CARDS
INC Ransom is a financially motivated ransomware-as-a-service (RaaS) operation that first emerged in July 2023 and has rapidly become one of the most prolific cybercriminal groups, significantly increasing its activity in 2025 and 2026. The group is assessed with moderate confidence to be of Eastern European origin, with some reports linking it to Russian criminals. What distinguishes INC Ransom is its systematic targeting of sectors traditionally avoided by other ransomware groups, such as healthcare, education, and government, demonstrating a departure from informal cybercriminal 'rules'. They also uniquely employ methods such as printing ransom notes on network printers and changing desktop wallpapers to display demands. The group is also known as GOLD IONIC and is closely associated with Lynx ransomware, which is widely believed to be a successor or rebrand of INC Ransom, especially after INC Ransom reportedly sold its source code in 2024.
Directory Briefing
01
The brand supplies shared capabilities, but affiliates can change access methods and tooling; incident scoping should follow observed behavior rather than assume one fixed playbook.
02
The retained behavior points to External Remote Services, Exploit public-facing edge appliance followed by credential access and lateral movement; Dark Reading reports a Rapid7-observed ransomware outcome, Domain Accounts, and Exploit Public Facing Application; preserve authentication, VPN, edge-device, email, and remote-administration evidence together.
03
The retained sequence includes Network Service Discovery, Domain Account, Domain Groups, Software Discovery, and NTDS, which supports scoping beyond the initially affected host.
04
Evidence includes NTDS, Exploit public-facing edge appliance followed by credential access and lateral movement; Dark Reading reports a Rapid7-observed ransomware outcome, and Exploit public-facing edge appliance followed by credential access, lateral movement, and ransomware deployment; response should cover privileged, service, remote-access, SaaS, and recovery identities—not just interactive user passwords.
05
Lateral movement, administrative access, and shared server infrastructure can turn a limited foothold into broad business interruption.
06
Reported tooling or behavior includes SMB Windows Admin Shares, Exploit public-facing edge appliance followed by credential access and lateral movement; Dark Reading reports a Rapid7-observed ransomware outcome, Lateral Tool Transfer, Remote Desktop Protocol, Windows Management Instrumentation, and Windows Command Shel; detection must distinguish authorized administration from anomalous context and sequence.
07
Defense impairment or evidence removal is retained in the source record. Protect immutable backups and investigate access to recovery systems before trusting them.
08
Collection or exfiltration behavior includes data staging and exfiltration; counsel and forensics need a shared record of what was accessed, staged, and transferred.
09
Retained targeting includes Construction of Buildings, Food Manufacturing, Other Information Services, Software Publishers, and Real Estate across United Arab Emirates, Argentina, Austria, and Australia; translate those sectors into the organization's exposed systems and high-value data.
10
Align counsel, forensics, identity, recovery, insurance, communications, and regulatory analysis around one compromise timeline and one evidence-preservation plan.
Bottom Line Up Front
The brand supplies shared capabilities, but affiliates can change access methods and tooling; incident scoping should follow observed behavior rather than assume one fixed playbook.
The retained behavior points to External Remote Services, Exploit public-facing edge appliance followed by credential access and lateral movement; Dark Reading reports a Rapid7-observed ransomware outcome, Domain Accounts, and Exploit Public Facing Application; preserve authentication, VPN, edge-device, email, and remote-administration evidence together.
The retained sequence includes Network Service Discovery, Domain Account, Domain Groups, Software Discovery, and NTDS, which supports scoping beyond the initially affected host.
Evidence includes NTDS, Exploit public-facing edge appliance followed by credential access and lateral movement; Dark Reading reports a Rapid7-observed ransomware outcome, and Exploit public-facing edge appliance followed by credential access, lateral movement, and ransomware deployment; response should cover privileged, service, remote-access, SaaS, and recovery identities—not just interactive user passwords.
Lateral movement, administrative access, and shared server infrastructure can turn a limited foothold into broad business interruption.
Reported tooling or behavior includes SMB Windows Admin Shares, Exploit public-facing edge appliance followed by credential access and lateral movement; Dark Reading reports a Rapid7-observed ransomware outcome, Lateral Tool Transfer, Remote Desktop Protocol, Windows Management Instrumentation, and Windows Command Shel; detection must distinguish authorized administration from anomalous context and sequence.
Defense impairment or evidence removal is retained in the source record. Protect immutable backups and investigate access to recovery systems before trusting them.
