INC Ransom

Executive Summary

INC Ransom (also known as GOLD IONIC) is a ransomware and data‑extortion group active since at least July 2023. The group has focused on industrial, healthcare, and education organizations across the United States and Europe, employing double‑extortion tactics to pressure victims into paying. Their operations show a moderate level of sophistication, leveraging common ransomware toolsets and credential‑stealing techniques.

Goals & Targeting

INC Ransom’s strategic objective is financial gain through ransomware encryption combined with data extortion. By focusing on industrial, healthcare, and education sectors, the group exploits organizations that maintain critical operations, possess valuable proprietary data, and often have limited cyber‑resilience budgets. Their typical victims are mid‑size to large enterprises that store patient records, manufacturing designs, or research data, making the threat of public exposure a powerful lever for ransom negotiations. The geographic focus on the US and Europe aligns with higher average ransom payouts and robust legal frameworks that increase the perceived value of the stolen data.

INC Ransom, identified in open‑source reports as early as July 2023, is a ransomware‑as‑a‑service (RaaS) operation that delivers the eponymous INC Ransomware payload. The group’s activity has been documented by multiple security vendors, including Bleeping Computer, Cybereason, Secureworks, and SentinelOne. Victims span a broad geographic footprint, with a concentration in the United States and Europe, and the primary sectors targeted are industrial manufacturing, healthcare delivery, and higher‑education institutions. The ransomware encrypts victim files and appends a distinctive ".inc" extension, while simultaneously exfiltrating sensitive data for public‑release threats. This double‑extortion model mirrors the tactics of other contemporary ransomware families, leveraging both encryption impact and reputational damage to increase ransom yields. The group typically distributes its payload via spear‑phishing emails, compromised remote‑access services, and exploitation of unpatched vulnerabilities in publicly‑facing applications. Operationally, INC Ransom appears to use a blend of off‑the‑shelf tools (e.g., Cobalt Strike, Mimikatz) and custom scripts, often employing PowerShell for execution and lateral movement. Ransom notes are delivered in plain‑text files named "README_INC.txt" and reference a leak site where stolen data will be published if the ransom is not met. The group’s ransom demands have ranged from tens of thousands to several hundred thousand US dollars, reflecting the high‑value nature of the targeted sectors. While the precise leadership and funding structure remain unknown, the group’s consistent targeting of critical infrastructure and public‑sector entities suggests a profit‑driven motivation with an awareness of the geopolitical impact of disrupting essential services. Continued monitoring of their infrastructure and tactics is essential for organizations operating in the affected sectors.

Key Capabilities

• Ransomware encryption with custom .inc file extension
• Data exfiltration for double‑extortion
• Spear‑phishing with malicious Office macros
• Credential dumping using Mimikatz
• Lateral movement via PsExec and Windows Admin Shares
• PowerShell-based execution and fileless techniques
• Use of Cobalt Strike beacons for command‑and‑control
• Deployment of custom RATs for persistence
• Exploitation of unpatched public‑facing services

MITRE ATT&CK Tactics

ATT&CK Techniques

Software / Tooling

Campaigns & Victims

Since its emergence in mid‑2023, INC Ransom has conducted multiple campaigns that follow a predictable kill‑chain: initial access via spear‑phishing or compromised VPN, deployment of PowerShell loaders, credential harvesting, lateral movement across internal networks, data staging, and final encryption coupled with data theft. The group tends to operate on a medium tempo, often compromising several organizations within a quarter before rotating its infrastructure. Notable incidents include a July 2023 attack on a European medical device manufacturer that resulted in a $250,000 ransom, and a November 2023 compromise of a US university network where over 2 TB of research data were exfiltrated and threatened for public release.

IOC Patterns

• Spear‑phishing emails with macro‑laden Word or Excel attachments
• PowerShell command lines obfuscated with base64 encoding
• C2 communication over HTTPS using domain‑fronted URLs
• Bulletproof hosting for leak sites and ransom payment portals
• Ransom note file named "README_INC.txt" containing payment instructions
• Encrypted payloads delivered with a .inc file extension

Recommended Actions

• Implement multi‑factor authentication for all remote access services
• Enforce strict email filtering and sandboxing for Office documents
• Patch and regularly audit publicly exposed services and VPN gateways
• Segment networks to isolate critical industrial, healthcare, and education assets
• Maintain immutable, offline backups and test restoration procedures quarterly
• Deploy endpoint detection and response (EDR) solutions with ransomware behavior signatures
• Conduct regular phishing awareness training for staff
• Monitor for known Cobalt Strike beacons and abnormal PowerShell activity
• Establish an incident response playbook specific to double‑extortion ransomware

Suggested Tags