INC Ransomware Claims More Than 800 Victims With Australia Second Most Targeted Country

Australia has emerged as the second most targeted country behind the United States in attacks carried out by INC ransomware, a group that has grown into one of the most active ransomware-as-a-service (RaaS) operations globally since first appearing in 2023.

Research published by the Acronis Threat Research Unit (TRU) reveals that INC ransomware has claimed more than 800 victims worldwide since it began operations, with the United States accounting for 65.3 per cent of all listed victims. Australia sits behind the US in the victim rankings, followed by Canada, Germany and Taiwan.

The group has established itself among the top five most active ransomware operations in 2026, consistently posting new victims to its data leak site and continuing to add hundreds of organisations to its disclosure list this year alone.

The findings carry particular significance for Australian organisations operating in the sectors most frequently targeted by the group, including legal services, manufacturing, technology, health care and construction.

From Emerging Operation To Top-Tier Threat

INC ransomware was first discovered in mid-2023 and operates as a semi-private, affiliate-based RaaS operation. Rather than a rebrand of an existing cybercriminal group, INC established itself as a distinct operation that rapidly built a reputation by targeting organisations across multiple sectors.

The group employs double extortion tactics, encrypting victim data while also exfiltrating sensitive files and threatening to publish them on a public leak site if ransom demands are not met.

INC’s growth was accelerated by the disruption of two previously dominant ransomware operations. The takedown of LockBit and the shutdown of BlackCat created a vacuum in the ransomware ecosystem, with several affiliates from those groups reportedly migrating to INC and other emerging operations.

The group also attracted the attention of Vice Society, a threat actor with a history of cycling through third-party ransomware payloads. In late 2024, Vice Society was observed deploying INC ransomware against health care targets.

Source Code Sale Spawns New Variants

INC’s influence extends beyond its own operations. In May 2024, a forum user known as “salfetka” listed the group’s Windows and Linux/ESXi payloads for sale on underground forums for US$300,000, limited to three buyers.

Security researcher 3xp0rt linked the “salfetka” account to the aliases “rinc” and “farnetwork”, which are tied to several previous ransomware operations including Nokoyawa, JSWORM, Nefilim, Karma and Nemty.

Shortly after the listing appeared, a new ransomware operation called Lynx emerged showing substantial code overlap with INC. Another variant, Sinobi, also appeared with similar characteristics.

The original INC brand continues to operate alongside these derivative strains, meaning the group’s codebase now propagates across multiple active ransomware operations.

Rust Rewrite Complicates Detection

Both the Windows and Linux/ESXi versions of INC ransomware have been rewritten in the Rust programming language, a move that increases the complexity of analysis and detection for security researchers while making cross-platform development easier for the operators.

The Acronis TRU researchers confirmed the Rust origins through the presence of Rust-specific function symbols, naming conventions and embedded runtime strings within the executables, as well as cargo registry dependency paths that serve as compiler signatures.

The Windows variant is a 64-bit executable that maintains a fully exposed import address table, allowing it to rely directly on native Windows operating system subsystems. The ransomware is operator-configurable through command-line arguments, giving attackers the ability to filter target software, execute anti-forensic passes or simulate deployment without causing damage.

The Linux/ESXi variant specifically targets VMware infrastructure, with the ability to enumerate and shut down all virtual machines before encrypting their associated files. This mirrors a broader trend among ransomware operations toward maximising impact by targeting hypervisors and the virtual machines they host.

Updated Tooling Targets Veeam Backups

The Acronis researchers observed that INC operators have updated their credential-stealing toolkit to target newer Veeam backup deployments, a development that highlights the group’s ongoing refinement of its tools.

In recent incidents, INC affiliates deployed a base64-encoded PowerShell script through the command line that functions as a Veeam credential dumper. The script is a modified version of an open-source tool, adapted to support Veeam’s newer salted DPAPI credential encryption method.

Unlike the original version of the tool, which pulls database connection settings from the registry automatically, the modified script uses hardcoded SQL server, instance and database values. This suggests it was tailored for specific target environments.

The updated script introduces a fallback decryption routine for newer encrypted credential blobs, improves error handling and formats output for automation or parsing. The researchers noted it is more compatible with modern Veeam deployments and designed for operational use rather than proof-of-concept testing.

Attack Chain Relies On Familiar Tactics

INC ransomware affiliates use a range of tools and techniques across their attack chains, combining exploitation of unpatched edge devices with credential theft and a mix of living-off-the-land binaries and commercial remote management tools.

