INC ransomware explainedINC is a ransomware operation associated with file encryption, ransom notes, and as seen in some Huntress investigations, data staging or exfiltration before encryption.Huntress has documented INC-related activity in investigations from 2023, 2024, and in February and September 2026. The observed access paths, tooling, and operator behavior vary by incident, so this profile focuses on documented behaviors rather than presenting a single, fixed INC playbook.Terms such as “INC ransomware group,” “INC operation,” and “INC-related activity” describe the ransomware name and activity observed in specific investigations. They do not establish that every incident involved the same individuals, infrastructure, or operating model.
When did INC ransomware first appear?Public reporting cited by Huntress places the group’s emergence around August 2023. Shortly after, Huntress analysts documented a week-long intrusion involving discovery, data collection, staging, exfiltration, and an attempted deployment of the encryptor, giving defenders an early, detailed look at how an INC incident can unfold from initial access to attempted impact.Huntress has since observed related activity in 2024, 2025, and 2026, including remote management and monitoring (RMM) software abuse and tampering with security controls. These findings are described as activity “observed by Huntress” in specific investigations. We do not claim that every later incident was carried out by the same individuals; ransomware variants are frequently used by more than one set of operators, and corroborating that is outside the scope of a single incident review.
Who created INC ransomware?Huntress investigations have not independently confirmed who is behind INC, and Huntress has identified different access paths and different tooling across INC-related incidents, making the case against treating INC as a single actor with one fixed method of operation.Third-party reporting offers more specific attribution than Huntress’ incident data does on its own. Fortra has reported that INC ransomware is operated by an anonymous, Russia-linked cybercriminal group tracked as INC Ransom (also identified as Gold Ionic or Tarnished Scorpion), operating on a Ransomware-as-a-Service (RaaS) model.As with many ransomware operations, an INC incident can involve several distinct participants regardless of the operator’s identity: an initial access broker who sells or provides entry into a network, an affiliate who conducts the intrusion, and an operator who deploys the encryption payload. These roles may or may not be filled by the same people from one incident to the next, even under a RaaS model.The September 2026 incident Huntress investigated featured a 17-day lull between initial access and deployment of the ransomware and note, which could indicate the use of an initial access broker.
How does INC ransomware spread?INC-related intrusions can involve different access paths and tools. The following stages summarize behaviors observed across specific investigations; they are not requirements for every INC-related intrusion.Stage 1: Initial access and account useHuntress has observed valid-account abuse and Remote Desktop Protocol (RDP) activity in different investigations, along with RMM activity in certain cases.However, the initial access vector could not always be determined because visibility began after the intrusion or was incomplete. The available evidence does not support identifying phishing, a specific vulnerability, RDP, or RMM software as the definitive INC access method.Stage 2: Environment discovery and lateral movementIn the 2023 incident Huntress investigated, the operator performed domain and network discovery, enumerated domain administrator accounts, accessed multiple systems, and interacted with file shares.Observed remote-administration and lateral-movement activity included RDP, Windows Management Instrumentation (WMI), PsExec, and remote service activity. These tools have legitimate administrative uses, so defenders should evaluate the account, host, parent process, timing, destination, and whether the activity matches an approved workflow.In the September 2026 incident, the threat actor leveraged scheduled tasks pointing to PowerShell scripts for lateral movement and persistence.Stage 3: Security control tamperingA 2024 investigation documented activity involving changes to Windows Defender and attempts to interfere with other security controls.The investigation observed SystemSettingsAdminFlows.exe alongside Windows Defender event ID 5007, which records configuration changes. This is an incident-specific detection lead, not a universal signature for INC activity.In the September 2026 incident, the threat actor installed the AnyDesk remote desktop application to deploy netscan.exe and a vulnerable driver. Bring Your Own Vulnerable Driver (BYOVD) is a common tactic where attackers load a legitimate but vulnerable driver to gain kernel-level access, usually to disable security tools before further compromise.Stage 4: Collection, staging, and exfiltrationInvestigations documented data collection, archive creation, staging, and activity involving file-transfer or cloud-storage tools.Observed tools included:7-ZipMEGAsyncResticrclonevRXThese tools have legitimate business uses. Detection should consider which account ran the tool, which process launched it, whether the activity was expected, where data was staged, and whether data was transferred to an approved destination.In a February 2026 investigation, Huntress observed Restic-based data staging and activity associated with cloud-storage infrastructure. This finding describes that investigation and should not be treated as a required technique in every INC-related intrusion.Stage 5: Payload deployment and encryptionIn the 2023 incident Huntress investigated, the encryptor was copied and executed remotely using WMI and PsExec.In February 2026, Huntress observed an INC executable launched from C:\perflogs\win.exe with the switches --sup --hide --mode medium.In September 2026, Huntress observed attackers using Impacket’s atexec.py remote execution utility to remotely execute tools on multiple endpoints by creating and running temporary scheduled tasks. The tasks were used to install the EDR/AV killer driver and launch INC ransomware.Payload names, paths, hashes, and command-line arguments can vary between investigations. These indicators should be correlated with behavior rather than treated as permanent identifiers of INC activity.Stage 6: Extortion and ransom notesINC ransom notes have threatened publication of stolen data. Huntress investigations documented ransom notes including INC-README.txt, DATALEAK_PRESS_RELEASE.txt, and related .inc note filenames.These note patterns are documented examples, not requirements for every INC-related incident. Leak-site listings and threat-actor claims should be treated as unverified unless corroborated by an authoritative source.
