INC ransomware claims 830 victims since 2023
INC ransomware has become one of 2026's most prolific cybercrime operations with 830 victims since August 2023, targeting US organizations across legal, manufacturing, healthcare, and tech sectors.
Sourcethehackernews.com — open the original
What to check
- Applies to
- The 4 CVEs named below. Whether you run an affected version is not assessed: check the versions the source lists.
- Exploitation
- CISA lists CVE-2023-3519, CVE-2023-48788, CVE-2024-57727, and CVE-2025-5777 as exploited in the wild.
INC ransomware has evolved from a nascent operation into one of the most prolific ransomware-as-a-service groups in 2026, claiming at least 830 victims since August 2023. The group capitalized on the disruption of LockBit and shutdown of BlackCat, attracting migrating affiliates to expand operations. United States organizations account for over 65% of listed victims, with legal services, manufacturing, construction, technology, and healthcare being the most heavily targeted sectors. The group has rewritten its Windows and Linux/ESXi encryptors in Rust to enable easier cross-platform development and resist reverse engineering.
INC affiliates employ a sophisticated attack chain beginning with initial access via spear-phishing, purchased credentials from initial access brokers, or exploitation of vulnerabilities in public-facing applications including Citrix Netscaler, Fortinet EMS, and SimpleHelp. Attackers use an updated credential dumper targeting newer Veeam backup deployments with salted DPAPI encryption, then move laterally using living-off-the-land binaries like RDP and PsExec. The group impairs defenses using bring-your-own-vulnerable-driver techniques and establishes command-and-control through Cobalt Strike and commercial RMM tools including AnyDesk, ScreenConnect, and TeamViewer before exfiltrating data with Rclone and deploying ransomware.
The sale of INC's ransomware variants on the cybercrime underground in May 2024 has spawned related families such as Lynx and Sinobi with significant code overlap. INC emerged as the fourth most prominent ransomware group in Q1 2026 with over 120 incidents, demonstrating that groups can achieve significant scale using widely known techniques rather than advanced tradecraft. The threat is amplified in targeted sectors that depend on uninterrupted operations and supply chains, creating financial pressure to pay and increasing collateral exposure across vendor networks.
Mentioned in this report
Detection guidance
Rclone Execution with Sync/Copy Flags Indicative of Cloud Exfiltration
A behavioural hunt for the technique in general, not a signature for the CVEs this report names.
Detects execution of rclone.exe with copy/sync subcommands typically used by INC ransomware affiliates to exfiltrate staged data to cloud storage prior to encryption. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Rclone Execution with Sync/Copy Flags Indicative of Cloud Exfiltration
id: 705e38c4-8f79-5fa0-a861-bfa45b6dec83
status: experimental
description: Detects execution of rclone.exe with copy/sync subcommands, a pattern
commonly used by INC ransomware affiliates to exfiltrate data to cloud storage before
deploying ransomware.
references:
- https://attack.mitre.org/techniques/T1567/002/
logsource:
category: process_creation
product: windows
detection:
selection_img:
- Image|endswith: \\rclone.exe
- OriginalFileName: rclone.exe
selection_cmd:
CommandLine|contains:
- ' copy '
- ' sync '
- ' move '
selection_flags:
CommandLine|contains:
- --config
- --min-age
- --transfers
- --drive-chunk-size
filter:
CommandLine|contains:
- rclone.conf --dry-run
condition: selection_img and selection_cmd and selection_flags and not filter
falsepositives:
- IT administrators using rclone for legitimate backup or file synchronization tasks
- Scheduled backup jobs configured to use rclone to approved cloud storage
level: high
tags:
- attack.t1567.002
- attack.exfiltration
author: Vorant
PsExec Remote Execution with Accepteula and System Flags
A behavioural hunt for the technique in general, not a signature for the CVEs this report names.
Detects PsExec or PsExec64 execution with -accepteula combined with -s/-d flags used by INC affiliates for lateral tool transfer and remote command execution across compromised hosts. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: PsExec Remote Execution with Accepteula and System Flags
id: 3e5fc923-00aa-56bd-9aa6-9b558c764a71
status: experimental
description: Detects invocation of PsExec/PsExec64 with -accepteula and -s (system)
or -d (non-interactive) flags, a pattern consistent with INC ransomware affiliates
moving laterally and pushing tools/payloads to remote hosts using living-off-the-land
binaries.
references:
- https://attack.mitre.org/techniques/T1570/
logsource:
category: process_creation
product: windows
detection:
selection_img:
- Image|endswith:
- \\PsExec.exe
- \\PsExec64.exe
- OriginalFileName: psexec.c
selection_flags:
CommandLine|contains: -accepteula
selection_mode:
CommandLine|contains:
- ' -s '
- ' -d '
filter:
ParentImage|endswith: \\sccm\\ccmexec.exe
condition: selection_img and selection_flags and selection_mode and not filter
falsepositives:
- Legitimate administrative use of PsExec for remote system management
- Software deployment or patching tools wrapping PsExec calls
level: medium
tags:
- attack.t1570
- attack.lateral-movement
author: Vorant
Suspicious Query Against Veeam Backup Credential Database
A behavioural hunt for the technique in general, not a signature for the CVEs this report names.
Detects command-line or SQL client activity querying the Veeam Backup & Replication credentials table, consistent with the updated INC credential dumper targeting salted DPAPI-protected Veeam secrets. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Suspicious Query Against Veeam Backup Credential Database
id: f3f491cb-d490-53c1-9339-989a6f43c62b
status: experimental
description: Detects process command lines referencing the Veeam Backup & Replication
credentials store combined with keywords indicating extraction of stored/encrypted
secrets, matching the technique used by INC affiliates to dump credentials from
Veeam deployments protected by DPAPI.
references:
- https://attack.mitre.org/techniques/T1003/
logsource:
category: process_creation
product: windows
detection:
selection_veeam:
CommandLine|contains:
- Veeam.Backup
- VeeamBackup
selection_creds:
CommandLine|contains:
- Credentials
- DPAPI
- Password
- dbo.Credentials
selection_tooling:
Image|endswith:
- \\sqlcmd.exe
- \\powershell.exe
- \\powershell_ise.exe
condition: selection_veeam and selection_creds and selection_tooling
falsepositives:
- Veeam administrators running legitimate maintenance or credential rotation scripts
- Backup software vendor support scripts querying the Veeam configuration database
level: high
tags:
- attack.t1003
- attack.credential-access
author: Vorant
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://thehackernews.com/2026/06/inc-ransomware-claims-830-victims-since.html
Free public brief. The detections with Splunk SPL already written (plus Elastic and KQL where they apply) are in the app with a free account, no card. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them.
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply) and live profiles of the CVEs, actors, and malware it names. The paid plans add the security research and news reporting the free tier leaves out.
It sits in a corpus of 16,445 reports from 149 sources, 666 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them, not the rest of the week's. Nothing is charged unless you subscribe.
Create a free account What it costs