INC ransomware is a Rust-based ransomware-as-a-service operation, also known as GOLD IONIC, that has claimed more than 800 victims since first emerging in July 2023 and now ranks among 2026's most active ransomware groups. The operation predominantly strikes legal, manufacturing, healthcare, technology, and construction organizations, with the United States as the primary target.

INC ransomware operators gain initial access through unpatched, public-facing edge appliances, notably exploiting CVE-2023-3519 and CVE-2023-48788, or through broker-supplied stolen credentials. Once inside, the affiliates rely on living-off-the-land binaries and a modified Veeam credential dumper to move laterally across Windows, Linux, and VMware ESXi infrastructure.

Before encryption, data is exfiltrated to attacker-controlled cloud storage, and the operation applies aggressive defense impairment through driver-dropping process killers and shadow-copy deletion. Victims face pressure from multiple directions: a Tor negotiation portal, a public leak site, wallpaper defacement, and ransom notes printed directly to networked printers, reinforcing INC ransomware's double-extortion model.

First Seen: July 2023  |  Targeted Regions: Global, except CIS countries  |  Targeted Platforms: Windows, Linux, VMware ESXi

Targeted Industries: Manufacturing, Legal, Healthcare, Business Services & Consulting, Financial Services, Retail, Charitable Organizations, Government, Transportation, Technology, Education, Real Estate, Agriculture, Pharmaceutical, Energy, Telecommunications, Associations, Media, Aerospace, Defense, Insurance, Religion, Hospitality, Aviation, Food Service

#1 Origins and Rise of INC Ransom

INC Ransom is a Ransomware-as-a-Service (RaaS) operation that emerged in July 2023, also tracked under the alias GOLD IONIC. It established itself as a semi-private, affiliate-based operation rather than a rebrand, and by 2026 matured into a top-tier operator, with more than 800 victims claimed since 2023. Its rise was opportunistic: the disruption of LockBit and the shutdown of BlackCat pushed affiliates and tooling toward INC ransomware.

#2 Ecosystem Influence and Victimology

The group's ecosystem influence is distinctive. In May 2024 the INC ransomware source code was listed on underground forums for $300,000; shortly after, the Lynx operation emerged with substantial code overlap, and Sinobi later appeared. The original brand continues to operate while its codebase propagates into adjacent ransomware families. Victimology is US-centric: the United States accounts for 60% of victims, with a long tail led by Australia, Canada, and Germany, and a complete absence of CIS-region victims, suggesting CIS-based operators. The 2026 top five targeted sectors are legal services, manufacturing, technology, healthcare, and construction, a shift away from the group's earlier education focus.

#3 Attack Chain and Toolkit

The attack chain favors known techniques. Initial access comes via spear-phishing, initial access broker (IAB) credentials, and public-facing exploits: CVE-2023-3519 (Citrix NetScaler), CVE-2023-48788 (Fortinet FortiClient EMS), CVE-2024-57727 (SimpleHelp), and CVE-2025-5777 (Citrix Bleed 2). A modified Veeam credential dumper upgraded for salted-DPAPI, RDP/PsExec lateral movement, a BYOVD (Bring Your Own Vulnerable Driver) process terminator that drops vulnerable drivers, remote-access tooling for command-and-control, and 7-Zip plus rclone exfiltration round out the INC ransomware toolkit.

#4 Rust-Based Payloads and Extortion Model

Both INC ransomware payloads are now Rust-based. The Windows encryptor deletes shadow copies, uses a hybrid Salsa20/AES scheme with Curve25519 ECC, and appends a .INC extension to encrypted files. The Linux/ESXi variant supports --esxi (VM shutdown via vim-cmd), --motd, --daemon, and fast/medium/slow encryption modes, deriving per-file AES-128-CTR keys via X25519 ECDH. Extortion is double-sided: a credentialed negotiation site plus a public leak site, combined with wallpaper hijacking, INC-README ransom notes, and automated network printing of ransom notes.