{
  "slug": "incransom",
  "group": "incransom",
  "name": "INC Ransom",
  "note": null,
  "attck": [
    {
      "id": "G1032",
      "name": "INC Ransom",
      "kind": "intrusion-set",
      "url": "https://attack.mitre.org/groups/G1032"
    }
  ],
  "activity": {
    "postings": 96,
    "first": "2026-08-12",
    "last": "2026-11-07",
    "countries": {
      "AL": 1,
      "CA": 6,
      "ES": 3,
      "US": 50,
      "DE": 5,
      "CR": 1,
      "PL": 1,
      "BR": 3,
      "IN": 1,
      "AE": 2,
      "ZA": 2,
      "SE": 1,
      "MA": 1,
      "MO": 1,
      "GB": 3,
      "NL": 1,
      "TW": 2,
      "AR": 1,
      "MY": 3,
      "MX": 2,
      "IT": 1,
      "PA": 1,
      "CH": 1,
      "TH": 1,
      "MU": 1,
      "AU": 1
    },
    "sectors": {
      "unknown": 16,
      "healthcare": 13,
      "finance": 7,
      "services": 18,
      "technology": 8,
      "consumer": 6,
      "education": 4,
      "manufacturing": 16,
      "government": 3,
      "transportation": 2,
      "energy": 3,
      "insurance": 1
    },
    "recent": [
      {
        "date": "2026-11-07",
        "name": "1da9100e55aqf21eb651eNea",
        "country": "AL",
        "sectors": [
          "unknown"
        ],
        "url": "https://www.ransomware.live/id/MWRhOTEwMGU1NWFxZjIxZWI2NTFlTmVhQGluY3JhbnNvbQ"
      },
      {
        "date": "2026-11-06",
        "name": "https://www.sleep-clinic.ca/",
        "country": "CA",
        "sectors": [
          "healthcare"
        ],
        "url": "https://www.ransomware.live/id/aHR0cHM6Ly93d3cuc2xlZXAtY2xpbmljLmNhL0BpbmNyYW5zb20"
      },
      {
        "date": "2026-11-03",
        "name": "fidepartners.com",
        "country": "ES",
        "sectors": [
          "finance"
        ],
        "url": "https://www.ransomware.live/id/ZmlkZXBhcnRuZXJzLmNvbUBpbmNyYW5zb20"
      },
      {
        "date": "2026-11-03",
        "name": "roundglass.com",
        "country": "US",
        "sectors": [
          "healthcare"
        ],
        "url": "https://www.ransomware.live/id/cm91bmRnbGFzcy5jb21AaW5jcmFuc29t"
      },
      {
        "date": "2026-11-03",
        "name": "butler.legal",
        "country": "US",
        "sectors": [
          "services"
        ],
        "url": "https://www.ransomware.live/id/YnV0bGVyLmxlZ2FsQGluY3JhbnNvbQ"
      },
      {
        "date": "2026-11-03",
        "name": "innovativedriven.com",
        "country": "US",
        "sectors": [
          "technology"
        ],
        "url": "https://www.ransomware.live/id/aW5ub3ZhdGl2ZWRyaXZlbi5jb21AaW5jcmFuc29t"
      },
      {
        "date": "2026-11-03",
        "name": "bliss1041.com",
        "country": "US",
        "sectors": [
          "unknown"
        ],
        "url": "https://www.ransomware.live/id/Ymxpc3MxMDQxLmNvbUBpbmNyYW5zb20"
      },
      {
        "date": "2026-11-03",
        "name": "hillandbeyer.com",
        "country": "US",
        "sectors": [
          "services"
        ],
        "url": "https://www.ransomware.live/id/aGlsbGFuZGJleWVyLmNvbUBpbmNyYW5zb20"
      },
      {
        "date": "2026-10-31",
        "name": "chicagolawyer.com",
        "country": "US",
        "sectors": [
          "services"
        ],
        "url": "https://www.ransomware.live/id/Y2hpY2Fnb2xhd3llci5jb21AaW5jcmFuc29t"
      },
      {
        "date": "2026-10-22",
        "name": "bereskinparr.com smartbiggar.ca",
        "country": "CA",
        "sectors": [
          "services"
        ],
        "url": "https://www.ransomware.live/id/YmVyZXNraW5wYXJyLmNvbSBzbWFydGJpZ2dhci5jYUBpbmNyYW5zb20"
      },
      {
        "date": "2026-10-20",
        "name": "centralrogers.com",
        "country": "US",
        "sectors": [
          "unknown"
        ],
        "url": "https://www.ransomware.live/id/Y2VudHJhbHJvZ2Vycy5jb21AaW5jcmFuc29t"
      },
      {
        "date": "2026-10-19",
        "name": "Seetelhotels.de",
        "country": "DE",
        "sectors": [
          "consumer"
        ],
        "url": "https://www.ransomware.live/id/U2VldGVsaG90ZWxzLmRlQGluY3JhbnNvbQ"
      }
    ]
  },
  "convergences": [
    {
      "name": "Life Bridges, Inc.",
      "flagged": "2026-08-21",
      "classes": [
        "leak",
        "notice"
      ],
      "curated": false,
