INC RANSOMWARE

INC Ransomware (also tracked as INC Ransom) is a double-extortion ransomware operation that emerged in mid-2023 and has conducted an aggressive expansion of victims across multiple sectors globally. The group employs both file encryption and data theft, threatening public publication of exfiltrated information on their dedicated Tor leak site to maximise pressure on victims to pay ransom demands.

INC Ransomware has demonstrated a troubling focus on healthcare and education sectors, targeting hospitals, health systems, and universities where data sensitivity and operational disruption create maximum negotiating leverage. The group's attack on NHS Scotland in 2024 generated significant public and government concern in the United Kingdom about the vulnerability of healthcare infrastructure to ransomware attacks.

The group's initial access methodology primarily exploits vulnerabilities in Citrix NetScaler ADC and Gateway appliances, as well as other edge network devices exposed to the public internet. Following initial access, INC operators conduct thorough reconnaissance, establish persistence through multiple access mechanisms, and systematically identify and exfiltrate high-value data prior to deploying their encryption payload network-wide.

INC Ransomware's technical sophistication is assessed as moderate-to-high, evidenced by their consistent ability to navigate enterprise network environments, evade EDR detection during lateral movement phases, and maintain operational security sufficient to avoid attribution despite conducting numerous high-profile attacks. The group's continued expansion and healthcare sector focus make them a priority threat for national cybersecurity agencies.