Threadlinqs IntelligenceStart free

Threat actorRussiaTracked since 2026-03

INC Ransom

Also known as:INC Ransom - G1032The GentlemenThe Gentlemen affiliatesLynxINC RansomwareGOLD IONICG1032INC Ransom Group

As of 2026-11-14, INC Ransom is a Russia-nexus threat actor tracked by Threadlinqs Intelligence across 10 threats spanning ransomware, campaign, threat intel. Also known as INC Ransom - G1032, The Gentlemen, The Gentlemen affiliates, Lynx. ATT&CK coverage spans 130 techniques across 15 tactics in 10 of 10 tracked threats. Most-observed techniques: T1190 (Exploit Public-Facing Application), T1078 (Valid Accounts), T1219 (Remote Access Tools).

Tracked threats
105 critical · 4 high · 1 medium
First seen
2026-03-09
Last seen
2026-11-14
ATT&CK techniques
130across 10 of 10 threats
Related CVEs
35Referenced by its activity
Attribution
RussiaNation or origin
Nation: Russia · 10 tracked threat(s) · Categories: RANSOMWARE, CAMPAIGN, THREAT_INTEL

Activity timeline

INC Ransom appears in 10 tracked threats between and ; the busiest month was 2026-07 with 2 reports.

ATT&CK techniques observed

130 techniques observed across 10 of 10 tracked threats · Credential Access (18), Command and Control (12), Resource Development (12), Discovery (11), Impact (10), Reconnaissance (9)
  • T1190 Exploit Public-Facing Application — Initial Accessobserved in 10 of 10 tracked threats
  • T1078 Valid Accounts — Initial Accessobserved in 8 of 10 tracked threats
  • T1219 Remote Access Tools — Command and Controlobserved in 7 of 10 tracked threats
  • T1490 Inhibit System Recovery — Impactobserved in 7 of 10 tracked threats
  • T1133 External Remote Services — Initial Accessobserved in 6 of 10 tracked threats
  • T1685 Disable or Modify Tools — Defense Impairmentobserved in 6 of 10 tracked threats
  • T1021.001 Remote Desktop Protocol — Lateral Movementobserved in 5 of 10 tracked threats
  • T1021.002 SMB/Windows Admin Shares — Lateral Movementobserved in 5 of 10 tracked threats
  • T1046 Network Service Discovery — Discoveryobserved in 5 of 10 tracked threats
  • T1486 Data Encrypted for Impact — Impactobserved in 5 of 10 tracked threats
  • T1489 Service Stop — Impactobserved in 5 of 10 tracked threats
  • T1567.002 Exfiltration to Cloud Storage — Exfiltrationobserved in 5 of 10 tracked threats
  • T1003 OS Credential Dumping — Credential Accessobserved in 4 of 10 tracked threats
  • T1018 Remote System Discovery — Discoveryobserved in 4 of 10 tracked threats
  • T1021 Remote Services — Lateral Movementobserved in 4 of 10 tracked threats

Tracked threats

Related CVEs

35 CVEs referenced by tracked INC Ransom activity