INC Ransom (G1032) | Threat Actor Index

25

Techniques

8

Toolsets

2

CVEs Referenced

1

KEV Entries

CISA Known Exploited

About INC Ransom

INC Ransom is a ransomware and data extortion threat group associated with the deployment of INC Ransomware that has been active since at least July 2023. INC Ransom has targeted organizations worldwide most commonly in the industrial, healthcare, and education sectors in the US and Europe.

View MITRE record ↗

Techniques by Tactic (25)

Resource Development

Initial Access

T1078 Valid AccountsT1190 Exploit Public-Facing ApplicationT1566 Phishing

Execution

T1047 Windows Management InstrumentationT1059.003 Windows Command ShellT1569.002 Service Execution

Persistence

T1078 Valid Accounts

Privilege Escalation

T1078 Valid Accounts

Stealth

T1036.005 Match Legitimate Resource Name or LocationT1070.004 File DeletionT1078 Valid Accounts

Defence Impairment

T1685 Disable or Modify Tools

Discovery

T1046 Network Service DiscoveryT1049 System Network Connections DiscoveryT1069.002 Domain GroupsT1087.002 Domain AccountT1135 Network Share Discovery

Lateral Movement

T1021.001 Remote Desktop ProtocolT1570 Lateral Tool Transfer

Collection

T1074 Data StagedT1560.001 Archive via Utility

Command & Control

T1071 Application Layer ProtocolT1105 Ingress Tool TransferT1219 Remote Access Tools

Exfiltration

T1537 Transfer Data to Cloud Account

Impact

T1486 Data Encrypted for ImpactT1657 Financial Theft

Toolsets (8)

🐛

INC Ransomware S1139

Malware · Windows

🔧

AdFind S0552

Tool · Windows

🔧

Net S0039

Tool · Windows

🔧

Nltest S0359

Tool · Windows

🔧

PsExec S0029

Tool · Windows

🔧

Rclone S1040

Tool · Linux, Windows, macOS

🔧

Tor S0183

Tool · Linux, Windows, macOS

🔧

esentutl S0404

Tool · Windows

CVEs Referenced (2 · 1 CISA KEV)

CVE-2014-7169View full details on NVDKEV

CVE-2016-6662View full details on NVD

References & Reports (4)

↑