INC Ransom
A ransomware-as-a-service and data extortion operation active since July 2023. Australia, New Zealand and Tonga warned about it in March 2026, and it claimed the 2024 attack on NHS Dumfries and Galloway.
Threat actor profile. Last reviewed 3 November 2026.
Why It Matters
The clearest UK case is NHS Dumfries and Galloway. It acknowledged a cyber attack in March 2024, and INC Ransom claimed it, saying it held about 3TB of data.6 The board later wrote to households in a region of just under 150,000 people, telling them to assume some of their data had been copied and published.7
Healthcare keeps appearing. In March 2026 Australian, New Zealand and Tongan agencies warned about the group, with professional services and health care the main sectors in Australian incidents.4 Its focus has also shifted. Acronis lists legal services, manufacturing, technology, health care and construction as its top 2026 targets.5
Names can mislead here. Unit 42 calls Lynx a successor to INC and found substantial reuse of code, but does not say how that came about.8 Its source code was offered for sale in 2024.8,5 Vice Society has also deployed it.5 A sample resembling INC does not by itself tell you who is behind an intrusion.
The Australian Signals Directorate's advice to "assume compromise" and protect critical assets, reported in March 2026, fits this group, because it blends in using ordinary administration tools.2
How It Attacks
From agency warnings as reported2,9 and Acronis.5 Affiliates vary, so treat this as a typical pattern.
- 1
Get In
Uses spear phishing, credentials from access brokers and flaws in internet-facing systems.
- 2
Create Access
Creates new administrator accounts and moves laterally. Reported in Australian health care cases since January 2025.
- 3
Discover
Uses ping and net commands, Advanced IP Scanner and NetScan.
- 4
Take Credentials and Hide
Uses a modified Veeam credential dumper, and vulnerable drivers to stop security tools.
- 5
Steal the Data
Compresses with 7-Zip or WinRAR and uploads with Rclone.
- 6
Encrypt and Publish
Encrypts systems and threatens publication on a Tor leak site.
Key Techniques
Selected from the group's ATT&CK v20 entry.1 ATT&CK lists more.
| ID | Technique | Tactic | What It Looks Like |
|---|---|---|---|
| T1566 | Phishing | Initial Access | Initial access through phishing. |
| T1190 | Exploit Public-Facing Application | Initial Access | Includes Citrix NetScaler. |
| T1078 | Valid Accounts | Initial Access | Compromised accounts. |
| T1021.001 | Remote Desktop Protocol | Lateral Movement | RDP for movement. |
| T1219 | Remote Access Tools | Command and Control | AnyDesk and PuTTY. |
| T1570 | Lateral Tool Transfer | Lateral Movement | Copies the encryptor to many endpoints. |
| T1685 | Disable or Modify Tools | Defense Impairment | Uses a native tool to disable Windows Defender. |
| T1560.001 | Archive via Utility | Collection | 7-Zip and WinRAR. |
| T1537 | Transfer Data to Cloud Account | Exfiltration | MegaSync. |
| T1486 | Data Encrypted for Impact | Impact | Encrypts victim data. |
Tools Observed
Discovery
Remote Access and Movement
Defence Evasion
Data Theft
From ATT&CK1 and Acronis.5 Agency guidance stresses that it uses legitimate software, so context matters.9
Vulnerabilities
From ATT&CK1 and Acronis.5 Arete also links INC to wider abuse of Fortinet access, which it calls FortiBleed.11
Agencies place internet-facing assets first in structured vulnerability management.2
Key Events
Active from this month.1
NHS Dumfries and Galloway acknowledges an attack and INC Ransom claims it.6
Source code offered for sale. Lynx emerges in July 2024 with substantial code reuse.8,5
NHS Dumfries and Galloway writes to households about data published.7
Vice Society seen deploying INC against health care.5
Australian, New Zealand and Tongan agencies publish an advisory.4,2,9
Arete says INC remained active and links it to Fortinet access abuse.11
Coveware shows INC among new entries in its top variants.3
Warning Signs
From the 2026 agency warning as reported9 and ATT&CK.1 These only count in context.
- New privileged accounts created soon after a login from a compromised user
- 7-Zip or WinRAR compressing data on servers
- Rclone or MegaSync connecting to external storage
- PsExec renamed to look like a Windows update file
- A run of copy commands placing the same file on many endpoints
Defences That Matter
Harden Remote Access
- Enforce phishing-resistant MFA.2
- Limit remote management tools to authorised administrators.2
- Restrict network traffic to business-critical services.2
Fix What Is Exposed
- Run structured vulnerability management, prioritising internet-facing assets.2
- Replace legacy IT where feasible.2
Assume Compromise
- Enhance logging and protect critical assets.2
- Use EDR with behavioural detection and anti-tamper features.5
Cover Suppliers and Recovery
- Set contractual security standards and vendor-risk oversight.2
- Keep and test offline backups, and document incident response plans.2
Could You Tell Patients or Clients What Was Taken?
We can test your access controls and response plans against the methods in this profile, and then help you close the gaps.
Sources
- MITRE ATT&CK: INC Ransom (G1032), ATT&CK v20
- Insurance Business: Authorities warn of INC Ransom impact on regional networks, reporting the ASD, NZ NCSC and CERT Tonga advisory of 6 March 2026, 10 March 2026
- Coveware by Veeam: Ransomware Payment Trends Q3 2026, 28 October 2026
- ACSC, NCSC-NZ and CERT Tonga: INC Ransom Affiliate Model Enabling Targeting of Critical Networks, 6 March 2026
- Acronis TRU: From emerging threat to top-tier ransomware-as-a-service: the evolution of INC ransomware, 17 June 2026
- Computer Weekly: Ransomware gang leaks data stolen from Scottish NHS board, undated, on events of March 2024
- The Record: report on NHS Dumfries and Galloway's letter to households, 17 June 2024
- Unit 42: research on Lynx ransomware and its overlap with INC, 10 October 2024, updated 17 October 2024
- Cyble: INC Ransom attacks Australia and New Zealand, 9 March 2026
- CISA Known Exploited Vulnerabilities catalogue, version 2026.10.30
- Arete: Ransomware Trends and Data Insights, April 2026, 4 May 2026
MITRE ATT&CK® and ATT&CK® are registered trademarks of The MITRE Corporation. © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. ATT&CK terms of use.