Skip to main content
Ransomware Group

INC Ransom

INC Ransom is a prolific ransomware-as-a-service operation active since July 2023 that systematically targets healthcare, government, education, and manufacturing sectors in North America and Europe, having posted over 200 victims in 2025 alone with no sector off-limits.

Known victims980

Threat level

CRITICAL

Get an alert if one of your domains is named on a ransomware leak site.

Monitor your domainsFree account · up to 5 monitored targets

Tactics, Techniques & Procedures (TTPs)

CredentialTheft

  • Mimikatz

DiscoveryEnum

  • AdFind
  • Advanced IP Scanner
  • SoftPerfect NetScan

Exfiltration

  • 7-Zip
  • BackBlaze
  • MEGA
  • RClone
  • Restic
  • +2 more

LOLBAS

  • Finger
  • PsExec

Networking

  • Bitvise SSH Client

RMM-Tools

  • AnyDesk

Indicators of Compromise (IOCs)

IP addresses

2
  • 213.176.114.6
  • 178.20.41.208

Get the complete IOC feed

The full IOC database by API, ready for your SIEM or SOAR.

Create free account

No credit card required · Free API key

Known infrastructure

The following Tor hidden services have been associated with this group:

  • INC Ransom
  • Error Response Page
  • Error Response Page
  • incbackrlasjesgpfu5brktfjknbqoahe2hhmqfhasc5fb56mtukn4yd.onion
  • incbacg6bfwtrlzwdbqc55gsfl763s3twdtwhp27dzuik6s6rwdcityd.onion

These sites are malicious. Open them only from an isolated environment.

0

Check if you’re affected

Look up your domain to see whether it appears on INC Ransom’s victim list.

Try it nowFree⌘K
Try

risk score · threat categories · sources · age · confidence — in one request

Other active ransomware groups

LockBitALPHV BlackcatCL0PPlayBianLianAkiraMedusaRhysida