INC Ransomware Hits 830+ Victims Since 2023 — RaaS Giant Reshapes Cybercrime

INC Ransomware has cemented its position as one of the most prolific ransomware-as-a-service (RaaS) operations in 2026, claiming more than 830 victims since its emergence in August 2023, according to Acronis researcher Darrel Virtusio. The group's rapid rise was fueled by the disruption of LockBit and the shutdown of BlackCat, which pushed displaced affiliates toward INC's infrastructure. U.S. organizations represent over 65% of listed victims, with legal services, manufacturing, construction, technology, and healthcare among the most heavily targeted sectors. INC has also rewritten its Windows and Linux/ESXi encryptors in Rust, enabling easier cross-platform development and stronger resistance to reverse engineering — a notable evolution in the group's technical maturity.

The group's attack chain blends commodity techniques with targeted tradecraft. Initial access is typically obtained through spear-phishing, credentials purchased from initial access brokers (IABs), or exploitation of vulnerabilities in public-facing applications, including Citrix NetScaler (CVE-2023-3519 and CVE-2025-5777), Fortinet EMS (CVE-2023-48788), and SimpleHelp (CVE-2024-57727). Once inside, affiliates extract sensitive credentials from compromised environments and move laterally using living-off-the-land binaries (LOLBins) such as RDP and PsExec. They also deploy a bring-your-own-vulnerable-driver (BYOVD) technique using filwfp.sys, filnk.sys, and fildds.sys to disable security defenses, then drop Cobalt Strike, AnyDesk, ScreenConnect, and TeamViewer for command-and-control operations. Organizations concerned about exposed credentials can verify compromised accounts using the email breach checker, while defenders should validate perimeter hardening with the port scanner to identify vulnerable internet-facing services.

A key differentiator in INC's latest campaigns is an updated credential dumper capable of targeting newer Veeam backup deployments that use salted DPAPI credential encryption, undermining a common recovery safeguard. Data is staged as password-protected archives and exfiltrated via Rclone before the encryptor is deployed using multithreading and partial encryption for speed. The payload includes a command-line interface for hands-on operator control, and executing it with the "--esxi" argument attempts to shut down virtual machines. The sale of INC's Windows and Linux variants on cybercrime forums in May 2024 has already spawned derivative families such as Lynx and Sinobi, which share significant code overlap with the original — a sign that INC's influence extends well beyond its own victim count. Defenders should also enforce strong credential hygiene, and teams can audit password strength with the password checker to reduce the risk of IAB-purchased credentials leading to a breach.