INC Ransomware

MITRE ATT&CK: S1139 View on attack.mitre.org

Aliases: INC Ransomware

First seen
2023-01-01 00:00:00
Malware type
ransomware
Family
Malware family
Operating systems
windows
Profile updated
2026-07-07 13:19:11

Targeted industries: financial-services healthcare-and-pharmaceutical government-and-public-sector manufacturing technology-and-telecommunications

Context

INC Ransomware is a ransomware strain that has been used by the INC Ransom group since at least 2023 against multiple industry sectors worldwide. INC Ransomware can employ partial encryption combined with multi-threading to speed encryption.

Detection coverage

  • 1 YARA rules
  • 177 Sigma rules

Malware & tools used

  • Lateral Tool Transfer (attack-pattern)
  • Phishing (attack-pattern)
  • Native API (attack-pattern)
  • Device Driver Discovery (attack-pattern)
  • Inhibit System Recovery (attack-pattern)
  • Windows Management Instrumentation (attack-pattern)
  • Local Storage Discovery (attack-pattern)
  • Network Share Discovery (attack-pattern)
  • Data Encrypted for Impact (attack-pattern)
  • Deobfuscate/Decode Files or Information (attack-pattern)
  • File and Directory Discovery (attack-pattern)
  • Process Discovery (attack-pattern)
  • Service Stop (attack-pattern)
  • Internal Defacement (attack-pattern)
  • Peripheral Device Discovery (attack-pattern)

Used by threat actors

Detection rules

  • SIGNATURE_BASE_MAL_RANSOM_INC_Aug24 (yara-rule)

Reports & references

  • secureworks.com — Gold Ionic Deploys Inc Ransomware (report)
  • sentinelone.com — Inc Ransom (report)
  • MITRE ATT&CK — S1139 (report)
  • huntress.com — Investigating New Inc Ransom Group Activity (report)

External references