INC Ransomware: Tactics, Evolution, and Incident Response Guide

INC ransomware is a ransomware-as-a-service (RaaS) operation that emerged in mid-2023 and quickly became a major threat to organizations worldwide. The group employs double extortion tactics (stealing sensitive data before encrypting systems) to maximize pressure on victims.

This article provides an overview of INC ransomware's operational characteristics and attack lifecycle, along with practical guidance for response, recovery, and prevention.

Organizations facing an active INC intrusion should engage 24/7 ransomware and breach response immediately rather than using this guide in isolation.

INC ransomware at a glance

What is INC ransomware?

INC ransomware operates as a RaaS platform, meaning the core developers provide the malware and infrastructure while different actors conduct intrusions in exchange for a share of ransom proceeds.

"RaaS is a division of labor: an initial access broker sells the foothold, an affiliate runs the intrusion with the operator's professional-grade tooling, and the operator provides infrastructure, leak site, and negotiation platform. The tooling ceiling is high and constantly updated; the operator's skill at the keyboard varies enormously by affiliation: you can face a meticulous intrusion or a sloppy one under the same brand." Magdy Abdelaziz, Head of DFIR, Proven Data

The group is financially motivated with no confirmed ties to state sponsorship. Communications and tactics are consistent with Eastern European ransomware operations, though definitive attribution remains uncertain.

INC maintains leak sites on the Tor network where it publishes victim data if it does not receive ransom payments.

A distinguishing characteristic is INC's cross-platform capability. The ransomware targets Windows systems, Linux servers, and VMware ESXi virtualization environments, enabling broad impact across enterprise infrastructure. The Linux variant, first observed in December 2023, includes ESXi-specific functionality.

By mid-2026, reporting indicated that INC's Windows and Linux/ESXi payloads had been rewritten in Rust. The operation’s toolkit has expanded beyond its original tooling to include Cobalt Strike, ScreenConnect, TeamViewer, and rclone. The group has also expanded its targets to include legal services, technology, and construction, alongside its original focus on manufacturing and healthcare. The United States accounts for roughly two-thirds of disclosed victims.

The same reporting ties later intrusions to a SimpleHelp RMM vulnerability and to Citrix Bleed 2, alongside two previously identified CVEs. It also describes a custom process-killing tool now tracked as ProcessTerminator. In some cases, this tool loads vulnerable signed drivers (filwfp.sys, filnk.sys, fildds.sys) to disable security software before encryption begins.

The encryption routine itself reportedly scales to roughly four threads per CPU core. To avoid destabilizing the host mid-encryption, it skips system extensions (.msi, .exe, .dll, .inc) as well as core Windows directories.

Aliases and tracking names

INC is tracked under several names across threat intelligence platforms and vendor reporting:

Relationship to Lynx ransomware

In mid-2024, a ransomware variant called Lynx emerged with significant code overlap. Independent binary analysis measured a 48% overall similarity score between Lynx and INC, rising to 70.8% when comparing shared functions. Lynx appears to be a successor to INC, with strong code and behavioral overlap.

This transition coincided with the reported sale of INC's source code on an underground forum between March and May 2024, for a sum reported in the low hundreds of thousands of dollars and limited to a small number of buyers.

Detection rules and indicators developed for INC remain relevant to Lynx activity, though you should not assume the same personnel operate both.

How INC ransomware attacks unfold

INC ransomware incidents follow a structured, multi-stage pattern consistent with human-operated ransomware campaigns. Understanding this lifecycle helps organizations detect intrusions before encryption.

Phase 1: Initial access

Threat actors gain entry through several vectors. Phishing attacks targeting employees remain common, often delivering malicious attachments or credential-harvesting links. Stolen credentials purchased from underground markets or harvested by information-stealing malware provide another entry point.

Exploiting vulnerabilities in internet-facing systems is a significant access method. INC-related intrusions have exploited CVE-2023-3519, a critical remote code execution vulnerability in Citrix NetScaler gateways. Some intrusions attributed to INC have involved exploitation of CVE-2023-48788, a SQL injection vulnerability in Fortinet FortiClient EMS.

The most significant recent development is INC's weaponization of a two-stage SonicWall SMA1000 exploit chain: a pre-authentication, maximum-severity WebSocket-proxy bypass paired with a path-traversal flaw that escalates to root access on the appliance. A separate intrusion cluster was exploiting the chain pre-disclosure in late June 2026, before INC affiliates adopted it as a delivery mechanism to compromise edge VPN infrastructure directly, deploying a setuid backdoor, a Python-based loader abusing the Java Attach API, and HTTP-tunneling and web-shell tooling on compromised appliances.

