# INC Ransom Affiliate Network Targeting Pacific Critical Infrastructure (AU/NZ/Tonga Joint Advisory)

> Joint advisory from Australia (ACSC), New Zealand (NCSC-NZ), and Tonga (CERT Tonga) warns of INC Ransom (GOLD IONIC / G1032) ransomware-as-a-service operations actively targeting critical infrastructure across the Pacific region. Affiliates use spear-phishing, exploitation of unpatched internet-facing devices (CVE-2023-3519 Citrix NetScaler, CVE-2023-48788 Fortinet EMS, CVE-2024-57727 SimpleHelp RMM), and purchased valid credentials from initial access brokers. Double-extortion with data leak site. Tonga Ministry of Health compromised June 2025 with $1M USD ransom demand. Roman Khubov (alias blackod) attributed by joint AU/NZ investigation.

- **Published:** 2026-03-09T12:00:00Z
- **Last reviewed:** 2026-03-09T12:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-0199
- **ID:** TL-2026-0199
- **Severity:** CRITICAL (CVSS 9.8)
- **Category:** RANSOMWARE
- **Status:** ACTIVE
- **Actor:** INC Ransom (Russia)
- **Detections:** 9 · **IOCs:** 24 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2023-3519, CVE-2023-48788, CVE-2024-57727, CVE-2023-4966

## Description

INC Ransom is a financially motivated ransomware-as-a-service (RaaS) operation active since July 2023, tracked as GOLD IONIC by Secureworks and G1032 by MITRE ATT&CK. The group operates a criminal franchise model where core developers build and maintain the ransomware platform and leak infrastructure, then lease access to affiliates who carry out attacks in exchange for a cut of ransom payments.

On March 6, 2026, Australia's ACSC, New Zealand's NCSC, and Tonga's CERT Tonga issued a joint advisory warning of INC Ransom affiliate operations actively targeting critical infrastructure across the Pacific region. This advisory marks the first tri-nation Pacific cybersecurity alert specifically addressing ransomware operations.

## Initial Access Vectors

INC Ransom affiliates employ multiple initial access methods:

1. **Exploitation of Public-Facing Applications**: Known exploitation of CVE-2023-3519 (Citrix NetScaler ADC/Gateway RCE, CVSS 9.8), CVE-2023-48788 (Fortinet EMS SQL injection), CVE-2024-57727 (SimpleHelp RMM path traversal), and CVE-2023-4966 (CitrixBleed session hijacking). A January 2025 campaign exploited FortiGate firewall management interfaces (FG-IR-24-535) exposed to the internet.

2. **Spear-Phishing**: Email-based social engineering campaigns with malicious attachments targeting organizational personnel.

3. **Purchased Credentials**: Valid account credentials acquired through Initial Access Brokers (IABs) on dark web forums, enabling direct access to VPN and RDP services.

## Attack Chain

Post-compromise, affiliates follow a consistent playbook:

- **Credential Harvesting**: Use of lsassy.py for LSASS credential dumping, esentutl for NTDS.dit extraction, HackTool.PS1.VeeamCreds for Veeam backup credential theft, and Kerberoasting against Active Directory service accounts.

- **Reconnaissance**: Domain enumeration via AdFind, net group commands, nltest for domain trust discovery, Advanced IP Scanner and NETSCAN.EXE for network mapping, and domain account/group discovery.

- **Lateral Movement**: Primarily via RDP with compromised domain admin credentials. PsExec renamed as winupd for remote service execution. WMIC used for multi-endpoint ransomware deployment.

- **Defense Evasion**: Disabling Windows Defender and security tools using HackTool.Win32.ProcTerminator.A. File deletion for anti-forensics. Masquerading PsExec as legitimate system files.

- **Data Exfiltration**: Archives created with 7-Zip (excluding media files to reduce size), exfiltrated via MegaSync or Rclone to cloud storage. In the Pennsylvania Office of Attorney General attack, over 5TB was exfiltrated.

- **Encryption**: INC Ransomware (S1139) deployed using AES-128 in CTR mode with Curve25519 Donna key exchange. Supports partial encryption with multi-threading for speed. Deletes volume shadow copies. Mounts hidden drives. Terminates blocking processes via Win32 Restart Manager. Ransom notes (INC-README.TXT and INC-README.HTML) printed to all connected printers and fax machines.

