INC Ransom

G10321 reports

aliases · INC Ransom · GOLD IONIC

Reports

Techniques

Tactics

Countries

58%

Hunt coverage

Aliases

Analyst assessment — key judgments

Signature techniques: T1053.005 (Scheduled Task), T1047 (Windows Management Instrumentation), T1213.002 (Sharepoint).
Primary targeting: US.
Currently dormant: 0 report(s) in last 30d vs 0 prior (+0%).
Hunt coverage 58% of 24 observed techniques (10 gap(s)).
Assessment confidence: medium (60).

Activity & trend

DormantLast 30d: 0 vs 0 prior (+0%)· first reported 2026-03-16 · last 2026-03-16

30d

90d

All

0.0

Rpts/wk

Reporting timeline · 12 months

Movement — last 30 days

Dropped (90d+)

T1053.005T1047T1213.002T1588.007T1059.007T1583.008T1003.002T1543.003T1588.006T1555.005T1219T1684

Vulnerabilities in this actor's reporting · 16

Overview

Analyst triage

Intelligence summary

INC Ransom is a ransomware and data extortion threat group associated with the deployment of INC Ransomware that has been active since at least July 2023. INC Ransom has targeted organizations worldwide most commonly in the industrial, healthcare, and education sectors in the US and Europe.(Citation: Bleeping Computer INC Ransomware March 2024)(Citation: Cybereason INC Ransomware November 2023)(Citation: Secureworks GOLD IONIC April 2024)(Citation: SentinelOne INC Ransomware)

Top co-occurring indicators

Aliases & naming

Targeting · countries

Targeting · named victims

ATT&CK technique matrix

Coverage vs hunt library:

—

Hunt-coverage gaps — prioritized

Top techniques by observation

T1053.005 · Scheduled Taskconf 601
evidence: Ransomware Under Pressure: Tactics, Techniques, and Procedures in a Sh
T1047 · Windows Management Instrumentationconf 601
evidence: Ransomware Under Pressure: Tactics, Techniques, and Procedures in a Sh
T1213.002 · Sharepointconf 601
evidence: Ransomware Under Pressure: Tactics, Techniques, and Procedures in a Sh
T1588.007 · Artificial Intelligenceconf 601
evidence: Ransomware Under Pressure: Tactics, Techniques, and Procedures in a Sh
T1059.007 · JavaScriptconf 601
evidence: Ransomware Under Pressure: Tactics, Techniques, and Procedures in a Sh
T1583.008 · Malvertisingconf 601
evidence: Ransomware Under Pressure: Tactics, Techniques, and Procedures in a Sh
T1003.002 · Security Account Managerconf 601
evidence: Ransomware Under Pressure: Tactics, Techniques, and Procedures in a Sh
T1543.003 · Windows Serviceconf 601
evidence: Ransomware Under Pressure: Tactics, Techniques, and Procedures in a Sh
T1588.006 · Vulnerabilitiesconf 601
evidence: Ransomware Under Pressure: Tactics, Techniques, and Procedures in a Sh
T1555.005 · Password Managersconf 601
evidence: Ransomware Under Pressure: Tactics, Techniques, and Procedures in a Sh
T1219 · Remote Access Toolsconf 601
evidence: Ransomware Under Pressure: Tactics, Techniques, and Procedures in a Sh
T1684 · Social Engineeringconf 601
evidence: Ransomware Under Pressure: Tactics, Techniques, and Procedures in a Sh

Threat catalogue · engineering roadmap0

Flagged detection-engineering queue

Uncovered techniques you flagged for hunt / detection build-out, aggregated across every actor you visit. Stored locally in your browser.

Infrastructure

IOC type mix

Tooling / malware families

Relationships

Activity

30-day mention timeline

Recent reporting

Title	Source	Severity	Collected