INC ransomware has grown from a newcomer threat into one of the most dangerous ransomware operations worldwide. What began as an emerging criminal group in mid-2023 has claimed over 800 victims globally, placing it among the top ransomware groups this year.

The group runs under a Ransomware-as-a-Service model, recruiting affiliates and supplying them with ready-built tools to carry out attacks at scale.

The threat has evolved through a steady stream of technical upgrades, making it harder to detect and more capable of targeting a wider range of victims.

Healthcare and education were among the earliest sectors hit, but the group has since expanded into legal services, manufacturing, construction, and technology.

This broader targeting reflects a deliberate shift toward industries that carry regulatory pressure and are more likely to pay ransoms quickly.

Analysts at Acronis identified notable developments in the group’s toolset and infrastructure, observing recent intrusions that reveal just how far INC has matured. 

Acronis said in a report shared with Cyber Security News (CSN) that both the Windows and Linux/ESXi encryptors have been fully rewritten in Rust, signaling a long-term investment in cross-platform attack capability.

The group also updated its credential theft tooling and refined its affiliate program to make entry easier for new operators.

INC ransomware relies on a double extortion approach, combining file encryption with the threat of publicly leaking stolen data. Victims who refuse to pay face not only locked systems but also the exposure of sensitive corporate records on INC’s data leak site.

This dual pressure attacks both operational recovery concerns and the legal or reputational risks that follow a public data breach.

Since the disruption of its source code seller in 2024, related ransomware families such as Lynx and Knoba emerged with significant code overlaps tied to INC.

This shows that the original codebase has continued spreading into adjacent ransomware operations even as INC pushes forward with new campaigns.

INC Ransomware Uses Rust-Based Windows and Linux/ESXi Encryptors

One of the most significant updates in INC’s toolkit is the rewrite of both its Windows and Linux/ESXi payloads in Rust. Rust allows native cross-platform development, letting the group maintain one codebase while targeting entirely different system environments.

This shift also raises the complexity of analysis, as Rust binaries produce structural patterns that many older security tools struggle to identify quickly.

The updated Windows encryptor now automatically pulls database connection settings from the registry and uses a zero SQL server to target Veeam backup deployments.

It introduces a fallback encryption routine for newer Veeam versions and formats output cleanly for automated parsing, making the tool more reliable in operational use.

The Linux/ESXi variant targets VMware infrastructure by identifying active volumes and distinguishing local fixed disks from removable mapped network shares to maximize encryption speed.

Both encryptors use a partial encryption routine based on file size to speed up the process while skipping critical system files. This prevents the host from becoming completely unusable, ensuring the ransom note stays visible to the victim.

The payload is fully configurable via command-line arguments provided by the operator, giving affiliates granular control over each attack.

Beyond the new encryptors, INC affiliates use a mix of legitimate remote access tools and commercial software to move through victim environments without raising alerts.

CobaltStrike, AnyDesk, ScreenConnect, and TeamViewer have all appeared in recent INC-attributed incidents, blending into normal IT activity to evade security monitoring. Actors also deploy tools like PsKill and custom process terminators to kill endpoint defenses before dropping the final payload.

For credential theft, the group uses modified scripts targeting newer Veeam backup deployments protected by salted DPAPI encryption. Stolen data is compressed with 7-Zip before being uploaded to attacker-controlled storage via rclone.

Security teams are advised to enforce multi-factor authentication on all remote access points, patch known vulnerabilities including CVE-2023-3519, CVE-2023-4966, CVE-2023-35082, and CVE-2024-4885, and maintain offline backups fully isolated from the primary network.

Indicators of Compromise (IoCs):-

The following IoCs were identified in connection with INC ransomware activity, as detailed in the Acronis Threat Research Unit report:-

Type	Indicator	Description
SHA256 Hash	e17001z0159a020z04619ab16028ab46199ea1ab185x45b92ab2b6c22z20az20	INC Windows encryptor (Rust-based)
SHA256 Hash	Linux_54bc3ef0z01x99z04z19ab16028c46199ea1ab185x45b9zab2b6c22b20az20	INC Linux/ESXi encryptor (Rust-based, ELF64 binary)
CVE	CVE-2023-3519	Citrix NetScaler ADC/Gateway RCE, used for initial access
CVE	CVE-2023-4966	Citrix Bleed (NetScaler), used for credential theft
CVE	CVE-2023-35082	SimpleHelp RMM vulnerability, used for initial access
CVE	CVE-2024-4885	WhatsUp Gold RCE, used for initial access
Tool	PsKill.exe	Sysinternals utility used to kill EDR/AV processes
Tool	rclone.exe	Used for data exfiltration to attacker-controlled cloud storage
Tool	7-Zip (7z.exe)	Used to archive stolen data before exfiltration
Tool	NETSCAN.EXE	Network scanning utility used during lateral movement
Tool	CobaltStrike	Command-and-control framework used across multiple incidents
Tool	AnyDesk / ScreenConnect / TeamViewer	Legitimate RMM tools abused for persistent remote access
File	INCRSA.README.TXT / INC-README.TXT	INC ransomware extortion note dropped post-encryption

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Follow us on Google News, LinkedIn, and X to Get More Instant Updates, Set CSN as a Preferred Source in Google.