VORANT. Threat Intelligence Sign in Get the full feed

INC ransomware claims 830 victims since 2023

high threat healthcaremanufacturingtechnologynon-profit

INC ransomware has become one of 2026's most prolific cybercrime operations with 830 victims since August 2023, targeting US organizations across legal, manufacturing, healthcare, and tech sectors.

INC ransomware has evolved from a nascent operation into one of the most prolific ransomware-as-a-service groups in 2026, claiming at least 830 victims since August 2023. The group capitalized on the disruption of LockBit and shutdown of BlackCat, attracting migrating affiliates to expand operations. United States organizations account for over 65% of listed victims, with legal services, manufacturing, construction, technology, and healthcare being the most heavily targeted sectors. The group has rewritten its Windows and Linux/ESXi encryptors in Rust to enable easier cross-platform development and resist reverse engineering.

INC affiliates employ a sophisticated attack chain beginning with initial access via spear-phishing, purchased credentials from initial access brokers, or exploitation of vulnerabilities in public-facing applications including Citrix Netscaler, Fortinet EMS, and SimpleHelp. Attackers use an updated credential dumper targeting newer Veeam backup deployments with salted DPAPI encryption, then move laterally using living-off-the-land binaries like RDP and PsExec. The group impairs defenses using bring-your-own-vulnerable-driver techniques and establishes command-and-control through Cobalt Strike and commercial RMM tools including AnyDesk, ScreenConnect, and TeamViewer before exfiltrating data with Rclone and deploying ransomware.

The sale of INC's ransomware variants on the cybercrime underground in May 2024 has spawned related families such as Lynx and Sinobi with significant code overlap. INC emerged as the fourth most prominent ransomware group in Q1 2026 with over 120 incidents, demonstrating that groups can achieve significant scale using widely known techniques rather than advanced tradecraft. The threat is amplified in targeted sectors that depend on uninterrupted operations and supply chains, creating financial pressure to pay and increasing collateral exposure across vendor networks.

Mentioned in this report

Vulnerabilities CVE-2023-3519KEVCVE-2023-48788KEVCVE-2024-57727KEVCVE-2025-5777KEV
Threat actors INC Ransomware
Malware Cobalt StrikeINCLynxRcloneSinobi

Detection guidance

Rclone Execution with Sync/Copy Flags Indicative of Cloud Exfiltration

ATT&CK T1567.002

Detects execution of rclone.exe with copy/sync subcommands typically used by INC ransomware affiliates to exfiltrate staged data to cloud storage prior to encryption. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

title: Rclone Execution with Sync/Copy Flags Indicative of Cloud Exfiltration
id: 705e38c4-8f79-5fa0-a861-bfa45b6dec83
status: experimental
description: Detects execution of rclone.exe with copy/sync subcommands, a pattern
  commonly used by INC ransomware affiliates to exfiltrate data to cloud storage before
  deploying ransomware.
references:
- https://attack.mitre.org/techniques/T1567/002/
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
  - Image|endswith: \\rclone.exe
  - OriginalFileName: rclone.exe
  selection_cmd:
    CommandLine|contains:
    - ' copy '
    - ' sync '
    - ' move '
  selection_flags:
    CommandLine|contains:
    - --config
    - --min-age
    - --transfers
    - --drive-chunk-size
  filter:
    CommandLine|contains:
    - rclone.conf --dry-run
  condition: selection_img and selection_cmd and selection_flags and not filter
falsepositives:
- IT administrators using rclone for legitimate backup or file synchronization tasks
- Scheduled backup jobs configured to use rclone to approved cloud storage
level: high
tags:
- attack.T1567.002
- attack.exfiltration
author: Vorant

PsExec Remote Execution with Accepteula and System Flags

ATT&CK T1570

Detects PsExec or PsExec64 execution with -accepteula combined with -s/-d flags used by INC affiliates for lateral tool transfer and remote command execution across compromised hosts. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

title: PsExec Remote Execution with Accepteula and System Flags
id: 3e5fc923-00aa-56bd-9aa6-9b558c764a71
status: experimental
description: Detects invocation of PsExec/PsExec64 with -accepteula and -s (system)
  or -d (non-interactive) flags, a pattern consistent with INC ransomware affiliates
  moving laterally and pushing tools/payloads to remote hosts using living-off-the-land
  binaries.
references:
- https://attack.mitre.org/techniques/T1570/
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
  - Image|endswith:
    - \\PsExec.exe
    - \\PsExec64.exe
  - OriginalFileName: psexec.c
  selection_flags:
    CommandLine|contains: -accepteula
  selection_mode:
    CommandLine|contains:
    - ' -s '
    - ' -d '
  filter:
    ParentImage|endswith: \\sccm\\ccmexec.exe
  condition: selection_img and selection_flags and selection_mode and not filter
falsepositives:
- Legitimate administrative use of PsExec for remote system management
- Software deployment or patching tools wrapping PsExec calls
level: medium
tags:
- attack.T1570
- attack.lateral_movement
author: Vorant

Suspicious Query Against Veeam Backup Credential Database

ATT&CK T1003

Detects command-line or SQL client activity querying the Veeam Backup & Replication credentials table, consistent with the updated INC credential dumper targeting salted DPAPI-protected Veeam secrets. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

title: Suspicious Query Against Veeam Backup Credential Database
id: f3f491cb-d490-53c1-9339-989a6f43c62b
status: experimental
description: Detects process command lines referencing the Veeam Backup & Replication
  credentials store combined with keywords indicating extraction of stored/encrypted
  secrets, matching the technique used by INC affiliates to dump credentials from
  Veeam deployments protected by DPAPI.
references:
- https://attack.mitre.org/techniques/T1003/
logsource:
  category: process_creation
  product: windows
detection:
  selection_veeam:
    CommandLine|contains:
    - Veeam.Backup
    - VeeamBackup
  selection_creds:
    CommandLine|contains:
    - Credentials
    - DPAPI
    - Password
    - dbo.Credentials
  selection_tooling:
    Image|endswith:
    - \\sqlcmd.exe
    - \\powershell.exe
    - \\powershell_ise.exe
  condition: selection_veeam and selection_creds and selection_tooling
falsepositives:
- Veeam administrators running legitimate maintenance or credential rotation scripts
- Backup software vendor support scripts querying the Veeam configuration database
level: high
tags:
- attack.T1003
- attack.credential_access
author: Vorant

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://thehackernews.com/2026/06/inc-ransomware-claims-830-victims-since.html

This is the public brief

Subscribers see the full picture: extracted IOCs, ready-to-deploy detections (Sigma, Splunk, KQL, Elastic, YARA, Suricata), the entity graph, TAXII 2.1 feed and real-time alerts matched to your sectors.

Start free