incransom ransomware group
INC Ransom is a prolific ransomware-as-a-service operation active since July 2023 that systematically targets healthcare, government, education, and manufacturing sectors in North America and Europe, having posted over 200 victims in 2025 alone with no sector off-limits.
- Claims in 7 days
- 46
- Claims in 30 days
- 61
- Reported techniques
- 25
Listings on leak sites are claims by criminals. They are unverified and can be false. coldbraid shows counts here, not names.
Where it claims victims
| Country | Claims in 60 days |
|---|---|
| United States | 31 |
| India | 4 |
| Canada | 4 |
| Sweden | 2 |
| United Arab Emirates | 2 |
| Germany | 2 |
| Thailand | 1 |
| Philippines | 1 |
Sectors
| Sector | Claims in 60 days |
|---|---|
| Professional Services | 14 |
| Other | 10 |
| Financial Services | 7 |
| Technology | 5 |
| Retail & E-Commerce | 3 |
| Government & Defense | 3 |
| Healthcare | 3 |
| Education | 3 |
Reported techniques
Valid AccountsExploit Public-Facing ApplicationPhishingWindows Management InstrumentationCommand and Scripting InterpreterSystem ServicesMasqueradingIndicator RemovalNetwork Service DiscoverySystem Network Connections DiscoveryPermission Groups DiscoveryAccount DiscoveryNetwork Share DiscoveryRemote ServicesLateral Tool TransferData StagedArchive Collected DataTransfer Data to Cloud AccountApplication Layer ProtocolIngress Tool TransferRemote Access ToolsData Encrypted for ImpactFinancial TheftObtain CapabilitiesDisable or Modify Tools