC Ransom is a ransomware and data extortion threat group associated with the deployment of INC Ransomware that has been active since at least July 2023. INC Ransom has targeted organizations worldwide most commonly in the industrial, healthcare, and education sectors in the US and Europe.Description reproduced from MITRE ATT&CK. © The MITRE Corporation, reproduced and distributed with permission.
Also tracked as
GOLD IONIC
IntelFusions coverage (20)
- Qilin and INC ransomware crews exploit Palo Alto VPN bug 2026-10-20 · Ransomware
- South Africa's BCX tops a busy week of extortion claims 2026-10-02 · Cyber Incidents
- Four African financial firms on leak sites in one week 2026-09-26 · Cyber Incidents
- INC ransomware now threatens victims with a press release 2026-09-22 · Ransomware
- Argentina had its busiest week yet on ransomware leak sites 2026-09-21 · Cyber Incidents
- Leak sites turn on Southeast Asia's listed companies 2026-09-03 · Cyber Incidents
- New crew Storm goes after US clinics, banks and factories 2026-08-25 · Ransomware
- Ransomware claims against Indian firms tripled in a month 2026-08-12 · Cyber Incidents
- Latin America's public bodies keep appearing on leak sites 2026-08-08 · Cyber Incidents
- Ransomware crew claims quantum computing firm Quantinuum 2026-08-01 · Ransomware
- Low-profile crew CMD keeps adding schools to its leak site 2026-08-01 · Ransomware
- Qilin ransomware lists Argentina's army on its leak site 2026-07-25 · Ransomware
- Smaller ransomware brands crowd the leak sites as Blackout debuts 2026-07-20 · Ransomware
- Qilin ransomware sweeps up US churches, schools and small businesses 2026-07-19 · Ransomware
- INC Ransom floods its leak site with Asia-Pacific victims 2026-07-18 · Ransomware
- New ransomware crew Wallstreet claims a US police department and rural hospital 2026-07-05 · Ransomware
- Ransomware crews pile onto US healthcare providers over the July 4 weekend 2026-07-04 · Ransomware
- INC Ransom adds US city governments and eye clinics to leak site 2026-07-04 · Ransomware
- Ransomware gang claims to hit German submarine builder Thyssenkrupp 2026-06-28 · Ransomware
- Newer ransomware crews claim diagnostics maker Hologic and an Australian fire service 2026-06-28 · Ransomware
Tools & malware
- AdFind Network Reconnaissance
- esentutl LOLBin
- INC Ransomware Ransomware
- Megasync Exfiltration Tool
- Meterpreter Post-Exploitation Framework
- Net Network Reconnaissance
- Nltest Network Reconnaissance
- PsExec Remote Execution
- Rclone Exfiltration Tool
- Tor Anonymization Tool
- WinRAR Archiving Tool
Recent claimed victims
- bereskinparr.com smartbiggar.ca 2026-10-22
- centralrogers.com 2026-10-20
- Seetelhotels.de 2026-10-19
- fairfeelegalservices.com 2026-10-15
- verveba.com \ www.att.com 2026-10-15
- www.coopecaja.fi.cr 2026-10-15
- nowaszkola.com 2026-10-15
- FINANCIAMENTO LTDA 2026-10-14
- Wolf & Sofsky GmbH 2026-10-13
- Great Lakes 2026-10-13
- brookslawfirm.com 2026-10-12
- hsc.mb.ca 2026-10-11
- Acme Stamping & Wire Forming Co. 2026-10-07
- Harbor Pacific Contractors, Inc. 2026-10-07
- architekt-vondanwitz.de 2026-10-07
- Wavecrest HFA 2026-10-07
- Tec Imports 2026-10-07
- UAE Pro League 2026-10-07
- City of Cloverdale 2026-10-07
- The New Community School 2026-10-07
- magnals.com 2026-10-06
- Sangre de Cristo Electric Association 2026-10-02
- Guardian Pharmacy LLC 2026-10-01
- Den Hartog Industries 2026-10-01
- Northern Counties Health Care 2026-10-01
Vendor research
- its write-up of the incident Huntress
- GOLD IONIC DEPLOYS INC RANSOMWARE Counter Threat Unit Research Team
- Threat Alert: INC Ransomware Cybereason Security Research Team
- GOLD IONIC DEPLOYS INC RANSOMWARE Secureworks
- INC Ransom threatens to leak 3TB of NHS Scotland stolen data Bleeping Computer
- Threat Alert: INC Ransomware Cybereason
- SentinelOne. (n.d.). What Is Inc. Ransomware? SentinelOne