INC Ransom
- ID
- G1032
- Associated names
- GOLD IONIC
- Source
- attack.mitre.org
- MITRE last modified
- 1 Aug 2026
INC Ransom is a ransomware and data extortion threat group associated with the deployment of INC Ransomware that has been active since at least July 2023. INC Ransom has targeted organizations worldwide most commonly in the industrial, healthcare, and education sectors in the US and Europe.[1][2][3][4]
Techniques used (25)
- T1021.001 Remote Desktop Protocol
- T1036.005 Match Legitimate Resource Name or Location
- T1046 Network Service Discovery
- T1047 Windows Management Instrumentation
- T1049 System Network Connections Discovery
- T1059.003 Windows Command Shell
- T1069.002 Domain Groups
- T1070.004 File Deletion
- T1071 Application Layer Protocol
- T1074 Data Staged
- T1078 Valid Accounts
- T1087.002 Domain Account
- T1105 Ingress Tool Transfer
- T1135 Network Share Discovery
- T1190 Exploit Public-Facing Application
- T1219 Remote Access Tools
- T1486 Data Encrypted for Impact
- T1537 Transfer Data to Cloud Account
- T1560.001 Archive via Utility
- T1566 Phishing
- T1569.002 Service Execution
- T1570 Lateral Tool Transfer
- T1588.002 Tool
- T1657 Financial Theft
- T1685 Disable or Modify Tools
Software used (8)
- S0029 PsExec
- S0039 Net
- S0183 Tor
- S0359 Nltest
- S0404 esentutl
- S0552 AdFind
- S1040 Rclone
- S1139 INC Ransomware