      "hand_picked": false
    }
  ],
  "reports": [
    {
      "url": "https://www.recordedfuture.com/blog/october-2026-cve-landscape",
      "publisher": "Recorded Future Insikt",
      "published": "2026-11-06",
      "title": "October 2026 CVE Landscape",
      "origin": "feed",
      "primary": false
    },
    {
      "url": "https://unit42.paloaltonetworks.com/active-exploitation-of-pan-os-cve-2026-0257/",
      "publisher": "Unit 42",
      "published": "2026-10-20",
      "title": "Active Exploitation of May 2026 PAN-OS CVE-2026-0257 (Updated October 20)",
      "origin": "feed",
      "primary": false
    },
    {
      "url": "https://databreaches.net/2026/10/20/qilin-and-inc-ransomware-groups-exploit-palo-alto-networks-flaw-to-bypass-mfa/",
      "publisher": "DataBreaches.net",
      "published": "2026-10-20",
      "title": "Qilin and INC Ransomware Groups Exploit Palo Alto Networks Flaw to Bypass MFA",
      "origin": "feed",
      "primary": false
    },
    {
      "url": "https://www.huntress.com/blog/two-inc-ransom-notes",
      "publisher": "Huntress",
      "published": "2026-09-21",
      "title": "The Tale of Two INC Ransom Notes: A Ransomware Timeline | Huntress",
      "origin": "feed",
      "primary": true
    }
  ],
  "techniques": [
    {
      "id": "T1021.001",
      "name": "Remote Desktop Protocol",
      "tactics": [
        "lateral-movement"
      ],
      "sources": [
        "attck"
      ],
      "structural": false,
      "own": [],
      "community": 16,
      "related": 10
    },
    {
      "id": "T1036.005",
      "name": "Match Legitimate Resource Name or Location",
      "tactics": [
        "stealth"
      ],
      "sources": [
        "attck"
      ],
      "structural": false,
      "own": [
        "t1557-recaptcha-skinned-turnstile-gate"
      ],
      "community": 21,
      "related": 40
    },
    {
      "id": "T1046",
      "name": "Network Service Discovery",
      "tactics": [
        "discovery"
      ],
      "sources": [
        "attck"
      ],
      "structural": false,
      "own": [],
      "community": 20,
      "related": 0
    },
    {
      "id": "T1047",
      "name": "Windows Management Instrumentation",
      "tactics": [
        "execution"
      ],
      "sources": [
        "attck"
      ],
      "structural": false,
      "own": [],
      "community": 52,
      "related": 0
    },
    {
      "id": "T1049",
      "name": "System Network Connections Discovery",
      "tactics": [
        "discovery"
      ],
      "sources": [
        "attck"
      ],
      "structural": false,
      "own": [],
      "community": 9,
      "related": 0
    },
    {
      "id": "T1059.003",
      "name": "Windows Command Shell",
      "tactics": [
        "execution"
      ],
      "sources": [
        "attck"
      ],
      "structural": false,
      "own": [],
      "community": 46,
      "related": 94
    },
    {
      "id": "T1069.002",
      "name": "Domain Groups",
      "tactics": [
        "discovery"
      ],
      "sources": [
        "attck"
      ],
      "structural": false,
      "own": [],
      "community": 15,
      "related": 3
    },
    {
      "id": "T1070.004",
      "name": "File Deletion",
      "tactics": [
        "stealth"
      ],
      "sources": [
        "attck"
      ],
      "structural": false,
      "own": [],
      "community": 15,
      "related": 20
    },
    {
      "id": "T1071",
      "name": "Application Layer Protocol",
      "tactics": [
        "command-and-control"
      ],
      "sources": [
        "attck"
      ],
      "structural": false,
      "own": [],
      "community": 7,
      "related": 59
    },
    {
      "id": "T1074",
      "name": "Data Staged",
      "tactics": [
        "collection"
      ],
      "sources": [
        "attck"
      ],
      "structural": false,
      "own": [],
      "community": 2,
      "related": 4
    },
    {
      "id": "T1078",
      "name": "Valid Accounts",
      "tactics": [
        "stealth",
        "persistence",
        "privilege-escalation",
        "initial-access"
      ],
      "sources": [
        "attck"
      ],
      "structural": false,
      "own": [],
      "community": 55,
      "related": 54
    },
    {