"Edge devices are one of the primary initial access targets because they are internet-facing and often have weaker telemetry than endpoints,” explains Abdelaziz. “Firewalls, VPN appliances, remote access gateways, file transfer systems, and management portals need to be treated like critical servers: patched quickly, logged deeply, monitored continuously, and protected with strong admin controls."

Initial access brokers also play a role, selling pre-existing network access to ransomware operators. This lets attackers bypass the intrusion phase entirely and move directly into internal operations.

Phase 2: Foothold and reconnaissance

After gaining access, attackers establish persistence and map the target environment. They use living-off-the-land binaries and built-in administrative tools to avoid detection. Commands such as net user /domain and net group /domain enumerate Active Directory accounts and groups.

Network scanning tools like Advanced IP Scanner identify additional systems. Attackers also query LDAP to inventory domain computers and locate critical assets, including domain controllers, file servers, and backup infrastructure.

Credential harvesting is central to this phase. Tools like Mimikatz extract credentials from memory, while a custom credential-dumping script specifically targets credentials used by backup software.

Accessing backup systems serves two purposes: enabling privilege escalation and preparing to neutralize recovery options.

Phase 3: Lateral movement and privilege escalation

With harvested credentials, attackers move laterally across the network. PsExec and Windows Management Instrumentation (WMI) enable remote command execution on additional systems. Remote desktop tools, including AnyDesk and TightVNC, provide persistent access to compromised hosts.

The objective is domain administrator access, which provides full control over the environment. Attackers may create new administrative accounts or add compromised accounts to privileged groups.

Security tools are disabled where possible: Process Hacker and ProcessTerminator have been observed terminating security processes, as described above.

Phase 4: Data exfiltration

Before encryption, attackers exfiltrate sensitive data to use as leverage. Target data includes customer records, financial information, intellectual property, and executive communications. Files are typically compressed using 7-Zip before transfer.

Exfiltration often occurs via cloud storage services. Attackers have used MegaSync to upload data to Mega.nz for exfiltration in multiple incidents, as well as rclone. Large transfers may occur overnight so they complete before encryption triggers.

Phase 5: Encryption and extortion

With data stolen and access secured, attackers deploy the ransomware payload across the environment. The malware encrypts files on local drives, network shares, and virtual machine storage. To maximize speed, INC uses partial encryption, encrypting only enough of each file to render it unusable.

The ransomware uses AES-128 in CTR mode for file contents and Curve25519 (X25519) elliptic-curve Diffie-Hellman key exchange with SHA-256 key derivation for key protection. Multi-threading accelerates the process, with the malware spawning threads proportional to the number of available CPU cores.

Who INC ransomware targets

INC ransomware has affected organizations across multiple sectors and geographies. Manufacturing and industrial companies are frequently targeted, likely because they have little tolerance for operational downtime. Professional services, technology firms, and healthcare organizations have also been affected.

Geographically, the United States accounts for a large share of disclosed victims, followed by the United Kingdom, Canada, Australia, and Germany. Incidents have been documented across Europe, Asia-Pacific, Latin America, and the Middle East. Notably, no publicly reported incidents have affected organizations in Russia or Commonwealth of Independent States countries, a pattern consistent with many Russian-speaking ransomware operations.

Target selection suggests deliberate reconnaissance. Victims tend to be medium to large enterprises with significant data assets, and the involvement of initial access brokers points to pre-selected, high-value targets.

A surging operation in 2026

Independent leak-site tracking placed INC's cumulative claimed victim count at 885 as of early August 2026, with security researchers describing it as a dominant threat actor following its adoption of the SonicWall exploit chain described above.

The group's rapid rise prompted a $22,000 reward offered by a crime-reporting nonprofit, in partnership with a ransomware tracking firm, for information leading to the disruption of INC's infrastructure, funding, and communications in July 2026.

The group has also shown a concentrated interest in legal services firms: INC's leak site claimed ten law firms within a single 48-hour window in March 2026, part of twenty law-firm victims claimed over the course of the year. Researchers have flagged this pattern as a possible coordinated or supply-chain-driven campaign against the sector.

Disclaimer: Victim listings on ransomware leak sites represent unverified claims made by the threat actor. Treat them as unconfirmed unless company disclosures, SEC filings, regulatory notifications, or law enforcement confirm them.

Indicators of compromise (IOCs)

Use these IOCs to track INC ransom activity and try to catch it in its early stages. This action can prevent the ransomware from completely encrypting or stealing your data.

Not sure whether a given incident is INC? Proven Data's ransomware identification tool and guide on how to identify a ransomware variant can help confirm the strain from a ransom note or encrypted file sample before response actions begin.

