The ransomware group INC has become one of the most active ransomware-as-a-service operations by doing the basics well.
According to research from Acronis, INC emerged in 2023 and has claimed more than 800 victims to date. The group gained momentum after disruptions to larger ransomware brands such as ALPHV/BlackCat and LockBit, creating space for newer, more aggressive groups to recruit affiliates and expand.
INC does not stand out because of highly original malware or advanced custom tooling. Instead, its success comes from scalability, aggressive victim selection, and reliable intrusion methods that continue to work across many organizations.
That is exactly why the group is dangerous.
A Ransomware Group Built for Scale
INC operates as a ransomware-as-a-service group.
In this model, the core operators provide malware, infrastructure, leak sites, negotiation support, and operational guidance. Affiliates then conduct intrusions and deploy ransomware, sharing profits with the operators.
This structure allows ransomware groups to scale quickly.
INC appears to have benefited from rapid affiliate growth at a time when law enforcement action, internal disputes, and the collapse or disruption of major groups were reshaping parts of the ransomware ecosystem.
As affiliates looked for new platforms, groups like INC were able to attract operators who already knew how to compromise networks and pressure victims.
Double Extortion as the Core Model
INC uses the standard double extortion model.
That means victims are pressured in two ways:
- Their systems are encrypted, disrupting operations.
- Their stolen data is threatened with public release if they do not pay.
This model remains effective because many organizations cannot tolerate either outcome.
The operational disruption can stop business processes, while the data leak threat can create legal, regulatory, reputational, and customer-trust consequences.
INC has targeted sectors where both types of pressure are especially painful.
Sectors Targeted by INC
INC has claimed victims across many industries, including:
- manufacturing
- legal services
- healthcare
- technology
- construction
- education
- public-sector-related organizations
The group appears to favor organizations that hold sensitive data and face immediate operational pressure when systems go offline.
Healthcare is a clear example. Attacks against hospitals and health systems can disrupt patient care, appointments, records access, and internal coordination. Legal and education organizations also hold sensitive personal and institutional data that can increase extortion leverage.
INC has been linked to high-profile attacks against organizations such as NHS Dumfries & Galloway and Alder Hey Children’s Hospital in the United Kingdom.
This victim selection strategy increases pressure to pay.
No Need for Novel Techniques
One of the most important lessons from INC is that ransomware operations do not need highly novel techniques to be successful.
Acronis researchers noted that INC relies on proven intrusion methods rather than technical innovation.
Common initial access methods include:
- spear-phishing
- stolen or valid account credentials
- access purchased from initial access brokers
- exploitation of known vulnerabilities
- abuse of exposed remote services
INC has reportedly exploited vulnerabilities such as:
- Citrix Bleed 2, CVE-2025-5777
- SimpleHelp RMM, CVE-2024-57727
- Citrix NetScaler, CVE-2023-3519
- Fortinet EMS, CVE-2023-48788
These are not exotic attack paths. They are the kinds of weaknesses defenders already know they need to control.
The problem is that enough organizations still leave them exposed.
The INC Intrusion Playbook
Once inside a network, INC follows a familiar ransomware playbook.
The group performs discovery using basic commands and established tools, including:
pingcmd.exe- Advanced IP Scanner
- netscan
For credential theft, INC has used scripts and common post-exploitation techniques. For lateral movement, it relies on living-off-the-land binaries and legitimate tools already present in Windows environments.
For evasion, the group uses tools designed to disable or interfere with endpoint detection and response products.
For command and control, INC uses red team tools and commercial remote access utilities.
For data theft, the group packages stolen data into archives and uploads it to attacker-controlled cloud storage.
None of this is especially unusual. But it is effective.
Windows, Linux, and ESXi Targets
INC’s ransomware has variants for both Windows and Linux/ESXi environments.
That matters because VMware ESXi servers are common in enterprise environments and often host critical virtual machines.
Encrypting ESXi infrastructure can multiply the impact of an attack because one compromised hypervisor can affect many workloads.
More recent INC malware versions have reportedly been rewritten in Rust.
Rust is attractive to ransomware developers because it can support cross-platform development and can make malware harder to reverse engineer. It also gives developers a more maintainable codebase across operating systems.
Again, this is not necessarily groundbreaking, but it improves operational efficiency.
Source Code Resale and Reuse
INC’s malware has also reportedly been sold to other threat actors.
Acronis noted that INC source code was sold in 2024 to at least three parties. Ransomware actors such as Lynx and Sinobi are believed to use strains of INC’s malware.
This creates another risk: even if one ransomware brand declines, its tooling can live on through other operators.
Ransomware ecosystems are highly reusable. Malware code, access brokers, affiliates, negotiation tactics, and leak site models often move between groups.