      "id": "T1087.002",
      "name": "Domain Account",
      "tactics": [
        "discovery"
      ],
      "sources": [
        "attck"
      ],
      "structural": false,
      "own": [],
      "community": 21,
      "related": 16
    },
    {
      "id": "T1105",
      "name": "Ingress Tool Transfer",
      "tactics": [
        "command-and-control"
      ],
      "sources": [
        "attck"
      ],
      "structural": false,
      "own": [
        "t1204-004-clickfix-run-dialog-execution"
      ],
      "community": 87,
      "related": 0
    },
    {
      "id": "T1135",
      "name": "Network Share Discovery",
      "tactics": [
        "discovery"
      ],
      "sources": [
        "attck"
      ],
      "structural": false,
      "own": [],
      "community": 7,
      "related": 0
    },
    {
      "id": "T1190",
      "name": "Exploit Public-Facing Application",
      "tactics": [
        "initial-access"
      ],
      "sources": [
        "attck"
      ],
      "structural": false,
      "own": [
        "t1190-peoplesoft-psemhub-encoded-path-exploitation"
      ],
      "community": 147,
      "related": 0
    },
    {
      "id": "T1219",
      "name": "Remote Access Tools",
      "tactics": [
        "command-and-control"
      ],
      "sources": [
        "attck"
      ],
      "structural": false,
      "own": [
        "t1505-003-peoplesoft-psemhub-webshell-drop"
      ],
      "community": 6,
      "related": 46
    },
    {
      "id": "T1486",
      "name": "Data Encrypted for Impact",
      "tactics": [
        "impact"
      ],
      "sources": [
        "attck"
      ],
      "structural": false,
      "own": [],
      "community": 16,
      "related": 0
    },
    {
      "id": "T1537",
      "name": "Transfer Data to Cloud Account",
      "tactics": [
        "exfiltration"
      ],
      "sources": [
        "attck"
      ],
      "structural": false,
      "own": [],
      "community": 6,
      "related": 0
    },
    {
      "id": "T1560.001",
      "name": "Archive via Utility",
      "tactics": [
        "collection"
      ],
      "sources": [
        "attck"
      ],
      "structural": false,
      "own": [],
      "community": 17,
      "related": 4
    },
    {
      "id": "T1566",
      "name": "Phishing",
      "tactics": [
        "initial-access"
      ],
      "sources": [
        "attck"
      ],
      "structural": false,
      "own": [],
      "community": 14,
      "related": 28
    },
    {
      "id": "T1569.002",
      "name": "Service Execution",
      "tactics": [
        "execution"
      ],
      "sources": [
        "attck"
      ],
      "structural": false,
      "own": [],
      "community": 43,
      "related": 4
    },
    {
      "id": "T1570",
      "name": "Lateral Tool Transfer",
      "tactics": [
        "lateral-movement"
      ],
      "sources": [
        "attck"
      ],
      "structural": false,
      "own": [],
      "community": 6,
      "related": 0
    },
    {
      "id": "T1588.002",
      "name": "Tool",
      "tactics": [
        "resource-development"
      ],
      "sources": [
        "attck"
      ],
      "structural": true,
      "own": [],
      "community": 9,
      "related": 2
    },
    {
      "id": "T1657",
      "name": "Financial Theft",
      "tactics": [
        "impact"
      ],
      "sources": [
        "attck"
      ],
      "structural": false,
      "own": [],
      "community": 0,
      "related": 0
    },
    {
      "id": "T1685",
      "name": "Disable or Modify Tools",
      "tactics": [
        "defense-impairment"
      ],
      "sources": [
        "attck"
      ],
      "structural": false,
      "own": [],
      "community": 162,
      "related": 44
    }
  ],
  "cves": [],
  "indicators": {
    "list": [
      {
        "type": "domain",
        "value": "throughoutes.net",
        "source": "https://www.huntress.com/blog/two-inc-ransom-notes"
      },
      {
        "type": "ipv4",
        "value": "213.111.185.108",
        "source": "https://www.huntress.com/blog/two-inc-ransom-notes"
      }
    ],
    "withheld": 0
  },
  "rules": [],
  "coverage": {
    "techniques": 25,
    "defendable": 24,
    "covered": 23,
    "uncovered": [
      "T1657"
    ]
  }
}