Threat Group Profile
incransom
● Active — last 30 days
Victim claims
103
First seen
Oct 2024
Last activity
06 Jul 2026
Tracked since
—
Group overview
INC Ransom is a prolific ransomware-as-a-service operation active since July 2023 that systematically targets healthcare, government, education, and manufacturing sectors in North America and Europe, having posted over 200 victims in 2025 alone with no sector off-limits.
Preferred targets
Business Services · 32
Healthcare · 13
Manufacturing · 12
Technology · 10
Consumer Services · 5
Education · 4
Most targeted countries
US · 64
DE · 5
BR · 4
AU · 3
IT · 2
MX · 2