Collection or exfiltration behavior includes data staging and exfiltration; counsel and forensics need a shared record of what was accessed, staged, and transferred.
Retained targeting includes Construction of Buildings, Food Manufacturing, Other Information Services, Software Publishers, and Real Estate across United Arab Emirates, Argentina, Austria, and Australia; translate those sectors into the organization's exposed systems and high-value data.
Align counsel, forensics, identity, recovery, insurance, communications, and regulatory analysis around one compromise timeline and one evidence-preservation plan.
Decision Context
INC Ransom is a financially motivated ransomware-as-a-service (RaaS) operation that first emerged in July 2023 and has rapidly become one of the most prolific cybercriminal groups, significantly increasing its activity in 2025 and 2026. The group is assessed with moderate confidence to be of Eastern European origin, with some reports linking it to Russian criminals. What distinguishes INC Ransom is its systematic targeting of sectors traditionally avoided by other ransomware groups, such as healthcare, education, and government, demonstrating a departure from informal cybercriminal 'rules'. They also uniquely employ methods such as printing ransom notes on network printers and changing desktop wallpapers to display demands. The group is also known as GOLD IONIC and is closely associated with Lynx ransomware, which is widely believed to be a successor or rebrand of INC Ransom, especially after INC Ransom reportedly sold its source code in 2024.1,3,2
Actor Card Detail
Victimology
No named victim organizations are retained in the cited source artifacts for this profile. Countries and sectors are targeting context, not victim identities.
Identity
Targeting
Target Countries / Exposure1,2
Campaign Context
| Campaign / Operation | Source-Backed Context |
|---|---|
| FortiBleed Credential Exposure Campaign7,8,9,10 | FortiBleed Credential Exposure Campaign is retained in the campaign database for INC Ransom. FortiBleed is retained as a Fortinet/FortiGate credential-exposure campaign in which public reporting tied exposed or stolen Fortinet edge credentials to downstream ransomware activity involving INC Ransom and Lynx. IntelliOS treats FortiBleed as a campaign/operation context rather than proof that every exposed Fortinet environment was compromised or deployed with ransomware. |
| SonicWall SMA1000 Zero-Day Exploitation Campaign11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31 | SonicWall SMA1000 Zero-Day Exploitation Campaign is retained in the campaign database for INC Ransom. SonicWall, Rapid7, and Volexity establish a July CVE-2026-15409/CVE-2026-15410 exploitation chain that can produce root appliance compromise. Source-qualified reporting separately associates continued weaponization with INC Ransom, while Volexity tracks its observed activity as UTA0533. Hunt.io adds a separate unattributed post-disclosure CVE-2026-15409 cluster reconstructed from attacker infrastructure: 250 exploitable target identifiers, LDAP configuration recovered from 168 targets, SAM/LSA theft in at least nine Active Directory domains, and full DCSync in five. Hunt.io does not establish CVE-2026-15410 use, ransomware, INC, UTA0533, or country attribution. |
Indicators
SOCRadar reports 53 IOCs for this profile. IntelliOS currently retains 39 cited public observable/context rows; this is not the full possible public-source IOC corpus.
Source coverage: 4 source groups tracked; 2 currently contribute retained observable or context rows.
