{
  "id": "inc-ransom",
  "name": "INC Ransom",
  "aliases": [
    "GOLD IONIC"
  ],
  "domain": "cyber",
  "country": "UNK",
  "category": "Cybercriminal group",
  "status": "tracked",
  "fielded": null,
  "operators": [],
  "summary": "INC Ransom is a ransomware and data extortion threat group associated with the deployment of INC Ransomware that has been active since at least July 2023. INC Ransom has targeted organizations worldwide most commonly in the industrial, healthcare, and education sectors in the US and Europe.",
  "specs": [
    {
      "k": "sponsor",
      "v": "Ransomware and extortion group",
      "src": [
        "mitre-g1032"
      ],
      "conf": "medium"
    },
    {
      "k": "active_since",
      "v": 2023,
      "src": [
        "mitre-g1032"
      ],
      "conf": "medium",
      "note": "At least 2023"
    },
    {
      "k": "attack_id",
      "v": "G1032",
      "src": [
        "mitre-g1032"
      ],
      "conf": "high"
    },
    {
      "k": "targets",
      "v": "INC Ransom has targeted organizations worldwide most commonly in the industrial, healthcare, and education sectors in the US and Europe.",
      "src": [
        "mitre-g1032"
      ],
      "conf": "medium"
    },
    {
      "k": "techniques_count",
      "v": 25,
      "src": [
        "mitre-g1032"
      ],
      "conf": "high",
      "note": "ATT&CK v20.1"
    },
    {
      "k": "software",
      "v": "AdFind, esentutl, INC Ransomware, Net, Nltest, PsExec, Rclone, Tor",
      "src": [
        "mitre-g1032"
      ],
      "conf": "high",
      "note": "8 malware and tool entries linked in ATT&CK"
    }
  ],
  "payloads": [],
  "variants": [],
  "art": "cyber",
  "image": null,
  "verified": null,
  "notes": "INC Ransom is a ransomware and data extortion threat group associated with the deployment of INC Ransomware that has been active since at least July 2023. INC Ransom has targeted organizations worldwide most commonly in the industrial, healthcare, and education sectors in the US and Europe. Description adapted from MITRE ATT&CK®, © The MITRE Corporation, used under the ATT&CK Terms of Use.",
  "changelog": [
    {
      "date": "2026-11-08",
      "change": "Entry created from MITRE ATT&CK Enterprise v20.1 (group G1032)"
    }
  ],
  "url": "https://www.defensepedia.com/systems/inc-ransom.html",
  "sources": {
    "mitre-g1032": {
      "title": "INC Ransom, Group G1032",
      "publisher": "MITRE ATT&CK",
      "url": "https://attack.mitre.org/groups/G1032/",
      "published": "2026-07-31",
      "tier": 2,
      "checked": "2026-11-08"
    }
  }
}