Threat Group Profile
incransom
● Active — last 30 days
Victim claims
158
First seen
Oct 2024
Last activity
22 Aug 2026
Tracked since
Aug 2023
Group overview
INC Ransom is a prolific ransomware-as-a-service operation active since July 2023 that systematically targets healthcare, government, education, and manufacturing sectors in North America and Europe, having posted over 200 victims in 2025 alone with no sector off-limits.
Preferred targets
Business Services · 34
Manufacturing · 21
Healthcare · 20
Technology · 16
Professional Services · 10
Financial Services · 7
Most targeted countries
US · 90
DE · 6
AU · 5
BR · 4
CA · 4
MX · 3
Tactics & techniques (MITRE ATT&CK)
Initial Access
Valid Accounts
Exploit Public-Facing Application
Phishing
Execution
Windows Management Instrumentation
Command and Scripting Interpreter: Windows Command Shell
System Services: Service Execution
Persistence
Valid Accounts
Privilege Escalation
Valid Accounts
Stealth
Masquerading: Match Legitimate Resource Name or Location
Indicator Removal: File Deletion
Valid Accounts
Discovery
Network Service Discovery
System Network Connections Discovery
Permission Groups Discovery: Domain Groups
Account Discovery: Domain Account
Network Share Discovery
Lateral Movement
Remote Services: Remote Desktop Protocol
Lateral Tool Transfer
Collection
Data Staged
Archive Collected Data: Archive via Utility