Clankerusecase
Threat-actor profile
 ← Back to main site
Home/ Threat Actors/ INC Ransom

🇷🇺INC Ransom

🇷🇺 INC Ransom is a tracked threat actor in the Clankerusecase corpus. RU-aligned. Primary motivation: Criminal. We map 14 detection use cases to this actor across 25 MITRE ATT&CK techniques, with 0 threat-intel articles citing them.

View full actor card → All threat actors MITRE ATT&CK group spec (G1032) ↗
14Use cases
0Articles
25Techniques
0IOCs

About this actor (MITRE)

[INC Ransom](https://attack.mitre.org/groups/G1032) is a ransomware and data extortion threat group associated with the deployment of [INC Ransomware](https://attack.mitre.org/software/S1139) that has been active since at least July 2023. [INC Ransom](https://attack.mitre.org/groups/G1032) has targeted organizations worldwide most commonly in the industrial, healthcare, and education sectors in the US and Europe.(Citation: Bleeping Computer INC Ransomware March 2024)(Citation: Cybereason INC Ransomware November 2023)(Citation: Secureworks GOLD IONIC April 2024)(Citation: SentinelOne INC Ranso

Known aliases

INC RansomGOLD IONIC

Top techniques

T1021.001 · Remote Desktop ProtocolT1036.005 · Match Legitimate Resource Name or LocationT1046 · Network Service Discovery

All other tracked techniques

T1047 · Windows Management InstrumentationT1049 · System Network Connections DiscoveryT1059.003 · Windows Command ShellT1069.002 · Domain GroupsT1070.004 · File DeletionT1071 · Application Layer ProtocolT1074 · Data StagedT1078 · Valid AccountsT1087.002 · Domain AccountT1105 · Ingress Tool TransferT1135 · Network Share DiscoveryT1190 · Exploit Public-Facing ApplicationT1219 · Remote Access ToolsT1486 · Data Encrypted for ImpactT1537 · Transfer Data to Cloud AccountT1560.001 · Archive via UtilityT1566 · PhishingT1569.002 · Service ExecutionT1570 · Lateral Tool TransferT1588.002 · ToolT1657 · Financial TheftT1685 · Disable or Modify Tools

Detection use cases (14)

INC Ransom (GOLD IONIC) encryptor — mass .inc rewrite + INC-README note drop AI · profile SΣDD INC Ransom double-extortion staging — 7-Zip/WinRAR archive then rclone/MEGAsync egress to MEGA AI · profile SΣDD 1Password impossible-travel sign-in MITRE match 1Password vault export attempted MITRE match Auth-Bypass on Public-Facing Service → Post-Exploit Action on Same Host (≤10 min) MITRE match Brand-Impersonation Domain Fetch Followed by User-Context Loader Within 10 Minutes MITRE match Cross-Platform ClickFix Paste-to-Pipe Loader (UI-Parent Shell with Decode-and-Execute Payload) MITRE match Developer/Data-tooling Daemon Spawns Shell Child Seconds After POST to Runner/Exec Endpoint MITRE match Internet-Facing Service Process Spawning Unix Shell or Ingress-Tool LOLBin (Edge Zero-Day Post-Exploit) MITRE match Low-Code / AI Workflow Runtime Sandbox-Escape — Server Process Spawns Shell + Public Egress MITRE match Server / AI-agent process spawns shell or LOLBIN with public egress — post-RCE behavioural chain MITRE match Service-process parent spawns subprocess containing CLI-argument-injection tokens MITRE match Web App Interpreter (Node/Python/Java/PHP) Spawns Shell or Net-Download LOLBin on Internet-Facing Host MITRE match Atlassian administrator impersonating user MITRE match