Retained Observables
Showing 39 of 39
| Type | Value | Source |
|---|---|---|
| SHA-256 Hash | 1898d056463284d849801cbdea6a3dec6c9f568f01569912c3868a5eea9a54495 | Acronis |
| SHA-256 Hash | 1d10d8f5a420d0e4683b4cb40bcf0c984d1e7ea1f3b4442a00a525584632ac115 | Acronis |
| SHA-256 Hash | 24f6c0ca39b2a5593086ff56d818ddfbde121f8e44d54faa762e510397dc9db75 | Acronis |
| SHA-256 Hash | 31800380c359143ae82c4f9011eee653dd22443d03d6a499148203bbfc2755025 | Acronis |
| SHA-256 Hash | 589d9480fbfec2d8e61638eb0b537183d0f9977411fd1d2c0f8eb611feebe8805 | Acronis |
| SHA-256 Hash | 5cc212f84d2bf3fbab165aaf09b16e00fcf2f1ccd880d24b14404c53dcdbf2415 | Acronis |
| SHA-256 Hash | 60aeb9f7bccf377ff02ed64783e66a62c0f976878d9729b067bc7e5b0b9da9d65 | Acronis |
| SHA-256 Hash | 6bf155b269d452f3c3b62832b27bbebe4da436e228dbf521155b1d5989e3743f5 | Acronis |
| SHA-256 Hash | 6cd349eda0fa6c8b274a0920852c68f8b727afea1fdbc69ad183cef05d9cf1415 | Acronis |
| SHA-256 Hash | 765508aa2ec6a1b73a76a23f4fa559d32355622748c91a46ed7b315eae2ee60a5 | Acronis |
| SHA-256 Hash | 7f37351979c249417cb180b4ede0ed17e5fe2a1f08add4d72606b589f8fdb2455 | Acronis |
| SHA-256 Hash | 8d1a22c430252f29611766b8e4a82af0fba60d609246463466b384d6d4793df45 | Acronis |
| SHA-256 Hash | 90e46e89fec2108a1cb4850bb33e3563e92a14d04e1e613ac8c9311f152d294c5 | Acronis |
| SHA-256 Hash | 97aebda5482899fef84a24e456bff055acaa47e5ab4029f768d9e0c62a660ce25 | Acronis |
| SHA-256 Hash | acce811c4fc2a6e3fddd4231e386f1648ca44f039d2d275316bc0a0fc96e0af45 | Acronis |
| SHA-256 Hash | bf8c45e5aa9551a17eefbd1d179422c32b4309c47ee9a3f315bb80ed6d4f7efc5 | Acronis |
| SHA-256 Hash | d26bfb0147f60dc6500a9298d521ee67b49daaf4b8f8be54e7cc8fd86a5975705 | Acronis |
| SHA-256 Hash | d65120291dee76c694f8bea54841f7f68329b499b28f4aee5ea5c9369a7432cb5 | Acronis |
| SHA-256 Hash | dc9938f51150d13a69fc25f3f19052eacb1bf0a086fd5cf39762501fb3ddd7da5 | Acronis |
| SHA-256 Hash | ea721240c14e3d14f8d88e0020880448c6c602f1180a1e5dbe40871cfeedcc225 | Acronis |
| SHA-256 Hash | f6a01d0246ce31faf6938ea488086d4358505405a4ef5c5faa482e79e92cb3475 | Acronis |
| SHA-256 Hash | ff5da8f0330a4c581c37284c74aae2683c007dc6e406e1e2e6803e7bb398b77b5 | Acronis |
| Filename | INC Encryptor.exe6 | SentinelOne |
| Filename | INC-README.html6 | SentinelOne |
| Filename | INC-README.txt6 | SentinelOne |
| Filename | inc.exe6 | SentinelOne |
| File Path | C:\source\INC Encryptor\Release\INC Encryptor.pdb6 | SentinelOne |
| Tool / Process | anydesk.exe6 | SentinelOne |
| Tool / Process | bcdedit.exe6 | SentinelOne |
| Tool / Process | netscan.exe6 | SentinelOne |
| Tool / Process | ping.exe6 | SentinelOne |
| Tool / Process | psexec.exe6 | SentinelOne |
| Tool / Process | vssadmin.exe6 | SentinelOne |
| Tool / Process | wevtutil.exe6 | SentinelOne |
| Tool / Process | wmic.exe6 | SentinelOne |
| Network Indicator | inc-decrypt[.]onion6 | SentinelOne |
| Network Indicator | incblog[.]su5 | Acronis |
| Network Indicator | incblog6qu4y4mm4zvw5nrmue6qbwtgjsxpw6b7ixzssu36tsajldoad[.]onion5 | Acronis |
| Network Indicator | incpaykabjqc2mtdxq6c23nqh4x6m5dkps5fr6vgdkgzp5njssx6qkid[.]onion5 | Acronis |
| Source | Reported | Retained | Coverage Status |
|---|---|---|---|
| SOCRadar2 | 53 | 0 | Reported IOC count retained; underlying SOCRadar feed values are not republished unless stored as cited public observables. |
| Acronis TRU5 | N/A | 25 | Public observables retained and displayed. |
| SentinelOne6 | N/A | 14 | Public filenames, paths, tool, or infrastructure observables retained and displayed. |
| MITRE ATT&CK / CTI3 | N/A | 0 | Technique and identity context retained; not treated as raw IOC feed for this card. |
Actor Chronology
No source-backed actor-activity dates are currently retained. Publication and record-maintenance dates are not promoted into activity dates.
