INC Ransomware Group

Actor Type Criminal Group
Directly Linked Intrusion Sets GOLD IONIC

The INC Ransomware Group emerged as a cyber criminal extortion group in July 2023.

INC ransomware is a multi-extortion operation, stealing victim data, encrypting it and then threatening to leak the data online should the victim fail to comply with their demands. The group targets multiple industries with attacks on healthcare, education, and government entities.

The initial access methods used by the group can vary, with observed methods including spear-phishing email as well as targeting of vulnerable external services. Once the threat actor has gained initial access, a variety of publicly available tooling and living-off-the-land techniques are used to continue internal reconnaissance and lateral movement. Tools associated with INC ransomware operations include NETSCAN.EXE, MEGAsyncSetup64.EXE, ESENTUTL.EXE, and AnyDesk.exe.

INC ransomware payloads support multiple command-line arguments to specify encryption options but by default the payload will simply attempt to encrypt the local device including all available volumes and files. INC ransomware ransom notes are written to each folder containing encrypted items and the ransomware attempts to output the HTML-formatted note to any connected and accessible printers or fax machines.

Victims are instructed to contact the attackers via their TOR-based portal. Each victim is assigned a personal ID within their ransom notes which they are to use upon visiting the payment site.

Cyber Threat Graph Context

Explore how this Intrusion Set relates to the wider threat graph

INC Ransomware Group Threat Reports

Report

Investigating New INC Ransom Group Activity

This blog post from huntress discusses the ransomware group known as 'INC', breaking down the stages of an attack day by day. The Huntress team ...

View Source

References

MITRE ATT&CK Techniques

MITRE ATT&CK techniques observed in use by this intrusion set.

ATT&CK ID Title Associated Tactics
T1078.002 Domain Accounts Defense Evasion, Initial Access, Persistence, Privilege Escalation
T1021.001 Remote Desktop Protocol Lateral Movement
T1560.001 Archive via Utility Collection
T1482 Domain Trust Discovery Discovery
T1047 Windows Management Instrumentation Execution
T1059.001 PowerShell Execution
T1003.001 LSASS Memory Credential Access
T1059.003 Windows Command Shell Execution
T1567.002 Exfiltration to Cloud Storage Exfiltration
T1021.002 SMB/Windows Admin Shares Lateral Movement