MITRE ATT&CK mapping

INC Ransom is tracked by MITRE ATT&CK as Group G1032, active since at least July 2023. The INC ransomware payload itself is separately cataloged as software S1139.

Ransom note

Ransom notes are delivered aggressively. Text and HTML files named "INC-README" appear in affected directories. The malware also attempts to print ransom messages to network printers and change desktop wallpapers. Encrypted files receive the .inc extension (or .LYNX in successor variants).

Victims are directed to Tor-based negotiation portals. The group maintains both a private communication site and a public leak blog where it publishes data if it doesn't receive payment.

INC Ransom Note Transcript

~~~ INC Ransom ~~~

—-> Your data is stolen and encrypted.

If you don't pay the ransom, the data will be published on our TOR darknet sites.

The sooner you pay the ransom, the sooner your company will be safe.

Tor Browser Link:

http://incblog***********************.onion/

http://incblog***********************.onion/

Link for normal browser:

http://in****.su/

—-> What guarantees are that we won't fool you?

We are not a politically motivated group and we want nothing more than money.

If you pay, we will provide you with decryption software and destroy the stolen data.

After you pay the ransom, you will quickly restore your systems and make even more money.

Treat this situation simply as a paid training for your system administrators, because it is due to your corporate

network not being properly configured that we were able to attack you.

Our pentest services should be paid just like you pay the salaries of your system administrators. Get over it and

pay for it.

If we don't give you a decryptor or delete your data after you pay, no one will pay us in the future.

You can get more information about us on Twitter https://twitter.com/hashtag/inc?ransom?f=live

—-> You need to contact us on TOR darknet sites with your personal ID

Download and install Tor Browser https://www.torproject.org/

Write to the chat room and wait for an answer, we'll guarantee a response from you.

Sometimes you will have to wait some time for our reply, this is because we have a lot of work and we attack tens

of companies around the world.

Tor Browser link for chat:

http://incpay***********************.onion/

Your personal ID:

***********************

—-> Warning! Don't delete or modify encrypted files, it will lead to problems with decryption of files!

—-> Don't go to the police or the FBI for help. They won't help you.

The police will try to prohibit you from paying the ransom in any way.

The first thing they will tell you is that there's no guarantee to decrypt your files and remove stolen files.

This is not true, we can do a test decryption before paying and your data will be guaranteed to be removed because it's a matter of our reputation.

Paying the ransom to us is much cheaper and more profitable than paying fines and legal fees.

The police and the FBI don't care what losses you suffer as a result of our attack, and we'll help you get rid of all your problems for a modest sum of money.

If you're worried that someone will trace your bank transfers, you can easily buy cryptocurrency for cash, thus leaving no digital trail that someone from your company paid our ransom.

The police and FBI won't be able to stop lawsuits from your customers for leaking personal and private information.

The police and FBI won't protect you from repeated attacks.

—–> Don't go to recovery companies!

They are essentially just middlemen who will make money off you and cheat you.

We are well aware of cases where recovery companies tell you that the ransom price is $5M dollars, but in fact they secretly negotiate with us for $1M.

If you approached us directly without intermediaries you would pay several times less.

—–> For those who have cyber insurance against ransomware attacks.

Insurance companies require you to keep your insurance information secret.

In most cases, we find this information and download it.

—–> If you do not pay the ransom, we will attack your company again in the future.

INC Ransom Note Transcript (Another Variant)

Inc. Ransomware

We have hacked you and downloaded all confidential data of your company and its clients.

It can be spread out to people and media. Your reputation will be ruined.

Do not hesitate and save your business.

Please, contact us via:

http://incpays*******************.onion/

Your personal ID:

*******************

We're the ones who can quickly recover your systems with no losses. Do not try to devalue

our tool – nothing will come of it.

Starting from now, you have 72 hours to contact us if you don't want your sensitive data

being published in our blog:

http://incblog*******************.onion/

You should be informed, in our business reputation – is a basic condition of the success.

Inc provides a deal. After successfull negotiations you will be provided:

1. Decryption assistance;

2. Initial access;

3. How to secure your network;

4. Evidence of deletion of internal documents;

5. Guarantees not to attack you in the future.

How to respond to an INC ransomware attack

Organizations experiencing an INC ransomware incident should immediately engage incident response resources. The following framework guides containment through recovery.

Immediate containment

Isolate affected systems from the network by disconnecting cables or disabling switch ports. If encryption is spreading actively, network isolation may limit the damage. Avoid powering off systems immediately if you can collect forensic evidence; memory contains data critical to the investigation.

Disable or reset any accounts suspected of compromise, particularly those with administrative privileges. If domain administrator credentials were obtained, assume broad compromise and plan for a comprehensive credential reset.

