Skip to content

INC Ransom

INC Ransom is a ransomware and data extortion threat group associated with the deployment of INC Ransomware that has been active since at least July 2023. INC Ransom has targeted organizations worldwide most commonly in the industrial, healthcare, and education sectors in the US and Europe.

ATT&CK ID: G1032
Techniques: 25
Tools: 8

Also tracked as GOLD IONIC

Vulnerabilities it has exploited

CVE-2023-3519 Citrix NetScaler ADC and NetScaler GatewayUnscored · exploited in the wild

Techniques

Resource Development

Obtain Capabilities

Initial Access

Valid Accounts Exploit Public-Facing Application Phishing

Execution

Windows Management Instrumentation Command and Scripting Interpreter System Services

Persistence

Privilege Escalation

Stealth

Masquerading Indicator Removal Valid Accounts

Defense Impairment

Disable or Modify Tools

Discovery

Network Service Discovery System Network Connections Discovery Permission Groups Discovery Account Discovery Network Share Discovery

Lateral Movement

Remote Services Lateral Tool Transfer

Collection

Data Staged Archive Collected Data

Command and Control

Application Layer Protocol Ingress Tool Transfer Remote Access Tools

Exfiltration

Transfer Data to Cloud Account

Impact

Data Encrypted for Impact Financial Theft

Software

AdFind · INC Ransomware · Net · Nltest · PsExec · Rclone · Tor · esentutl

MITRE ATT&CK All threat actors