Inc Ransom doesn’t just encrypt data: it orchestrates its attacks as a service, using a systematic approach, professional tools, and an exfiltration strategy that circumvents traditional defenses.
In just a year and a half, this emerging group has already targeted more than 220 organizations. In this article, we provide an in-depth analysis of how they operate, their tactics for initial access, persistence, and impact, as well as the technical methods they use to evade detection and force victims’ hands.
A well-established model, from phishing to encryption
The Inc Ransom group operates using a classic—yet highly effective—cyberattack model, combining traditional attack vectors with a methodical approach supported by legitimate tools and advanced evasion tactics.
1. Initial Access: Spear-Phishing and RDP Access
The intrusion typically begins byexploiting compromised accounts purchased through Initial Access Brokers (IABs). This access may include VPN or RDP credentials, allowing direct connection to the target network. Inc Ransom also conducts targeted phishing campaigns—particularly during the early stages of compromise—to obtain credentials or inject malicious payloads.
2. Network reconnaissance and privilege escalation
Once inside the environment, attackers conduct network reconnaissance using tools such as Advanced IP Scanner, NetScan, or Nltest.exe to map domains and trust relationships. Native applications such as Notepad, WordPad, or Paint are hijacked to analyze files covertly.
Privilege escalation is performed using Mimikatz, which allows passwords to be extracted to obtain SYSTEM privileges. Particular emphasis is placed on targeting accounts associated with backup systems, such as Veeam Backup & Replication, in order to disable restore capabilities prior to encryption.
Method of Executing INC Ransomware
3. Lateral Movement and Network Control
Lateral movement relies on the use of LOLBINs such as PsExec to pivot between machines. AD accounts are manipulated to expand the attacker’s control over the network. At this stage, security mechanisms are bypassed using specialized tools, allowing antivirus-type solutions to be disabled without alerting system administrators.
4. Final Impact: Data Exfiltration and Encryption
Before the ransomware is finally deployed, Inc Ransom carries out a systematic data exfiltration:
-
Compression using 7-Zip
-
Transfer via MegaSync
-
Encryption using a modular AES algorithm: two modes are used—fast and medium—which selectively target files to make partial recovery more difficult.
Removing Volume Shadow Copies (VSS) prevents any local recovery, increasing the victim's reliance on negotiating with the attackers. An integrated chat feature is made available to the victim to discuss the ransom, thereby increasing the psychological pressure.
3 Types of Attacks Observed
1. Purchase of Compromised Credentials
One of Inc Ransom’s primary attack vectors involves acquiring valid accounts (such as VPN or RDP credentials) through Initial Access Brokers operating on the dark web. Using these credentials, attackers can gain direct access to the victim’s network without resorting to a traditional infiltration phase (such as phishing or exploiting vulnerabilities), which speeds up the deployment of the ransomware. This method allows attackers to bypass initial detection mechanisms, facilitates lateral movement, and enables rapid encryption of critical systems.
2. Targeted Extraction of Identifiers
The INC ransomware specifically targets credentials stored on Veeam Backup & Replication systems, which are essential to any post-attack recovery effort. The goal is clear: to disable backups to maximize the impact of the attack. The infection begins by extracting credentials stored on these systems, primarily using Mimikatz. This information allows attackers to access the backup infrastructure, move laterally, and then compromise other systems before deploying the ransomware. By preventing any restoration, INC causes widespread encryption, a shutdown of operations, and places the company in a position of total dependence on the demanded ransom.
3. Data exfiltration and encryption
Inc Ransom combines stealthy data exfiltration with custom encryption to maximize the impact of its attack. Data is compressed using 7-Zip and then exfiltrated with MegaSync. The ransomware then applies custom AES encryption using two modes: a “fast” mode that encrypts the first 1,000,000 bytes while ignoring large blocks, and a “medium” mode that uses the same threshold but ignores small blocks. This method allows for covert exfiltration using legitimate tools, while causing partial file corruption. Even when backups are available, the complexity of recovery forces victims to seriously consider paying the ransom.
How can you protect yourself against Inc Ransom and advanced ransomware?
Inc Ransom’s modus operandi exemplifies the rise of a structured, discreet, and destructive form of cybercrime. To combat this, organizations must strengthen their overall security posture: this involves advanced detection of early warning signs, continuous monitoring of privileges, isolation of sensitive environments, and active user awareness campaigns.
Thanks to our solutions such as IKare (vulnerability scanner), Reveelium (AI-powered SIEM, XDR, SOAR, and UEBA), and our phishing campaigns to test your employees’ response skills, and our other cybersecurity services, you’ll benefit from a comprehensive approach to protecting your business by anticipating, detecting, and containing the most advanced threats.
Our experts are available to help you assess your risks; so please contact us.
