D
CyberUnattributed

INC Ransom

Cybercriminal groupTrackedPending verification

Also known as: GOLD IONIC

CyberUNK
Identification silhouette. Not drawn to scale between entries.
Fact cardConfidence · Source
System
TypeCybercriminal group
Alternative designationsGOLD IONIC
ProliferationOrigin country only
Active since2023At least 2023Med[1]
MITRE ATT&CK IDG1032High[1]
Capabilities
ATT&CK techniques used25ATT&CK v20.1High[1]
Malware and toolsAdFind, esentutl, INC Ransomware, Net, Nltest, PsExec, Rclone, Tor8 malware and tool entries linked in ATT&CKHigh[1]
Attribution and activity
Attributed sponsorRansomware and extortion groupMed[1]
TargetsINC Ransom has targeted organizations worldwide most commonly in the industrial, healthcare, and education sectors in the US and Europe.Med[1]
Notes
INC Ransom is a ransomware and data extortion threat group associated with the deployment of INC Ransomware that has been active since at least July 2023. INC Ransom has targeted organizations worldwide most commonly in the industrial, healthcare, and education sectors in the US and Europe. Description adapted from MITRE ATT&CK®, © The MITRE Corporation, used under the ATT&CK Terms of Use.
Summary

INC Ransom is a ransomware and data extortion threat group associated with the deployment of INC Ransomware that has been active since at least July 2023. INC Ransom has targeted organizations worldwide most commonly in the industrial, healthcare, and education sectors in the US and Europe.

Draft entry. Values come from the cited public sources and are awaiting editor verification.
CompareJSON
Operators
Sources
  1. INC Ransom, Group G1032, MITRE ATT&CK
    Published/updated 2026-07-31 · Tier 2 · checked 2026-11-08
Change log
  • 2026-11-08 Entry created from MITRE ATT&CK Enterprise v20.1 (group G1032)