INC Ransom is a ransomware and data extortion threat group associated with the deployment of INC Ransomware that has been active since at least July 2023. INC Ransom has targeted organizations worldwide most commonly in the industrial, healthcare, and education sectors in the US and Europe.1234
- Bleeping Computer INC Ransomware March 2024
- Cybereason INC Ransomware November 2023
- Secureworks GOLD IONIC April 2024
- SentinelOne INC Ransomware
Claims and citations
Every claim comes from a writer; provenance is the writer's assertion, not a review verdict from this directory. Validity reads by citation year.
| predicate | object | Valid | Conf. | Evidence |
|---|---|---|---|---|
| uses_technique | tech_t1486 | 2024 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1021.001 | 2024 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1657 | 2024 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1047 | 2024 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1566 | 2024 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1059.003 | 2024 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1537 | 2024 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1087.002 | 2024 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1074 | 2024 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1071 | 2024 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1046 | 2024 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1569.002 | 2024 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1219 | 2024 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1685 | 2024 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1588.002 | 2024 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1036.005 | 2024 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1570 | 2024 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1069.002 | 2024 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1135 | 2024 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1190 | 2024 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1070.004 | 2024 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1078 | 2024 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1105 | 2024 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1560.001 | 2024 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1049 | 2024 → … | 100 | src_mitre_attck_enterprise |
Technique use
| ATT&CK | Technique | platforms |
|---|---|---|
| T1021.001 | Remote Desktop Protocol | — |
| T1036.005 | Match Legitimate Resource Name or Location | — |
| T1046 | Network Service Discovery | — |
| T1047 | Windows Management Instrumentation | — |
| T1049 | System Network Connections Discovery | — |
| T1059.003 | Windows Command Shell | — |
| T1069.002 | Domain Groups | — |
| T1070.004 | File Deletion | — |
| T1071 | Application Layer Protocol | — |
| T1074 | Data Staged | — |
| T1078 | Valid Accounts | — |
| T1087.002 | Domain Account | — |
| T1105 | Ingress Tool Transfer | — |
| T1135 | Network Share Discovery | — |
| T1190 | Exploit Public-Facing Application | — |
| T1219 | Remote Access Tools | — |
| T1486 | Data Encrypted for Impact | — |
| T1537 | Transfer Data to Cloud Account | — |
| T1560.001 | Archive via Utility | — |
| T1566 | Phishing | — |
| T1569.002 | Service Execution | — |
| T1570 | Lateral Tool Transfer | — |
| T1588.002 | Tool | — |
| T1657 | Financial Theft | — |
| T1685 | Disable or Modify Tools | — |
Aliases
GOLD IONIC · INC Ransom
Reading and review
Records are auto-ingested and not human-reviewed. Confidence is the writer's 0–100 value; bands split at ≥80 / 50–79 / <50 into high / medium / low. The four trust axes (synthetic, lifecycle, band, source count) stay separate and never merge into one score.