INC Ransom

Threat Actors · INC Ransom

· ATT&CK GroupG1032

GOLD IONIC

Techniques

Software

Tactics

Aliases

Description

INC Ransom is a ransomware and data extortion threat group associated with the deployment of INC Ransomware that has been active since at least July 2023. INC Ransom has targeted organizations worldwide most commonly in the industrial, healthcare, and education sectors in the US and Europe.(Citation: Bleeping Computer INC Ransomware March 2024)(Citation: Cybereason INC Ransomware November 2023)(Citation: Secureworks GOLD IONIC April 2024)(Citation: SentinelOne INC Ransomware)

Tactic Coverage

discovery (5)stealth (3)execution (3)command and control (3)initial access (3)lateral movement (2)collection (2)impact (2)persistence (1)privilege escalation (1)exfiltration (1)resource development (1)defense impairment (1)

Techniques Used (25)

T1021.001Remote Desktop Protocol

lateral movement

T1036.005Match Legitimate Resource Name or Location

stealth

T1046Network Service Discovery

discovery

T1047Windows Management Instrumentation

execution

T1049System Network Connections Discovery

discovery

Registration Required

Create a free account to access full Threat Actor Techniques

Showing 5 of 25 results

✓ Personal dashboard✓ Track 1 vendor/product✓ 1 keyword alert✓ Weekly digest✓ 1 CSV export/month

Already have an account? Sign in →

Software Used (8)

S0552AdFindtool S1139INC Ransomwaremalware S0039Nettool S0359Nltesttool S0029PsExectool S1040Rclonetool S0183Tortool S0404esentutl

References (6)

https://attack.mitre.org/groups/G1032 https://www.secureworks.com/blog/gold-ionic-deploys-inc-ransomware https://www.cybereason.com/hubfs/dam/collateral/reports/threat-alert-inc-ransomware.pdf https://www.sentinelone.com/anthology/inc-ransom/https://www.bleepingcomputer.com/news/security/inc-ransom-threatens-to-leak-3tb-of-nhs-scotland-stolen-data/