Hunt / incransom
INC Ransom
Who they hit
| Posted | Victim | Country |
|---|---|---|
| 2026-11-07 | 1da9100e55aqf21eb651eNea | AL |
| 2026-11-06 | https://www.sleep-clinic.ca/ | CA |
| 2026-11-03 | fidepartners.com | ES |
| 2026-11-03 | roundglass.com | US |
| 2026-11-03 | butler.legal | US |
| 2026-11-03 | innovativedriven.com | US |
| 2026-11-03 | bliss1041.com | US |
| 2026-11-03 | hillandbeyer.com | US |
| 2026-10-31 | chicagolawyer.com | US |
| 2026-10-22 | bereskinparr.com smartbiggar.ca | CA |
| 2026-10-20 | centralrogers.com | US |
| 2026-10-19 | Seetelhotels.de | DE |
Latest 12 of 96, from ransomware.live. These are the group's claims.
Confirmed elsewhere
Victims of INC Ransom that a second, independent source also named inside two weeks. How convergence works.
- 2026-08-21 Life Bridges, Inc. leak + notice
Reports about them
- 2026-09-21 Huntress: The Tale of Two INC Ransom Notes: A Ransomware Timeline | Huntress
Also named in passing in 3 more: Recorded Future Insikt, Unit 42, DataBreaches.net. Those don't feed the techniques or indicators below.
What they do
25 techniques, in kill-chain order. 1 have no rule anywhere we can find. "Their side" is infrastructure work you can't see from your network.
| ID | Technique | SigmaHQ | Status |
|---|---|---|---|
| T1588.002 | Tool | 9 | their side |
| T1078 | Valid Accounts | 55 | SigmaHQ |
| T1190 | Exploit Public-Facing Application | 147 | thrunt |
| T1566 | Phishing | 14 | SigmaHQ |
| T1047 | Windows Management Instrumentation | 52 | SigmaHQ |
| T1059.003 | Windows Command Shell | 46 | SigmaHQ |
| T1569.002 | Service Execution | 43 | SigmaHQ |
| T1046 | Network Service Discovery | 20 | SigmaHQ |
| T1049 | System Network Connections Discovery | 9 | SigmaHQ |
| T1069.002 | Domain Groups | 15 | SigmaHQ |
| T1087.002 | Domain Account | 21 | SigmaHQ |
| T1135 | Network Share Discovery | 7 | SigmaHQ |
| T1021.001 | Remote Desktop Protocol | 16 | SigmaHQ |
| T1570 | Lateral Tool Transfer | 6 | SigmaHQ |
| T1074 | Data Staged | 2 | SigmaHQ |
| T1560.001 | Archive via Utility | 17 | SigmaHQ |
| T1071 | Application Layer Protocol | 7 | SigmaHQ |
| T1105 | Ingress Tool Transfer | 87 | thrunt |
| T1219 | Remote Access Tools | 6 | thrunt |
| T1537 | Transfer Data to Cloud Account | 6 | SigmaHQ |
| T1486 | Data Encrypted for Impact | 16 | SigmaHQ |
| T1657 | Financial Theft | nothing | |
| T1036.005 | Match Legitimate Resource Name or Location | 21 | thrunt |
| T1070.004 | File Deletion | 15 | SigmaHQ |
| T1685 | Disable or Modify Tools | 162 | SigmaHQ |
SigmaHQ counts are rules tagged with that exact technique; "~n" is rules on its parent or sub-techniques. A close match does not mean the technique is covered.
Rules to deploy
Ours on the same techniques but written for something else, so check the logic fits before you lean on them: t1557-recaptcha-skinned-turnstile-gate, t1204-004-clickfix-run-dialog-execution, t1190-peoplesoft-psemhub-encoded-path-exploitation, t1505-003-peoplesoft-psemhub-webshell-drop.
Sweep
1 domain, 1 ipv4. iocs.csv · package.json