Victims of INC ransomware attacksINC-related activity affects organizations across different industries and environments. Rather than naming specific victims, this profile describes targeting and tradecraft at a sector level unless a victim has been publicly named by an authoritative source. Where a Huntress internal incident is referenced, the organization is anonymized and the focus stays on the tradecraft observed.It’s also worth noting that leak-site listings are claims made by the threat actor, not verified confirmations of a breach. Treat them as a starting point for research, not as established fact.
Ransom demands and amountsRansom demands and payment outcomes can vary by victim, sector, and incident. Paying a ransom does not guarantee file recovery or deletion of stolen data.Organizations experiencing a ransomware incident should involve appropriate incident-response, legal, insurance, and law-enforcement resources.
Technical analysis of INC RansomwareHuntress investigations documented the following characteristics in specific INC-related samples and incidents.File encryption and impactThe encryptor targets files on affected systems, making them inaccessible until they are restored or decrypted.Ransom-note names and file extensionsThe 2023 investigation documented:.inc as an encrypted-file extensionRansom notes named similarly to INC-README.txtIn a 2026 investigation, Huntress researchers found two INC ransom notes on the victim organization’s impacted systems. The second note, DATALEAK_PRESS_RELEASE.txt, appeared to be an attempt to place further pressure on the victim.These indicators should be scoped to the relevant investigation and should not be treated as immutable signatures.Execution locationsInvestigations observed payloads executed from operational or temporary locations, including:C:\perflogs\win.exeC:\Users\win.exeC:\ProgramData\w.exeC:\Users\Public \ hwau.exePaths and filenames can change between incidents.Command-line switchesOne observed sample used the following switches:--hide--sup--mode mediumThese switches were associated with a specific sample and should not be treated as stable identifiers across all INC-related activity.Restart Manager API useA February 2026 investigation noted apparent use of the Restart Manager API. This behavior may allow a process to release file locks so encryption can proceed against files that are otherwise in use.Sample variationHashes, filenames, paths, command-line arguments, supporting tools, and infrastructure can vary between incidents.The presence of an INC ransom note or file extension does not independently establish that the same operator conducted the preceding intrusion. Malware identity and operator identity are separate questions.