IntelliOS Intel Products
None Found
Source Reconciliation
| Source | Primary Name | Treatment | Boundary |
|---|---|---|---|
| SOCRadar | INC Ransom | Baseline actor-card record retained for the current profile view. | Fields reflect the retained database record. Additional source consensus, collisions, and canonical identity mappings can be layered into this profile without automatically merging actors. |
| IntelliOS | INC Ransom | Normalizes this record for directory search, card display, profile lookup, and future product linking. | Normalization is a presentation and workflow aid; it is not an independent attribution claim. |
Source Collision Notes
IntelliOS starts this detail page from the retained source record for INC Ransom.
No possible same-actor, alias reuse, sub-cluster, duplicate-boundary, or external-source collision is currently retained for this actor.
| Collision Source | Candidate Records | Shared Evidence | Treatment |
|---|---|---|---|
| None retained | No candidate records | No shared evidence recorded | No collision action needed. |
| External sources | Mandiant, CrowdStrike, other non-SOCRadar sources | None retained | External collisions are shown separately when retained. |
Citations
| # | Source | Use In Card |
|---|---|---|
| 1 | SOCRadar Threat Actor Database https://socradar.io/free-tools/threat-actor/ransomware | Threat actor directory source for profile fields and reported activity. |
| 2 | SOCRadar Actor Profile https://socradar.io/free-tools/ransomware-intelligence/groups/inc-ransom | Actor-specific source for ransomware profile metadata and reported IOC counts when available. |
| 3 | MITRE ATT&CK https://attack.mitre.org/groups/G1032/ | ATT&CK source for group, campaign, software, alias, and technique mappings where matched. |
| 4 | MITRE CTI https://raw.githubusercontent.com/mitre/cti/master/enterprise-attack/enterprise-attack.json | Open MITRE CTI source for ATT&CK data. |
| 5 | Acronis TRU: The evolution of INC ransomware https://www.acronis.com/en/tru/posts/from-emerging-threat-to-top-tier-ransomware-as-a-service-the-evolution-of-inc-ransomware/ | IOC Source |
| 6 | SentinelOne: Inc. Ransomware analysis https://www.sentinelone.com/anthology/inc-ransom/ | Threat Actor Profile |
| 7 | FortiBleed campaign linked to INC and Lynx ransomware operations https://socradar.io/blog/fortibleed-inc-lynx-ransomware-link/ | SOCRadar campaign row source for FortiBleed Credential Exposure Campaign. |
| 8 | Critical FortiBleed campaign https://www.recordedfuture.com/blog/critical-fortibleed-campaign | Recorded Future campaign row source for FortiBleed Credential Exposure Campaign. |
| 9 | FortiBleed campaign traced to INC and Lynx ransomware operations https://www.cybersecuritydive.com/news/fortibleed-campaign-traced-to-inc-and-lynx-ransomware-operations/824348/ | Cybersecurity Dive campaign row source for FortiBleed Credential Exposure Campaign. |
| 10 | FortiBleed credential theft linked to INC and Lynx ransomware https://thehackernews.com/2026/07/fortibleed-credential-theft-linked-to.html | The Hacker News campaign row source for FortiBleed Credential Exposure Campaign. |
| 11 | SonicWall PSIRT: SNWLID-2026-0008 https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2026-0008 | SonicWall campaign row source for SonicWall SMA1000 Zero-Day Exploitation Campaign. |
| 12 | Known Exploited Vulnerabilities Catalog https://www.cisa.gov/known-exploited-vulnerabilities-catalog | CISA campaign row source for SonicWall SMA1000 Zero-Day Exploitation Campaign. |
| 13 | SMA1000 zero-days actively exploited https://www.rapid7.com/blog/post/etr-rapid7-mdr-team-discovers-new-sonicwall-sma1000-zero-days-being-actively-exploited-cve-2026-15409-cve-2026-15410/ | Rapid7 campaign row source for SonicWall SMA1000 Zero-Day Exploitation Campaign. |
| 14 | Proxying to Compromise: SMA 0-day exploitation https://www.volexity.com/blog/2026/07/17/proxying-to-compromise-sonicwall-secure-mobile-access-0-day-exploitation/ | Volexity campaign row source for SonicWall SMA1000 Zero-Day Exploitation Campaign. |
