Threat actor · MITRE ATT&CK G1032
INC
Also tracked as INC Ransom, INC Ransomware, INC Ransomware group
Tracked by CyberSIXT since 29 Apr · RSS
Activity
22 articles from 8 outlets; the latest 8 days ago.
- Thu 29 Oct. Research report by SOCRadar. INC and The Gentlemen Ransomware: Exposed AI Infrastructure.
- Fri 23 Oct. The Hacker News. AI Agents Power Ransomware Affiliates’ Attacks on Edge Devices. Cites a CVE in CISA KEV.
- Fri 23 Oct. SecurityOnline. INC Ransomware Exposed Using AI and Custom Malware Against Victims. Cites a CVE in CISA KEV.
- Wed 21 Oct. Infosecurity. Ransomware Attacks Jump 50% as Data Theft Replaces Encryption.
- Tue 20 Oct. DataBreaches. Ransomware gangs exploit patched Palo Alto VPN security flaw. Cites a CVE in CISA KEV.
- Tue 20 Oct. The Hacker News. Qilin and INC ransomware gangs exploit Palo Alto VPN flaw to bypass MFA. Cites a CVE in CISA KEV.
- Tue 20 Oct. SOCRadar. AI-Driven Ransomware Campaign Targeted 62 Organisations. Cites a CVE in CISA KEV.
- Tue 20 Oct. SecurityOnline. Ransomware gangs bypass MFA through PAN OS VPN flaw CVE-2026-0257. Cites a CVE in CISA KEV.
- Wed 9 Sep. DataBreaches. New Jersey School District Network Outage Linked to Ransomware Attack.
- Tue 4 Aug. Security Affairs. INC Ransomware abuses CVE-2026-15409 in SonicWall, calls victims. Cites a CVE in CISA KEV.
- Mon 3 Aug. SecurityWeek. INC Ransomware exploits CVE-2026-15409, gains root on SonicWall. Cites a CVE in CISA KEV.
- Mon 3 Aug. SecurityOnline. SonicWall SMA Exploit Chain Now Fuels INC Ransomware Attacks. Cites a CVE in CISA KEV.
- Thu 30 Jul. DataBreaches. Operation Silent Vector targets INC ransomware with bounty.
- Thu 23 Jul. Research report by Medium. INC Ransom: Infrastructure Analysis, Operational Tradecraft, and Detection Opportunities.
- Fri 1 May. Research report by cisoseries.com. Cybersecurity News: INC targets healthcare, Providence schools cyberattack, Apple iPads bricked.
- Fri 1 Nov. Research report by Cybereason. THREAT ALERT - INC RANSOMWARE [NEST].
- Known exploited CVE
- Article naming INC
- Square: research report
- Articles a day, all coverage
- Quiet time, folded
Drawn: the latest 12 of 22 articles and all 4 research reports.
Show as tableHide table
| Date | Type | Source | Title |
|---|---|---|---|
| 29 Oct | Report | SOCRadar | INC and The Gentlemen Ransomware: Exposed AI Infrastructure |
| 23 Oct | Article | The Hacker News | AI Agents Power Ransomware Affiliates’ Attacks on Edge Devices |
| 23 Oct | Article | SecurityOnline | INC Ransomware Exposed Using AI and Custom Malware Against Victims |
| 21 Oct | Article | Infosecurity | Ransomware Attacks Jump 50% as Data Theft Replaces Encryption |
| 20 Oct | Article | DataBreaches | Ransomware gangs exploit patched Palo Alto VPN security flaw |
| 20 Oct | Article | The Hacker News | Qilin and INC ransomware gangs exploit Palo Alto VPN flaw to bypass MFA |
| 20 Oct | Article | SOCRadar | AI-Driven Ransomware Campaign Targeted 62 Organisations |
| 20 Oct | Article | SecurityOnline | Ransomware gangs bypass MFA through PAN OS VPN flaw CVE-2026-0257 |
| 9 Sep | Article | DataBreaches | New Jersey School District Network Outage Linked to Ransomware Attack |
| 4 Aug | Article | Security Affairs | INC Ransomware abuses CVE-2026-15409 in SonicWall, calls victims |
| 3 Aug | Article | SecurityWeek | INC Ransomware exploits CVE-2026-15409, gains root on SonicWall |
| 3 Aug | Article | SecurityOnline | SonicWall SMA Exploit Chain Now Fuels INC Ransomware Attacks |
| 30 Jul | Article | DataBreaches | Operation Silent Vector targets INC ransomware with bounty |
| 23 Jul | Report | Medium | INC Ransom: Infrastructure Analysis, Operational Tradecraft, and Detection Opportunities |
| 1 May | Report | cisoseries.com | Cybersecurity News: INC targets healthcare, Providence schools cyberattack, Apple iPads bricked |
| 1 Nov | Report | Cybereason | THREAT ALERT - INC RANSOMWARE [NEST] |
Connections
6 exploited CVEs · 8 tools. What the record links this actor to; hover or use the arrow keys.
Show as a listHide the list
- Exploited CVEs
- CVE-2026-41940, CVE-2026-35616, CVE-2026-15410, CVE-2026-15409, CVE-2026-0257, CVE-2024-57727
- Affected vendors
- WebPros, Fortinet, SonicWall, Palo Alto Networks, SimpleHelp
- Malware and tools
- PsExec, Net, Tor, Nltest, esentutl, AdFind, Rclone, INC Ransomware
- Related actor
- The Gentlemen
Profile
Written by CyberSIXT from the sources listed below. Updated 26 Oct.
