Inc Ransomware

Description

INC Ransom (also Incransom) is a ransomware-as-a-service (RaaS) group that emerged in mid-2023, also known as GOLD IONIC. They use spearphishing techniques along with double extortion—exfiltrating data before encryption and threatening leaks.

The group operates professionally with affiliates, primarily targeting North America and Europe across healthcare, manufacturing, government, and education sectors.

Objectives

Financial Gain

Known Infection Vectors

• Exploiting public-facing applications (CVE-2023-3519 Citrix Bleed)
• Phishing for initial access
• Using compromised valid accounts (RDP/VPN)
• Partnerships with initial access brokers (GootLoader)

References

Inc Ransom

https://attack.mitre.org/groups/G1032/