For initial access, the group relies on spear phishing, valid account credentials purchased from initial access brokers and exploitation of vulnerabilities in public-facing applications. The Acronis researchers identified several specific vulnerabilities being exploited, including CVE-2023-3519 targeting Citrix Netscaler, CVE-2023-48788 targeting Fortinet EMS, CVE-2024-57727 targeting SimpleHelp RMM and CVE-2025-5777 known as Citrix Bleed 2.

Once inside a network, INC operators perform discovery using ping and net commands through the Windows command line, supplemented by tools such as Angry IP Scanner, Advanced IP Scanner and netscan.

For lateral movement, the group uses remote desktop protocol and PsExec to access and execute commands on other systems within the network. Command and control is maintained through a mix of red team tools and commercial remote access software, including Cobalt Strike, AnyDesk, ScreenConnect and TeamViewer.

Defence Evasion And Data Exfiltration

The Acronis researchers observed INC operators using multiple approaches to disable endpoint detection and response tools. In one incident, the group used PsKill, a Sysinternals utility that terminates local or remote processes. In another case, the operators deployed a custom process terminator that drops vulnerable drivers and installs them as a service to kill security software.

Before encrypting data, INC operators exfiltrate sensitive files by compressing and password-protecting them with 7-Zip before uploading the archives to attacker-controlled cloud storage using rclone. The researchers noted that many ransomware groups favour rclone because it works with dozens of cloud providers, allowing operators to pick whichever destination is least likely to be blocked by the victim’s firewall.

Encryption Designed For Speed

The ransomware payload itself is designed to maximise encryption speed across victim environments. The malware uses multithreading, spawning a total thread count equal to the host’s number of processors multiplied by four.

A tiered partial encryption routine based on file size accelerates the process, while exclusion lists prevent the encryption of critical system files and directories. The ransomware avoids extensions such as .msi, .exe, .dll and .inc, as well as folders including Windows, Program Files, appdata and $RECYCLE.BIN, ensuring the host remains functional enough to display the extortion message.

The Windows variant employs a hybrid encryption scheme using Salsa20 and AES symmetric encryption protected by Curve25519 elliptic curve cryptography. The Linux variant uses AES-128 in CTR mode with X25519 for key exchange.

Both variants append the .INC extension to encrypted files and leave a footer at the end of each file that serves as a marker for the ransomware family.

Dual Extortion Infrastructure

INC ransomware operates two separate web platforms to maximise pressure on victims. The first is a private negotiation site that requires unique credentials provided to the victim, acting as a communication channel for ransom negotiations. The second is a publicly accessible leak site used to publish stolen data if the victim refuses to pay.

The ransomware also includes a network printing routine that scans the compromised network for active printers and automatically sends commands to physically print hard copies of the ransom instructions, adding another layer of pressure.

Targeting Shifts By Region

The Acronis researchers observed that INC’s targeting strategy varies by geography. In the United States, victims cluster in regulated, privacy-sensitive industries such as legal services and health care, sectors that often carry cyber insurance and face significant regulatory and reputational pressure to resolve breaches quickly.

Outside the US, victims are spread more broadly across sectors including technology, manufacturing and construction, suggesting a less selective approach in non-US markets.

The researchers also noted the complete absence of victims from Commonwealth of Independent States countries, a pattern that suggests the operators are based in the CIS region and have agreements with affiliates to avoid attacking organisations within those countries.

The shift in sector targeting is also notable. In its early stages, INC primarily targeted the education sector. In 2026, legal services have become the primary target, with the researchers noting that law firms hold valuable files including settlement documents, case files and non-disclosure agreements that create additional pressure to pay ransoms due to the risk of malpractice claims and client lawsuits.

Mitigation Recommendations

The Acronis researchers recommended that organisations prioritise reducing external exposure and securing perimeter access points to limit intrusion risk from INC and similar groups.

Specific recommendations include following the 3-2-1 backup rule with offline or immutable backups, deploying endpoint detection and response tools with behavioural detections and anti-tamper protections, requiring multifactor authentication with strong passwords, segmenting networks and restricting outbound traffic, maintaining a patch management program that prioritises vulnerabilities known to be exploited by ransomware and conducting regular phishing awareness training and simulations.

Last Updated on June 18, 2026 by Nick Ross