From emerging threat to top-tier ransomware-as-a-service: The evolution of INC ransomware
June 17, 2026, 8:24 p.m.
Description
INC has evolved from an emerging ransomware-as-a-service operation into one of the most active groups in 2026, claiming over 800 victims since 2023. The disruption of LockBit and BlackCat's shutdown created opportunities for INC to expand as affiliates migrated. Both Windows and Linux/ESXi encryptors have been rewritten in Rust, enabling cross-platform development and increasing analysis complexity. Recent incidents reveal updated tooling, including a modified credential dumper targeting newer Veeam backup deployments with support for salted DPAPI encryption. INC's influence extends beyond its operations; following the 2024 source code sale for $300,000, related families like Lynx and Sinobi emerged. United States organizations account for over 65% of victims, with legal services, manufacturing, construction, technology, and healthcare among the most targeted sectors.
Tags
Date
- Created: June 17, 2026, 1:38 p.m.
- Published: June 17, 2026, 1:38 p.m.
- Modified: June 17, 2026, 8:24 p.m.
Indicators
- 1d10d8f5a420d0e4683b4cb40bcf0c984d1e7ea1f3b4442a00a525584632ac11
- dc9938f51150d13a69fc25f3f19052eacb1bf0a086fd5cf39762501fb3ddd7da
- 1898d056463284d849801cbdea6a3dec6c9f568f01569912c3868a5eea9a5449
- bf8c45e5aa9551a17eefbd1d179422c32b4309c47ee9a3f315bb80ed6d4f7efc
- 31800380c359143ae82c4f9011eee653dd22443d03d6a499148203bbfc275502
- 765508aa2ec6a1b73a76a23f4fa559d32355622748c91a46ed7b315eae2ee60a
- d65120291dee76c694f8bea54841f7f68329b499b28f4aee5ea5c9369a7432cb
- 24f6c0ca39b2a5593086ff56d818ddfbde121f8e44d54faa762e510397dc9db7
- 6cd349eda0fa6c8b274a0920852c68f8b727afea1fdbc69ad183cef05d9cf141
- 60aeb9f7bccf377ff02ed64783e66a62c0f976878d9729b067bc7e5b0b9da9d6
- ff5da8f0330a4c581c37284c74aae2683c007dc6e406e1e2e6803e7bb398b77b
- 5cc212f84d2bf3fbab165aaf09b16e00fcf2f1ccd880d24b14404c53dcdbf241
- 8d1a22c430252f29611766b8e4a82af0fba60d609246463466b384d6d4793df4
- 7f37351979c249417cb180b4ede0ed17e5fe2a1f08add4d72606b589f8fdb245
- 97aebda5482899fef84a24e456bff055acaa47e5ab4029f768d9e0c62a660ce2
- 90e46e89fec2108a1cb4850bb33e3563e92a14d04e1e613ac8c9311f152d294c
- ea721240c14e3d14f8d88e0020880448c6c602f1180a1e5dbe40871cfeedcc22
- d26bfb0147f60dc6500a9298d521ee67b49daaf4b8f8be54e7cc8fd86a597570
- 6bf155b269d452f3c3b62832b27bbebe4da436e228dbf521155b1d5989e3743f
- 589d9480fbfec2d8e61638eb0b537183d0f9977411fd1d2c0f8eb611feebe880
- acce811c4fc2a6e3fddd4231e386f1648ca44f039d2d275316bc0a0fc96e0af4
- f6a01d0246ce31faf6938ea488086d4358505405a4ef5c5faa482e79e92cb347
Additional Informations
- Education
- Legal
- Manufacturing
- Technology
- Construction
- Healthcare
- incblog6qu4y4mm4zvw5nrmue6qbwtgjsxpw6b7ixzssu36tsajldoad.onion
- incblog.su
- incpaykabjqc2mtdxq6c23nqh4x6m5dkps5fr6vgdkgzp5njssx6qkid.onion