INC Ransom is a ransomware and data extortion threat group associated with the deployment of INC Ransomware that has been active since at least July 2023. INC Ransom has targeted organizations worldwide most commonly in the industrial, healthcare, and education sectors in the US and Europe.1234
- Bleeping Computer INC Ransomware March 2024
- Cybereason INC Ransomware November 2023
- Secureworks GOLD IONIC April 2024
- SentinelOne INC Ransomware
断言与引用
每条断言来自写入方；provenance 是写入方声称，不是本目录的复核结论。有效期按引用年份读取。
| predicate | object | 有效期 | 置信 | 证据 |
|---|---|---|---|---|
| uses_technique | tech_t1486 | 2024 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1021.001 | 2024 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1657 | 2024 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1047 | 2024 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1566 | 2024 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1059.003 | 2024 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1537 | 2024 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1087.002 | 2024 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1074 | 2024 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1071 | 2024 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1046 | 2024 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1569.002 | 2024 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1219 | 2024 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1685 | 2024 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1588.002 | 2024 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1036.005 | 2024 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1570 | 2024 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1069.002 | 2024 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1135 | 2024 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1190 | 2024 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1070.004 | 2024 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1078 | 2024 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1105 | 2024 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1560.001 | 2024 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1049 | 2024 → … | 100 | src_mitre_attck_enterprise |
技术使用
| ATT&CK | 技术 | platforms |
|---|---|---|
| T1021.001 | Remote Desktop Protocol | — |
| T1036.005 | Match Legitimate Resource Name or Location | — |
| T1046 | Network Service Discovery | — |
| T1047 | Windows Management Instrumentation | — |
| T1049 | System Network Connections Discovery | — |
| T1059.003 | Windows Command Shell | — |
| T1069.002 | Domain Groups | — |
| T1070.004 | File Deletion | — |
| T1071 | Application Layer Protocol | — |
| T1074 | Data Staged | — |
| T1078 | Valid Accounts | — |
| T1087.002 | Domain Account | — |
| T1105 | Ingress Tool Transfer | — |
| T1135 | Network Share Discovery | — |
| T1190 | Exploit Public-Facing Application | — |
| T1219 | Remote Access Tools | — |
| T1486 | Data Encrypted for Impact | — |
| T1537 | Transfer Data to Cloud Account | — |
| T1560.001 | Archive via Utility | — |
| T1566 | Phishing | — |
| T1569.002 | Service Execution | — |
| T1570 | Lateral Tool Transfer | — |
| T1588.002 | Tool | — |
| T1657 | Financial Theft | — |
| T1685 | Disable or Modify Tools | — |
别名
GOLD IONIC · INC Ransom
读取与复核
记录自动入库·未人工复核。置信度是写入方给出的 0–100 值，置信带按 ≥80 / 50–79 / <50 划为高 / 中 / 低；四条信任轴（合成、生命周期、置信带、佐证源数）分开呈现，不合并为单一信任分。