Back to Ransomware Database
Ransomware Group
incransom
INC Ransom is a prolific ransomware-as-a-service operation active since July 2023 that systematically targets healthcare, government, education, and manufacturing sectors in North America and Europe, having posted over 200 victims in 2025 alone with no sector off-limits.
Known victims936
Threat Level
CRITICAL
Tactics, Techniques & Procedures (TTPs)
CredentialTheft
- Mimikatz
DiscoveryEnum
- AdFind
- Advanced IP Scanner
- SoftPerfect NetScan
Exfiltration
- 7-Zip
- BackBlaze
- MEGA
- RClone
- Restic
- +2 more
LOLBAS
- Finger
- PsExec
Networking
- Bitvise SSH Client
RMM-Tools
- AnyDesk
Indicators of Compromise (IOCs)
IP Addresses
2- 213.176.114.6
- 178.20.41.208
Get Complete IOC Feed
Access our full IOC database via API for integration with your SIEM/SOAR.
Get StartedNo credit card required · Free API key
Check If You’re Affected
Search our database to see if your organization appears in incransom’s victim list.
Try it nowFree⌘K
Try
risk score · threat categories · sources · age · confidence — in one request