| 15 | INC ransomware exploits SonicWall SMA zero-days https://www.darkreading.com/vulnerabilities-threats/inc-ransomware-exploits-sonicwall-sma-zero-days | Dark Reading campaign row source for SonicWall SMA1000 Zero-Day Exploitation Campaign. |
| 16 | SonicWall warns of exploited SMA1000 zero-days https://www.bleepingcomputer.com/news/security/sonicwall-warns-of-sma1000-flaws-exploited-in-zero-day-attacks-patch-now/ | BleepingComputer campaign row source for SonicWall SMA1000 Zero-Day Exploitation Campaign. |
| 17 | SMA1000 zero-days used to deploy custom malware https://www.bleepingcomputer.com/news/security/sonicwall-sma1000-flaws-exploited-as-zero-days-to-push-custom-malware/ | BleepingComputer campaign row source for SonicWall SMA1000 Zero-Day Exploitation Campaign. |
| 18 | SMA appliances targeted in zero-day attacks https://www.helpnetsecurity.com/2026/07/14/sonicwall-sma-attacks-via-cve-2026-15409-cve-2026-15410/ | Help Net Security campaign row source for SonicWall SMA1000 Zero-Day Exploitation Campaign. |
| 19 | Urgent SMA patch warning for two zero-days https://www.securityweek.com/sonicwall-issues-urgent-sma-patch-warning-for-two-zero-day-exploits/ | SecurityWeek campaign row source for SonicWall SMA1000 Zero-Day Exploitation Campaign. |
| 20 | Two SonicWall SMA 1000 zero-days exploited https://thehackernews.com/2026/07/two-sonicwall-sma-1000-zero-days.html | The Hacker News campaign row source for SonicWall SMA1000 Zero-Day Exploitation Campaign. |
| 21 | SMA1000 product notice and recovery guidance https://www.sonicwall.com/support/notices/product-notice-sma-1000-series-affected-by-multiple-vulnerabilities/kA1VN000001nv6D0AQ | SonicWall campaign row source for SonicWall SMA1000 Zero-Day Exploitation Campaign. |
| 22 | From WSProxy to Root: INC ransomware and SonicWall SMA exploit chain https://www.resecurity.com/blog/article/from-wsproxy-to-root-inc-ransomware-and-sonicwall-sma-exploit-chain | Resecurity campaign row source for SonicWall SMA1000 Zero-Day Exploitation Campaign. |
| 23 | INC ransomware emerges as dominant actor exploiting SMA1000 flaws https://thehackernews.com/2026/08/inc-ransomware-emerges-as-dominant.html | The Hacker News campaign row source for SonicWall SMA1000 Zero-Day Exploitation Campaign. |
| 24 | SonicWall PSIRT SNWLID-2026-0016 https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2026-0016 | SonicWall PSIRT campaign row source for SonicWall SMA1000 Zero-Day Exploitation Campaign. |
| 25 | NVD CVE-2026-83548 https://nvd.nist.gov/vuln/detail/CVE-2026-83548 | NIST NVD campaign row source for SonicWall SMA1000 Zero-Day Exploitation Campaign. |
| 26 | NVD CVE-2026-83549 https://nvd.nist.gov/vuln/detail/CVE-2026-83549 | NIST NVD campaign row source for SonicWall SMA1000 Zero-Day Exploitation Campaign. |
| 27 | Canadian Centre for Cyber Security AV26-872 Update 1 https://www.cyber.gc.ca/en/alerts-advisories/sonicwall-security-advisory-av26-872 | Canadian Centre for Cyber Security campaign row source for SonicWall SMA1000 Zero-Day Exploitation Campaign. |
| 28 | Rapid7 September SMA1000 vulnerability analysis https://www.rapid7.com/blog/post/etr-critical-sonicwall-sma1000-vulnerabilities-cve-2026-83548-cve-2026-83549-exploited-in-the-wild/ | Rapid7 campaign row source for SonicWall SMA1000 Zero-Day Exploitation Campaign. |
| 29 | runZero Rapid Response: SMA1000 September vulnerabilities https://help.runzero.com/docs/em-rapid-response/ | runZero campaign row source for SonicWall SMA1000 Zero-Day Exploitation Campaign. |
| 30 | Hunt.io UK Council Attack Linked to SonicWall SMA 1000 Campaign https://hunt.io/blog/sonicwall-sma1000-uk-council-attack | Hunt.io campaign row source for SonicWall SMA1000 Zero-Day Exploitation Campaign. |
| 31 | BBC News council cyberattack disclosure https://www.bbc.co.uk/news/articles/c4gk85ey55yo | BBC News campaign row source for SonicWall SMA1000 Zero-Day Exploitation Campaign. |
