# INC Ransom leaks SpearFin fund administrator data

Published: 2026-08-18 · Severity: high · Sectors: financial-services
Canonical: https://vorant.io/reports/3e34dc11-8c1b-5e61-9da6-a84dd03c3d8a/inc-ransom-leaks-spearfin-fund-administrator-data

> Ransomware group INC Ransom claims a 416GB data leak from SpearFin Ltd, a fund administration and compliance services firm managing $10B in assets.

Ransomware.live reports that INC Ransom, an extortion-focused ransomware operation, has listed SpearFin Ltd as a victim on its leak site. SpearFin is a fund administration, compliance, and investor relations provider overseeing approximately $10 billion in assets under administration. The group claims to have exfiltrated 416GB of highly sensitive financial and client data, including NDAs, KYC documentation (passports, certificates), AML audit records, bank statements and payrolls, loan documents, share registries, and director registers.

The leak reportedly implicates dozens of downstream clients across investment funds, private equity, and corporate services sectors, including named entities such as Apex Fund Services, Amicorp Capital, and MIC Electronics. Given SpearFin's role as a third-party administrator, this incident carries potential cascading exposure risk for its numerous fund and corporate clients whose confidential financial records may be included in the breach. Full publication of the stolen data is stated to be pending, indicating this is likely a pressure tactic ahead of a possible ransom negotiation deadline.

## Mentioned in this report

- Threat actors: INC Ransom
- Malware: INC Ransom

## Detection guidance (public sample)

### Volume Shadow Copy Deletion via vssadmin or WMIC

ATT&CK: T1486

Detects deletion of Volume Shadow Copies via vssadmin, wmic or PowerShell shadowcopy calls - a standard pre-encryption step used by ransomware operators (including INC Ransom-style operations) to prevent file recovery before mass encryption. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Volume Shadow Copy Deletion via vssadmin or WMIC
description: Detects command-line invocation of vssadmin, wmic or PowerShell to delete
  Volume Shadow Copies or disable recovery, a common precursor to ransomware encryption
  used to impede recovery efforts (T1486).
tags:
- attack.impact
- attack.t1486
logsource:
  category: process_creation
  product: windows
detection:
  selection_vssadmin:
    Image|endswith: \vssadmin.exe
    CommandLine|contains|all:
    - delete
    - shadow
  selection_wmic:
    Image|endswith: \wmic.exe
    CommandLine|contains|all:
    - shadowcopy
    - delete
  selection_bcdedit:
    Image|endswith: \bcdedit.exe
    CommandLine|contains|all:
    - recoveryenabled
    - 'no'
  selection_powershell:
    Image|endswith:
    - \powershell.exe
    - \pwsh.exe
    CommandLine|contains|all:
    - Get-WmiObject
    - Win32_ShadowCopy
  condition: 1 of selection_*
falsepositives:
- Legitimate backup software or storage-cleanup scripts occasionally invoking vssadmin/wmic
  shadow deletion
- IT administrators manually clearing shadow copies to free disk space
level: high
id: 0c7eec6a-943f-5458-98c1-746be4d283a6
status: experimental
author: Vorant
```

### Mass File Renaming with New Extension Consistent with Ransomware Encryption

ATT&CK: T1486

Detects a high-volume burst of file rename/write events appending a uniform new extension across many files in a short period, consistent with ransomware batch-encrypting a victim's file estate as reported for INC Ransom style operations. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Mass File Renaming with New Extension Consistent with Ransomware Encryption
description: Detects a large number of file modify/rename events on user or share
  directories where files are rewritten with an unfamiliar, uniform extension in a
  short window - a behavioural pattern of ransomware bulk-encrypting data prior to
  leak-site extortion (T1486). The volume/time threshold described here should be
  enforced by the SIEM's correlation layer, not encoded in this rule's condition.
tags:
- attack.impact
- attack.t1486
logsource:
  category: file_event
  product: windows
detection:
  selection:
    TargetFilename|contains:
    - \Users\
    - \Shares\
    - \Documents\
    TargetFilename|endswith:
    - .locked
    - .enc
    - .inc
    - .crypt
  filter_backup_software:
    Image|endswith:
    - \veeam.exe
    - \backupexec.exe
  condition: selection and not filter_backup_software
falsepositives:
- Legitimate encryption/compression utilities configured to write these extensions
- Backup or archival software renaming files during routine jobs
level: medium
id: 5592d9a1-138f-5a63-872a-d91caa8a28ee
status: experimental
author: Vorant
```

### Execution of Rclone or Similar Sync Tool with Remote Cloud Configuration for Bulk Exfiltration

ATT&CK: T1567

Detects execution of rclone.exe (or similarly-named cloud-sync utilities) with configuration/copy flags targeting a remote cloud storage backend, a technique commonly used by ransomware/extortion actors to stage bulk exfiltration of victim data prior to leak-site publication. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Execution of Rclone or Similar Sync Tool with Remote Cloud Configuration for
  Bulk Exfiltration
description: Detects command-line execution of rclone or comparable sync utilities
  with flags indicating configuration of a remote cloud endpoint and copy/sync operations
  against local directories - a known pattern for bulk staged exfiltration to web/cloud
  storage services ahead of ransomware extortion (T1567).
tags:
- attack.exfiltration
- attack.t1567
logsource:
  category: process_creation
  product: windows
detection:
  selection_tool:
    Image|endswith:
    - \rclone.exe
    - \rclone
  selection_args:
    CommandLine|contains:
    - copy
    - sync
    - move
  selection_config:
    CommandLine|contains:
    - config
    - --config
  condition: selection_tool and selection_args and selection_config
falsepositives:
- Authorized IT staff using rclone for legitimate backup or cloud migration tasks
- Data engineering teams syncing large datasets to approved cloud storage as part
  of normal operations
level: medium
id: 7f62b21c-eb9a-51fb-b139-3d687b07e12f
status: experimental
author: Vorant
```

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://www.ransomware.live/id/U3BlYXJGaW4gTHRkQGluY3JhbnNvbQ==

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/3e34dc11-8c1b-5e61-9da6-a84dd03c3d8a/inc-ransom-leaks-spearfin-fund-administrator-data.
Full IOC sets, deployable detections, the entity graph, TAXII 2.1 feed and real-time alerts: https://vorant.io/signup