Observed tactics, techniques, and proceduresThe table below summarizes behaviors documented in specific investigations.TacticObserved behaviorExampleDefensive takeawayInitial AccessValid-account abuse and remote-access activityCompromised accounts and RDP activityRequire MFA for remote access and privileged accounts; investigate unusual loginsExecutionCommand shell, PowerShell, WMI, or remote administrationRemote command executionReview unusual scripting and WMI activity outside approved workflowsPersistenceServices or scheduled tasks where supported by incident evidenceAttacker-created services or scheduled tasksReview new services and scheduled tasks against an established baselineDefense EvasionSecurity-tool configuration changes or removal attemptsWindows Defender configuration changesAlert on unexpected security-control changes and product removalDiscoveryDomain, account, network, and share enumerationDomain administrator discoveryInvestigate sequences of discovery commands across hostsLateral MovementRDP, WMI, PsExec, and remote service activityMovement between multiple systemsRestrict remote administration to approved users, hosts, and workflowsCollectionFile collection and archive creation7-Zip archive activityReview archive utilities used outside normal workflowsExfiltrationStaging and file-transfer activityMEGAsync, rclone, Restic, or cloud-storage activityMonitor unsanctioned transfer destinations and unusual outbound data movementImpactData encrypted for impact.inc filesMaintain tested, offline, or immutable backups
Indicators of compromise (IOC)CategoryIndicatorSource incidentRansom-note nameINC-README.txt2023 and 2026 investigationsEncrypted-file extension.inc2023 investigationExecution pathC:\perflogs\win.exeFebruary 2026 investigationExecution pathC:\Users\win.exeSpecific approved investigationExecution pathC:\ProgramData\w.exeSpecific approved investigationFilenamettt.exeSpecific approved investigationFilenamewin.exeSpecific approved investigationBehavioral signalWindows Defender configuration changes2024 investigationBehavioral signalSecurity-product removal attemptsFebruary 2026 investigationBehavioral signalUnusual RDP, WMI, or PsExec activity2023 investigationBehavioral signalUnexpected RMM installation or use2024 investigationSecond ransom note nameDATALEAK_PRESS_RELEASE.txtSeptember 2026 investigationObfuscated PowerShell implant referenced by an early scheduled taskC:\ProgramData\Vendettister\jocularities.ps1September 2026 investigationDomain contacted by the obfuscated PowerShell implantthroughoutes[.]netSeptember 2026 investigationCommand-and-control IP associated with the observed AnyDesk installation213.111.185[.]108September 2026 investigationEDR/AV killer component found in C:\Users\Public\ on a domain controllerhwau.exeSeptember 2026 investigationRenamed Vicarius vRx executable, observed in C:\Program Files\7-Zip\HealthUpdater.exeSeptember 2026 investigationDriver loaded by the HwAudio kernel-driver serviceHWAuidoOs2Ec.sysSeptember 2026 investigationKernel-driver service used to load the EDR/AV killer driverHwAudioSeptember 2026 investigation
Impact of INC ransomware attacksThe impact of an INC-related incident can include:File unavailability and operational disruptionPotential exposure of data collected before encryptionReduced security visibility after security controls are modified or removedLateral spread across servers and workstationsIncident response, recovery, legal, and notification costsReputational pressure and prolonged business disruption
INC ransomware response and recoveryResponse should follow the evidence identified in the intrusion.Isolate and preserveIsolate affected systems and preserve relevant evidence before making changes that could destroy forensic information.Contain identity riskDisable or restrict compromised accounts and rotate affected credentials according to the incident-response plan.Review remote access pathsAudit RDP, VPN, RMM, WMI, PsExec, services, and scheduled tasks for unexplained activity.Restore security controlsRe-enable or reinstall security tools after containment, following the organization’s incident-response procedures and product-specific guidance.Hunt broadlySearch the environment for related accounts, tools, paths, hashes, command-line patterns, scheduled tasks, services, and network destinations.Validate before restorationConfirm that backups are clean and usable before restoring systems. Rebuild compromised systems where appropriate.Engage appropriate supportConsider engaging law enforcement, legal counsel, cyber insurance, external incident responders, and relevant technology providers.Early endpoint visibility, centralized logging, and analyst review can help organizations investigate activity before encryption occurs. These capabilities do not guarantee prevention, containment, recovery, decryption, or deletion of stolen data.
Is INC ransomware still a threat?Huntress has documented INC-related activity as recently as September 2026.These observations demonstrate recent activity associated with the INC ransomware name, but they do not prove that one group has operated continuously since 2023 or that every incident involved the same operators.Defenders should focus on behaviors observed in the relevant investigations, including:Valid-account abuseRemote-access activitySecurity-control tamperingData staging or exfiltrationArchive and file-transfer activityRemote payload deploymentEncryption-related behavior
Mitigation and prevention strategiesOrganizations should consider the following controls:Require phishing-resistant MFA for remote access and privileged accounts.Remove or disable unused VPN, RDP, RMM, and remote-access accounts.Restrict RDP, WMI, PsExec, and RMM tools to approved users and systems.Maintain complete endpoint coverage and centralized logging.Alert on security-tool tampering, unexpected RMM installation, and Defender configuration changes.Monitor archive, backup, and synchronization utilities used outside approved workflows.Segment critical servers and limit administrative privileges.Maintain tested, offline, or immutable backups.Build and rehearse an incident-response playbook for suspected ransomware activity.Review identity telemetry for suspicious logins, compromised accounts, and unusual privilege use.
Latest news
Related ransomware education
Click Here For The Original Source.
——————————————————–
