Ransomware Intelligence / Groups / inc ransom

Ransomware group

inc ransom

INC Ransom is a prolific ransomware-as-a-service operation active since July 2023 that systematically targets healthcare, government, education, and manufacturing sectors in North America and Europe, having posted over 200 victims in 2025 alone with no sector off-limits.

  • 7claims, 7 days
  • 28claims, 30 days
  • 103claims, 90 days
  • 2026-04-01first seen
  • 2026-11-03last seen

These are claims posted by the group on its leak site, counted when we first see them. They are not confirmed incidents, and we never name a victim.

Activity, last 26 weeks

New leak-site claims per week.

Week of 2026-05-11: 8Week of 2026-05-18: 4Week of 2026-05-25: 7Week of 2026-06-01: 10Week of 2026-06-08: 5Week of 2026-06-15: 8Week of 2026-06-22: 7Week of 2026-06-29: 12Week of 2026-07-06: 3Week of 2026-07-13: 12Week of 2026-07-20: 4Week of 2026-07-27: 12Week of 2026-08-03: 11Week of 2026-08-10: 7Week of 2026-08-17: 13Week of 2026-08-24: 6Week of 2026-08-31: 14Week of 2026-09-07: 4Week of 2026-09-14: 11Week of 2026-09-21: 8Week of 2026-09-28: 10Week of 2026-10-05: 10Week of 2026-10-12: 8Week of 2026-10-19: 3Week of 2026-10-26: 1Week of 2026-11-02: 6
Claims per week, oldest to newest. Each bar is a full Monday-to-Sunday week; the newest bar is the current week so far.

Sectors claimed, last 90 days

  1. Unclassified 21
  2. Professional services 20
  3. Manufacturing 15
  4. Healthcare 11
  5. Financial services 6
  6. Technology 4
  7. Construction 3
  8. Critical infrastructure 3
  9. Government 3
  10. K-12 education 3
  11. Media and entertainment 3
  12. Nonprofit 3
  13. Retail 3
  14. Hospitality 2
  15. Higher education 1
  16. Other 1
  17. Transportation and logistics 1

Countries claimed, last 90 days

  1. United States 55
  2. Canada 5
  3. Germany 5
  4. Brazil 3
  5. Spain 3
  6. United Kingdom 3
  7. Malaysia 3
  8. United Arab Emirates 2
  9. India 2
  10. Mexico 2
  11. Taiwan 2
  12. South Africa 2
  13. Argentina 1
  14. Australia 1
  15. Switzerland 1

Vulnerabilities inc ransom exploits

CVEs attributed to inc ransom by Ransomware.live, most severe first. Patch these first if this group is in your threat model.

CVE Vendor / product CVSS CISA KEV
CVE-2026-15409 SonicWall SMA1000 10.0 Critical Listed 2026-07-14, ransomware use
CVE-2026-15410 SonicWall SMA1000 7.2 High Listed 2026-07-14, ransomware use

70% of successful ransomware attacks use remote encryption (Microsoft, 2024): files on protected servers are encrypted over the network from a device the attacker controls. Read our remote encryption briefing →

Newest vulnerabilities used by any ransomware group (CISA KEV)
Added CVE Vendor / product Vulnerability
2026-08-18 CVE-2026-59310 Broadcom VMware vCenter Broadcom VMware vCenter Path Traversal Vulnerability
2026-08-05 CVE-2026-63077 JetBrains TeamCity JetBrains TeamCity Deserialization of Untrusted Data Vulnerability
2026-07-29 CVE-2026-20316 Cisco Secure Firewall Management Center (FMC) Cisco Secure Firewall Management Center Use of Hard-coded Password Vulnerability
2026-07-14 CVE-2026-15410 SonicWall SMA1000 Appliances SonicWall SMA1000 Appliances Code Injection Vulnerability
2026-07-14 CVE-2026-15409 SonicWall SMA1000 Appliances SonicWall SMA1000 Appliances Server-Side Request Forgery Vulnerability
2026-07-01 CVE-2026-45659 Microsoft SharePoint Server Microsoft SharePoint Server Deserialization of Untrusted Data Vulnerability
2026-06-25 CVE-2026-12569 PTC Windchill and FlexPLM PTC Windchill and FlexPLM Improper Input Validation Vulnerability
2026-06-12 CVE-2026-35273 Oracle PeopleSoft Enterprise PeopleTools Oracle PeopleSoft Enterprise PeopleTools Missing Authentication for Critical Function Vulnerability

Tactics and techniques

MITRE ATT&CK techniques reported for inc ransom by Ransomware.live, in attack order.

Resource Development
Initial Access
Execution
Discovery
Lateral Movement
Collection
Command and Control
Exfiltration
Impact
Defense Impairment
Stealth

Data sources: CISA KEV, Ransomchats, RansomLook, Ransomware.live, security news outlets · updated 12 hours ago

Sector, country and ransom-demand figures are SecuritySnares estimates made with a language model. Leak-site listings are claims by threat actors and are not independently verified; leak-site victims are never named unless they have disclosed the incident themselves. News headlines are the publishers' own reporting, shown as written and linked to the original. Methodology