INC Ransom
INC Ransom is a ransomware and data extortion threat group associated with the deployment of INC Ransomware that has been active since at least July 2023. INC Ransom has targeted organizations worldwide most commonly in the industrial, healthcare, and education sectors in the US and Europe.
Attribution signal
?Score = mentions × confidence weight, summed across all attributed sources. Higher source diversity increases the score.≥ 10 High≥ 3 Moderate< 3 Low0.1
Low signal strength
Mentions1
Sources1
High conf.0
Last seenMay 2026
First observed
2024-06-06
Last active
—
Origin
Unknown — financially motivated cybercriminal group
Aliases
2
Techniques
25
Campaigns
0
Attribution signals
1 mention · 1 source#1unspecified
Malware
cyberscoop
May 2026