Threat Group Profile
incransom
โ Active โ last 30 days
Victim claims
158
First seen
Oct 2024
Last activity
22 Aug 2026
Tracked since
Aug 2023
Group overview
INC Ransom is a prolific ransomware-as-a-service operation active since July 2023 that systematically targets healthcare, government, education, and manufacturing sectors in North America and Europe, having posted over 200 victims in 2025 alone with no sector off-limits.
Preferred targets
Business Services ยท 34
Manufacturing ยท 21
Healthcare ยท 20
Technology ยท 16
Professional Services ยท 10
Financial Services ยท 7
Most targeted countries
US ยท 90
DE ยท 6
AU ยท 5
BR ยท 4
CA ยท 4
MX ยท 3
Tactics & techniques (MITRE ATT&CK)
Initial Access
Valid Accounts
Exploit Public-Facing Application
Phishing
Execution
Windows Management Instrumentation
Command and Scripting Interpreter: Windows Command Shell
System Services: Service Execution
Persistence
Valid Accounts
Privilege Escalation
Valid Accounts
Stealth
Masquerading: Match Legitimate Resource Name or Location
Indicator Removal: File Deletion
Valid Accounts
Discovery
Network Service Discovery
System Network Connections Discovery
Permission Groups Discovery: Domain Groups
Account Discovery: Domain Account
Network Share Discovery
Lateral Movement
Remote Services: Remote Desktop Protocol
Lateral Tool Transfer
Collection
Data Staged
Archive Collected Data: Archive via Utility