Threat group.View on attack.mitre.org
INC Ransom is a ransomware and data extortion threat group associated with the deployment of INC Ransomware that has been active since at least July 2023. INC Ransom has targeted organizations worldwide most commonly in the industrial, healthcare, and education sectors in the US and Europe.
| Technique | Procedure example |
|---|---|
| T1021.001 Remote Desktop Protocol |
INC Ransom has used RDP to move laterally. |
| T1036.005 Match Legitimate Resource Name or Location |
INC Ransom has named a PsExec executable winupd to mimic a legitimate Windows update file. |
| T1046 Network Service Discovery |
INC Ransom has used NETSCAN.EXE for internal reconnaissance. |
| T1047 Windows Management Instrumentation |
INC Ransom has used WMIC to deploy ransomware. |
| T1049 System Network Connections Discovery |
INC Ransom has used RDP to test network connections. |
| T1059.003 Windows Command Shell |
INC Ransom has used `cmd.exe` to launch malicious payloads. |
| T1069.002 Domain Groups |
INC Ransom has enumerated domain groups on targeted hosts. |
| T1070.004 File Deletion |
INC Ransom has uninstalled tools from compromised endpoints after use. |
| T1071 Application Layer Protocol |
INC Ransom has used valid accounts over RDP to connect to targeted systems. |
| T1074 Data Staged |
INC Ransom has staged data on compromised hosts prior to exfiltration. |
| T1078 Valid Accounts |
INC Ransom has used compromised valid accounts for access to victim environments. |
| T1087.002 Domain Account |
INC Ransom has scanned for domain admin accounts in compromised environments. |
| T1105 Ingress Tool Transfer |
INC Ransom has downloaded tools to compromised servers including Advanced IP Scanner. |
| T1135 Network Share Discovery |
INC Ransom has used Internet Explorer to view folders on other systems. |
| T1190 Exploit Public-Facing Application |
INC Ransom has exploited known vulnerabilities including CVE-2023-3519 in Citrix NetScaler for initial access. |
None recorded.
Data from MITRE ATT&CK® (Enterprise). ATT&CK® is a registered trademark of The MITRE Corporation.
