Threadlinqs IntelligenceStart free

Threat actorTracked since 2026-06

INC Ransom - G1032

As of 2026-09-15, INC Ransom - G1032 is a threat actor tracked by Threadlinqs Intelligence across 5 threats spanning ransomware, campaign, threat intel. ATT&CK coverage spans 91 techniques across 15 tactics in 5 of 5 tracked threats. Most-observed techniques: T1133 (External Remote Services), T1190 (Exploit Public-Facing Application), T1078 (Valid Accounts).

Tracked threats
52 critical · 3 high
First seen
2026-06-21
Last seen
2026-09-15
ATT&CK techniques
91across 5 of 5 threats
Related CVEs
26Referenced by its activity
5 tracked threat(s) · Categories: RANSOMWARE, CAMPAIGN, THREAT_INTEL

Activity timeline

INC Ransom - G1032 appears in 5 tracked threats between and ; the busiest month was 2026-07 with 2 reports.

ATT&CK techniques observed

91 techniques observed across 5 of 5 tracked threats · Credential Access (12), Command and Control (11), Resource Development (10), Discovery (7), Reconnaissance (7), Collection (6)
  • T1133 External Remote Services — Initial Accessobserved in 5 of 5 tracked threats
  • T1190 Exploit Public-Facing Application — Initial Accessobserved in 5 of 5 tracked threats
  • T1078 Valid Accounts — Initial Accessobserved in 4 of 5 tracked threats
  • T1595 Active Scanning — Reconnaissanceobserved in 4 of 5 tracked threats
  • T1018 Remote System Discovery — Discoveryobserved in 3 of 5 tracked threats
  • T1021 Remote Services — Lateral Movementobserved in 3 of 5 tracked threats
  • T1040 Network Sniffing — Credential Accessobserved in 3 of 5 tracked threats
  • T1041 Exfiltration Over C2 Channel — Exfiltrationobserved in 3 of 5 tracked threats
  • T1087 Account Discovery — Discoveryobserved in 3 of 5 tracked threats
  • T1090 Proxy — Command and Controlobserved in 3 of 5 tracked threats
  • T1098 Account Manipulation — Persistenceobserved in 3 of 5 tracked threats
  • T1110 Brute Force — Credential Accessobserved in 3 of 5 tracked threats
  • T1136 Create Account — Persistenceobserved in 3 of 5 tracked threats
  • T1490 Inhibit System Recovery — Impactobserved in 3 of 5 tracked threats
  • T1552 Unsecured Credentials — Credential Accessobserved in 3 of 5 tracked threats

Tracked threats

Related CVEs

26 CVEs referenced by tracked INC Ransom - G1032 activity