Scoping the incident

Determine which systems were accessed and what data may have been stolen. Preserving ransomware evidence before remediation begins helps reconstruct the attack timeline and identify all affected assets. Review authentication logs, EDR telemetry, and network traffic records.

Assess data exposure by identifying which file shares and databases compromised accounts could access. Network logs showing large outbound transfers indicate likely exfiltration.

If stolen data has already surfaced on INC's leak site, the incident should be reclassified immediately as a confirmed breach rather than a suspected one, since the regulatory notification clocks under ransomware and data-breach law, including HIPAA, state breach statutes, and, for public companies, the SEC's four-business-day disclosure requirement, may already be running.

Contact a ransomware incident response team

Restoring data and rebuilding compromised systems internally is often more complex than it appears. As Abdelaziz notes, the primary delay in long-term ransomware recovery is rarely the technical restoration of data itself. Instead, the real bottleneck is decision latency and trust: addressing unproven eradication, unverified or encrypted backups, unvalidated application interdependencies, and delays from legal counsel reviews, insurance approvals, and executive hesitation.

An experienced cybersecurity incident response team assists with these operational complexities, verifies complete threat eradication, and streamlines coordination across legal, insurance, and executive channels.

DO NOT PAY THE RANSOM. Decisions about ransom payments carry serious legal, financial, and operational risks that qualified legal counsel and an incident response team should thoroughly evaluate before taking action. Engaging cyber insurance carriers early is critical to how a company should handle a ransomware attack.

Is there a public decryptor for INC ransomware?

No public decryptor for INC ransomware is currently available.

The payload's hybrid encryption scheme, AES-128 in CTR mode for file contents protected by a Curve25519/X25519 elliptic-curve key exchange with SHA-256 key derivation, has no documented cryptographic weakness that would allow decryption without the attacker's private key.

Because INC uses partial encryption on larger files, some file types retain recoverable structure; a qualified ransomware recovery and digital forensics team can assess what, if anything, can be salvaged without engaging the attacker.

Prevention and hardening

Defensive measures should address the specific techniques observed in INC ransomware operations.

Identity and access controls

Enforce multi-factor authentication on all remote access points, including VPNs, RDP gateways, and cloud services, ideally backed by identity threat detection and response that flags session-token theft and anomalous sign-ins, not just a login prompt.

Review privileged accounts regularly and remove unnecessary access. Service accounts should use strong, unique passwords and operate with the minimum necessary privileges.

Monitor for unusual authentication patterns: logins from unexpected locations, off-hours access, or a single account authenticating across many systems in a short period.

Perimeter and vulnerability management

Prioritize patching for internet-facing systems. Address CVE-2023-3519 and CVE-2023-48788 immediately where applicable, and update SonicWall SMA1000 appliances to current firmware without delay, given active exploitation of the chain described above. Reduce external attack surface by disabling unnecessary services and restricting RDP/SSH access from the internet.

Deploy web application firewalls and intrusion prevention systems, and consider endpoint detection and response coverage for edge devices specifically, since VPN concentrators and remote-access gateways typically carry weaker telemetry than standard endpoints.

Network segmentation

Segment networks to contain lateral movement. Place domain controllers, backup servers, and sensitive file shares on isolated VLANs with restricted access. Workstations should not have direct access to server subnets unless explicitly required.

Backup resilience

Maintain offline or immutable backups that ransomware cannot reach during an attack. Backup systems should use credentials separate from the primary domain. Test restoration procedures regularly to verify data integrity and measure recovery time; untested restore throughput is a routine cause of multi-week recovery timelines.

Security checklist

The following actions address the INC ransomware attack patterns directly:

• Enforce MFA on all remote access (VPN, RDP, Citrix, cloud portals); credential theft remains INC's primary access path.
• Patch CVE-2023-3519 (Citrix NetScaler) and CVE-2023-48788 (Fortinet FortiClient EMS) if these products are deployed.
• Update SonicWall SMA1000 appliances to current firmware to close the pre-auth exploit chain INC affiliates now use for initial access.
• Restrict RDP and SSH exposure from the internet.
• Segment domain controllers and backup servers on isolated VLANs.
• Maintain offline or immutable backups with separate credentials.
• Deploy EDR with detection for Mimikatz, PsExec, vulnerable-driver loading, and VSS deletion.
• Monitor for unusual admin account activity and off-hours authentication.
• Block or monitor access to file-sharing and sync services (Mega.nz, rclone) at the network perimeter.
• Test backup restoration procedures quarterly.
• Develop and rehearse a ransomware-specific incident response plan.
• Have a reputable firm on an incident response retainer, or assess current exposure with a ransomware readiness review.