This makes disruption harder.
Why INC’s Simplicity Is a Strength
INC’s success is not based on secret techniques. It is based on repeatability.
The group’s affiliates can use common intrusion methods, widely available tools, known vulnerabilities, stolen credentials, and familiar data-theft workflows.
That lowers the barrier to entry and makes the operation easier to scale.
As Acronis’ research suggests, scalability may be the single biggest factor behind INC’s growth.
A ransomware group does not need elite malware if it can reliably turn common weaknesses into a steady stream of victims.
The Timing Helped
INC’s growth also benefited from timing.
When ALPHV/BlackCat shut down and LockBit was disrupted, the ransomware ecosystem shifted. Affiliates needed new places to go, and victims continued to present familiar weaknesses.
INC was one of the groups positioned to absorb that opportunity.
Other rising groups, such as The Gentlemen, have similarly benefited from the reshuffling of ransomware affiliates and infrastructure.
This shows how resilient the ransomware ecosystem remains. When one major brand collapses, affiliates, tools, and tactics often reappear elsewhere.
Current Position in the Ransomware Landscape
INC is now competing with some of the most active ransomware groups in the current threat landscape.
Groups such as Qilin, Akira, The Gentlemen, RansomHub, Play, and Cl0p continue to dominate incident reporting, but INC has become a significant player.
ZeroFox reported that INC entered its global top five in the first quarter of 2026, with 124 incidents.
That growth may reflect affiliate churn and re-consolidation rather than purely organic expansion. But either way, the result is the same: INC is attracting enough affiliate activity to become a major operational threat.
Defensive Lessons
The main defensive lesson from INC is that basic controls still matter.
The group’s playbook relies heavily on weaknesses that organizations can reduce:
- unpatched remote services
- stolen credentials
- exposed VPN and remote access systems
- weak identity controls
- poor segmentation
- insufficient endpoint protection
- inadequate backup resilience
- lack of monitoring for common post-exploitation tools
Organizations should not assume that only advanced techniques matter. Most ransomware incidents still begin with preventable exposure.
Backup Strategy: 3-2-1 Still Matters
Acronis recommends the 3-2-1 backup rule:
- keep three copies of important data
- store them on two different media types
- keep one copy offsite
Backups should also be:
- offline or immutable
- regularly tested
- protected from domain compromise
- monitored for unauthorized deletion
- separated from production credentials
Backups are not a full ransomware defense, but they can reduce pressure during negotiations and improve recovery options.
Untested backups are not reliable backups.
Identity and Access Controls
Because INC often uses stolen credentials and valid access, identity security is essential.
Organizations should prioritize:
- multi-factor authentication
- conditional access
- least privilege
- privileged access management
- regular account review
- disabling unused accounts
- monitoring for impossible travel
- reviewing VPN logins
- rotating credentials after incidents
- blocking shared admin accounts
Valid credentials remain one of the most powerful tools in ransomware operations.
If attackers can log in like legitimate users, many technical defenses become harder to apply.
Patch and Exposure Management
INC’s use of known vulnerabilities reinforces the importance of exposure management.
Organizations should:
- identify internet-facing systems
- patch exploited vulnerabilities quickly
- reduce exposed remote management services
- review VPN, Citrix, RMM, and firewall exposure
- monitor vendor advisories
- prioritize vulnerabilities actively used by ransomware groups
- remove unsupported software
- restrict access to remote services by IP or VPN where possible
The goal is not only to patch everything immediately. The goal is to reduce the attack paths ransomware affiliates actually use.
Endpoint and Network Defenses
INC uses common tools and living-off-the-land techniques. That means defenders need visibility into behavior, not only malware signatures.
Useful controls include:
- endpoint detection and response
- ransomware behavior detection
- application control
- PowerShell and script monitoring
- detection of EDR-killing tools
- alerting on mass file access or encryption
- monitoring archive creation and large uploads
- network segmentation
- blocking unnecessary outbound cloud storage uploads
- restricting lateral movement between endpoints and servers
Ransomware defense requires early detection before encryption begins.
Final Thoughts
INC’s rise shows that ransomware success does not require technical originality.
The group has grown by combining aggressive targeting, affiliate scalability, double extortion, known vulnerabilities, stolen credentials, and basic but reliable intrusion methods.
That makes INC a serious threat, especially for sectors where downtime and sensitive data exposure create immediate pressure to pay.
For defenders, the message is practical: focus on the fundamentals.
Patch exposed systems, secure identities, reduce remote access risk, segment networks, monitor common post-exploitation behavior, protect backups, and test recovery plans.
INC is not winning because its methods are mysterious. It is winning because too many common weaknesses remain available.
