Uptime Hamster: 21d 11h 24mDeploy: 3 Aug 2026 06:56Updated: 2026-07-21
PanelActoresCampanasMapaTTPs
Panel » Actores » INC Ransom
ClassicBrechasMapaActoresTTP MatrixAnaliticaAlertasCyberNewsArsenalExploitsKillChainOrigenSSLBLRansomLookRansomwhere
Logo del actor de amenaza INC Ransom

INC Ransom

0 incidentes 0 paises 0 sectores threat-actor RU Ultimo: -
Aliases: GOLD IONIC, "Inc
Ver en IntelTracker → APTTrail →
INC Ransom is a ransomware and data extortion threat group associated with the deployment of INC Ransomware that has been active since at least July 2023. INC Ransom has targeted organizations worldwide most commonly in the industrial, healthcare, and education sectors in the US and Europe.

Aliases del actor

GOLD IONIC"Inc

Actores similares

incransomransomware · 832inc-ransomactor · 26braincipheractor · 22BrainCipherthreat-actor · 2arvinclubthreat-actor · 2inception-frameworkactor · 1prince-of-persiaactor · 1pinchy-spideractor · 1brave-princeactor · 1Inceptionthreat-actor · 1

Canales, DLS e infraestructura asociada

Clasificacion automatica desde IntelTracker/APTTrail/OSINT. Estado real solo si viene indicado por la fuente.

TipoEstadoHost / enlaceTitle / ultimo titulo
DLS / leak siteupransomware.anggipradana.comRansomware Group: incransom
DLS / onionunknownincblog6qu4y4mm4zvw5nrmue6qbwtgjsxpw6b7ixzssu36tsajldoad.onionRansomware Victim: callhorton.com (incransom)
DLS / onionunknownincblog6qu4y4mm4zvw5nrmue6qbwtgjsxpw6b7ixzssu36tsajldoad.onionRansomware Victim: johndufourlaw.com (incransom)
DLS / onionunknownincblog6qu4y4mm4zvw5nrmue6qbwtgjsxpw6b7ixzssu36tsajldoad.onionRansomware Victim: theswansonlawgroup.com (incransom)
DLS / leak siteunknownnitter.netRansomware Monitor: Actor: #incransom Victim: GSP Crop Science Pvt Date: 2026-06-26 07:10:34 UTC+3 According to #DarkWeb #Ransomware activity detected by the ThreatMon Threat Intelligence Team. The “#incransom” Ransomware group has added GSP Crop Science Pvt to its victims.
X/Twitterunknownx.comRansomware Monitor: Actor: #incransom Victim: Life Bridges Date: 2026-06-26 05:08:35 UTC+3 According to #DarkWeb #Ransomware activity detected by the ThreatMon Threat Intelligence Team. The “#incransom” Ransomware group has added Life Bridges to its victims.
DLS / leak siteunknownnitter.netRansomware Monitor: Actor: #incransom Victim: Life Bridges Date: 2026-06-26 05:08:35 UTC+3 According to #DarkWeb #Ransomware activity detected by the ThreatMon Threat Intelligence Team. The “#incransom” Ransomware group has added Life Bridges to its victims.
Repositoriounknowngithub.comBushidoUK ToolMatrix GroupProfiles: INC_Ransom
Repositorioupgithub.comBushidoUK ToolMatrix CommunityReports: CR-020-INCRANSOM-JAN-2026
DLS / leak siteunknownwww.huntress.comBushidoUK ToolMatrix GroupProfiles: INC_Ransom
DLS / leak siteunknownwww.guidepointsecurity.comOSINT
DLS / leak siteunknownwww.huntress.comOSINT
DLS / leak siteunknownwww.secureworks.comOSINT
DLS / leak siteunknownwww.huntress.comOSINT
Repositorioupgithub.comBushidoUK ToolMatrix CommunityReports: CR-019-INCRANSOM-NOV-2025
X/Twitterupx.comBushidoUK ToolMatrix CommunityReports: CR-020-INCRANSOM-JAN-2026
Repositorioupgithub.comBushidoUK ToolMatrix CommunityReports: CR-020-INCRANSOM-JAN-2026
DLS / onionupincbacg6bfwtrlzwdbqc55gsfl763s3twdtwhp27dzuik6s6rwdcityd.onionincransom
DLS / onionupincbackrlasjesgpfu5brktfjknbqoahe2hhmqfhasc5fb56mtukn4yd.onionincransom
DLS / onionofflineincblog7vmuq7rktic73r4ha4j757m3ptym37tyvifzp2roedyyzzxid.onionCTI.FYI
DLS / onionofflineincbackrlasjesgpfu5brktfjknbqoahe2hhmqfhasc5fb56mtukn4yd.onionCTI.FYI
DLS / leak siteofflineincbackend.topCTI.FYI
DLS / leak siteofflineincapt.blogCTI.FYI
DLS / leak siteofflineincapt.suCTI.FYI
DLS / onionissueincblog6qu4y4mm4zvw5nrmue6qbwtgjsxpw6b7ixzssu36tsajldoad.onionCTI.FYI
DLS / onionofflineincbacg6bfwtrlzwdbqc55gsfl763s3twdtwhp27dzuik6s6rwdcityd.onionCTI.FYI
DLS / leak siteunknownincblog.sumarktsec
DLS / onionunknownincblog6qu4y4mm4zvw5nrmue6qbwtgjsxpw6b7ixzssu36tsajldoad.onionmarktsec
Webunknownattack.mitre.orgOSINT
Malware asociado
INC Ransomware
Tecnicas MITRE
T1566, T1518.001 - Security Software Discovery, T1566 - Phishing, T1562.001 - Disable or Modify Tools, T1566.001, T1570
CVEs relacionadas
CVE-2025-5777, CVE-2025-53770, CVE-2025-49706, CVE-2025-49704, CVE-2024-57727, CVE-2023-4966
Tipo
threat-actor
Pais origen
RU
Motivacion
-
Impacto
110
Actualizado
2026-08-03

Paises objetivo (OSINT)

United Arab EmiratesArgentinaAustriaAustraliaBelgiumBeninBrazilCanadaCongo, the Democratic Republic of theSwitzerland

Sectores objetivo (OSINT)

Construction of BuildingsFood ManufacturingOther Information ServicesSoftware PublishersReal EstateRental and Leasing ServicesHospitalsAccommodationAir TransportationManufacturing