INC

INC Ransom is a financially motivated ransomware-as-a-service operation that emerged in 2023 and became one of the more active extortion groups by 2026. The group is known for double-extortion operations in which data is stolen prior to encryption and victims are pressured through leak-site publication and negotiation portals. Common aliases include INC, INC Ransom, INC Ransomware, and Gold Ionic. Lynx is widely assessed as a closely related successor, rebrand, or evolved variant of the same broader criminal ecosystem, and some reporting has identified operational overlap between the two brands. INC Ransom has targeted organizations across multiple sectors worldwide, including healthcare, education, government, manufacturing, technology, construction, legal services, and professional services. Reporting in 2026 indicated a notable focus on legal-sector victims, likely because of the coercive value of confidential case materials, settlement records, and other sensitive business documents. The group has also been associated with attacks affecting nonprofits and public-interest organizations. The operation follows a typical affiliate-driven intrusion model. Initial access has been associated with spearphishing, use of valid accounts obtained from initial access brokers, exploitation of vulnerable internet-facing applications, abuse of exposed remote services, and credential-based compromise of perimeter infrastructure. Once inside a network, operators conduct reconnaissance, identify domain controllers and other high-value systems, dump credentials, escalate privileges, move laterally with legitimate administrative tooling, exfiltrate sensitive data, and then deploy ransomware for impact. Public reporting and ATT&CK-aligned analysis have associated the group with techniques including Valid Accounts, credential theft, remote services abuse, command and scripting interpreters, account manipulation, privilege escalation, remote system discovery, local data collection, exfiltration, and data encryption for impact. INC Ransom has shown cross-platform capability. Exposed affiliate infrastructure in 2026 revealed active Windows and Linux encryptor development and deployment activity, including Rust-based Linux tooling compiled for a broad range of processor architectures. That infrastructure also showed evidence of enterprise-focused tradecraft such as Active Directory enumeration, Kerberos ticket handling, password cracking activity, VPN-enabled victim access, and targeted exfiltration of sensitive business data. These observations indicate a mature operational model oriented toward large heterogeneous environments rather than opportunistic single-host encryption. Multiple 2026 investigations linked INC Ransom to the FortiBleed credential-harvesting campaign targeting Fortinet FortiGate devices. Researchers reported direct evidence that an operator tied to FortiBleed infrastructure had access to INC Ransom negotiation systems, and victim overlap suggested that stolen firewall and VPN access was being operationalized for downstream ransomware deployment. Those findings support the assessment that INC Ransom either works closely with, or purchases access from, organized initial access broker activity. Separate reporting described FortiBleed as likely run by a Russian-speaking criminal team, but public evidence does not conclusively establish INC Ransom itself as a state-sponsored actor. INC Ransom is recognized in MITRE ATT&CK as a cybercriminal group associated with double-extortion ransomware activity. The group’s growth has been attributed to aggressive affiliate recruitment, sustained operational tempo, and the broader reshaping of the ransomware market after disruption of other major crews. By 2026, it had claimed hundreds of victims that year alone and was widely regarded as a prolific and operationally mature extortion threat.