INC Ransom is a ransomware-as-a-service (RaaS) operation first identified in 2023 that uses a double-extortion model, combining data encryption with the theft of sensitive information to pressure victims into paying a ransom. If demands are not met, the group threatens to publish stolen data through its leak site. The threat profile examines INC Ransom’s operations, including its preferred targets, geographic focus, exploited vulnerabilities, associated threat actors, and the tools used throughout attacks. The group has frequently targeted organizations in the industrial and manufacturing sectors, demonstrating a focus on industries where operational disruption can be particularly costly. The report also analyzes attack behaviors across Windows and Linux systems, maps activities to the MIT

Join for free to read