MITRE ATT&CK describes INC as a ransomware and data extortion group associated with the deployment of INC Ransomware, active since at least July 20231. Unit 42 tracks the group as Tarnished Scorpius, and MITRE lists GOLD IONIC as an alias2,3,4. MITRE states it has targeted organizations worldwide, most commonly in the industrial, healthcare, and education sectors in the US and Europe1.
SOCRadar Threat Research Unit disclosed an AI-driven intrusion ecosystem operated by affiliates of INC Ransomware and The Gentlemen Ransomware, including 46 custom INC encryptor builds staged for October 1, 20265. SecurityWeek reported INC Ransomware as the primary threat actor exploiting CVE-2026-15409 and CVE-2026-15410 in SMA1000 appliances, which were exploited as zero-days since June 22, 20266. Unit 42 named Tarnished Scorpius among operators exploiting CVE-2026-0257 in PAN-OS and Prisma Access, in campaigns Palo Alto Networks described as financially motivated3.
Crime Stoppers International launched Operation Silent Vector, which offers a bounty for validated information leading to an arrest of people associated with INC Ransomware7.
- INC: description · MITRE ATT&CK
- Ransomware gangs exploit patched Palo Alto VPN security flaw · DataBreaches.net · 2026-10-20
- Qilin and INC ransomware gangs exploit Palo Alto VPN flaw to bypass MFA · The Hacker News · 2026-10-20
- INC: alias · MITRE ATT&CK
- AI-Driven Ransomware Campaign Targeted 62 Organisations · SOCRadar · 2026-10-20
- INC Ransomware exploits CVE-2026-15409, gains root on SonicWall · SecurityWeek · 2026-08-03
- Operation Silent Vector targets INC ransomware with bounty · DataBreaches.net · 2026-07-30
© 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation.
CVEs exploited6
CVEs an article attributes to INC, most covered first
- CVE-2024-57727Exploited
SimpleHelp Path Traversal Vulnerability
9.1Critical97% EPSS · 3 articles - CVE-2026-0257Exploited
Palo Alto Networks PAN-OS Authentication Bypass Vulnerability
7.8High95% EPSS · 26 articles - CVE-2026-15409Exploited
SonicWall SMA1000 Appliances Server-Side Request Forgery Vulnerability
10.0Critical6.8% EPSS · 19 articles - CVE-2026-15410Exploited
SonicWall SMA1000 Appliances Code Injection Vulnerability
7.2High12% EPSS · 16 articles - CVE-2026-35616Exploited
Fortinet FortiClient EMS Improper Access Control Vulnerability
9.1Critical94% EPSS · 14 articles - CVE-2026-41940Exploited
WebPros cPanel & WHM and WP2 (WordPress Squared) Missing Authentication for Critical Function Vulnerability
9.8Critical99% EPSS · 9 articles
MITRE ATT&CK techniques25 techniques · 13 tactics
Distinct techniques recorded per ATT&CK tactic. The shape shows what the record covers, not activity or risk.
Show as tableHide table
| Tactic | INC | Average of 48 actors |
|---|---|---|
| Reconnaissance | 0 | 2.2 |
| Resource Development | 1 | 4.9 |
| Initial Access | 3 | 3.3 |
| Execution | 3 | 5.7 |
| Persistence | 1 | 4.4 |
| Privilege Escalation | 1 | 3.7 |
| Stealth | 3 | 7.9 |
| Defense Impairment | 1 | 1.5 |
| Credential Access | 0 | 3.1 |
| Discovery | 5 | 5.9 |
| Lateral Movement | 2 | 1.5 |
| Collection | 2 | 3.1 |
| Command and Control | 3 | 4 |
| Exfiltration | 1 | 0.9 |
| Impact | 2 | 1.1 |
Most recorded: Discovery 5 · Initial Access 3 · Execution 3
Show the technique matrixTechnique matrix28 techniques
Resource Development1
Initial Access3
Execution3
Persistence1
Privilege Escalation1
Stealth3
Defense Impairment1
Discovery5
Lateral Movement2
Collection2
Command and Control3
Exfiltration1
Impact2
© 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. All techniques on MITRE ATT&CK
Malware and tools8
MITRE ATT&CK® · G1032
CVEs named alongside2
These articles name both the actor and the CVE. They do not attribute exploitation of these CVEs to INC.
- CVE-2026-42208Exploited
BerriAI LiteLLM SQL Injection Vulnerability
9.3Critical89% EPSS · 9 articles - CVE-2026-63030Exploited
WordPress Core Interpretation Conflict Vulnerability
9.8Critical11% EPSS · 15 articles
Articles22
Drawn: the latest 12 of 22 articles and all 4 research reports.
- AI Agents Power Ransomware Affiliates’ Attacks on Edge DevicesThe Hacker NewsExploitedCVE-2024-57727
- INC Ransomware Exposed Using AI and Custom Malware Against VictimsSecurityOnlineExploitedCVE-2026-35616
- Ransomware gangs exploit patched Palo Alto VPN security flawDataBreachesExploitedCVE-2026-0257
- Qilin and INC ransomware gangs exploit Palo Alto VPN flaw to bypass MFAThe Hacker NewsExploitedCVE-2026-0257
- AI-Driven Ransomware Campaign Targeted 62 OrganisationsSOCRadarExploitedCVE-2026-35616
- Ransomware gangs bypass MFA through PAN OS VPN flaw CVE-2026-0257SecurityOnlineExploitedCVE-2026-0257
- INC Ransomware abuses CVE-2026-15409 in SonicWall, calls victimsSecurity AffairsExploitedCVE-2026-15409
- INC Ransomware exploits CVE-2026-15409, gains root on SonicWallSecurityWeekExploitedCVE-2026-15409
- SonicWall SMA Exploit Chain Now Fuels INC Ransomware AttacksSecurityOnlineExploitedCVE-2026-15409