## Pacific Campaign (2025-2026)

Since January 2025, the ACSC has observed INC Ransom affiliates specifically targeting Australian healthcare sector entities using compromised accounts. The most significant Pacific attack occurred on June 15, 2025, when Tonga's Ministry of Health National Health Information System was fully encrypted, forcing medical staff to pen-and-paper record keeping. The group demanded $1 million USD, which the Tongan government refused to pay. Four sample documents were published on the leak site including communicable disease reports and patient records.

A joint Australian-New Zealand investigation attributed the Tonga attack to Roman Khubov (alias blackod), who controlled the malicious infrastructure used for data exfiltration. Microsoft Threat Intelligence tracks affiliate group Vanilla Tempest as adopting INC Ransomware as their primary payload since August 2024.

## Code Evolution

INC Ransomware source code was sold on underground forums in March 2024 for approximately $300,000. This led to the emergence of Lynx ransomware, which shares over 70% code similarity (48% matched functions) with INC, demonstrating payload rebranding. As of mid-2025, over 200 victims appeared on INC's data leak site, with the group ranking as the most deployed ransomware by victim postings in July 2025.

---

**Revalidated on 2026-03-12**

POST-PUBLICATION DEVELOPMENTS (as of 2026-03-12): (1) LEGAL SECTOR EXPANSION: Since the Pacific advisory, INC Ransom has rapidly pivoted to target the legal sector, claiming 20 law firms in 2026 with a concentrated burst of 10 firms posted to their leak site within 48 hours (Halcyon, March 2026). The clustering suggests a possible supply chain compromise of a shared legal technology provider or managed services vendor. (2) NZ HEALTH VICTIM CONFIRMED: Dark Reading confirmed a previously unreported New Zealand health-sector organization was attacked in May 2025 — servers and endpoints encrypted, significant data exfiltrated, and the dataset later published on INC's leak site. This predates the Tonga MoH attack by approximately one month and strengthens the pattern of systematic Pacific healthcare targeting. (3) ACSC INCIDENT COUNT: The ACSC disclosed responding to 11 INC ransomware incidents in Australia between July 2024 and December 2025, predominantly healthcare and professional services. (4) KHUBOV STATUS: No formal U.S. or international sanctions, indictments, or extradition actions against Roman Khubov (blackod) have been publicly announced as of this date, despite the joint AU/NZ attribution. (5) LYNX DERIVATIVE ACTIVITY: The INC-derived Lynx ransomware continues to operate independently with 91% Linux code similarity and 70.8% Windows matched functions, representing an ongoing parallel threat vector from the March 2024 source code sale. (6) RANKING: INC Ransom is listed among the top 10 most infamous ransomware groups to watch in 2026 (NordStellar), confirming sustained operational tempo.

## MITRE ATT&CK

- T1190 Exploit Public-Facing Application
- T1566 Phishing
- T1078 Valid Accounts
- T1588 Obtain Capabilities
- T1059 Command and Scripting Interpreter
- T1047 Windows Management Instrumentation
- T1569 System Services
- T1685 Disable or Modify Tools
- T1070 Indicator Removal
- T1036 Masquerading
- T1140 Deobfuscate/Decode Files or Information
- T1003 OS Credential Dumping
- T1558 Steal or Forge Kerberos Tickets
- T1046 Network Service Discovery
- T1087 Account Discovery
- T1135 Network Share Discovery
- T1069 Permission Groups Discovery
- T1049 System Network Connections Discovery
- T1083 File and Directory Discovery
- T1120 Peripheral Device Discovery
- T1074 Data Staged
- T1021 Remote Services
- T1570 Lateral Tool Transfer
- T1071 Application Layer Protocol
- T1219 Remote Access Tools
- T1105 Ingress Tool Transfer
- T1537 Transfer Data to Cloud Account
- T1560 Archive Collected Data
- T1486 Data Encrypted for Impact
- T1657 Financial Theft
- T1490 Inhibit System Recovery
- T1489 Service Stop
- T1491 Defacement

## Sources

- [ACSC Advisory: INC Ransom Affiliate Model Enabling Targeting of Critical Networks](https://www.cyber.gov.au/about-us/view-all-content/alerts-and-advisories/inc-ransom-affiliate-model-enabling-targeting-of-critical-networks)
- [NZ NCSC Alert: INC Ransom Affiliate Model](https://www.ncsc.govt.nz/alerts/inc-ransom-affiliate-model-enabling-targeting-of-critical-networks/)
- [MITRE ATT&CK Group G1032 - INC Ransom](https://attack.mitre.org/groups/G1032/)
- [MITRE ATT&CK Software S1139 - INC Ransomware](https://attack.mitre.org/software/S1139/)
- [Cyble: Australia, NZ, Tonga Warn of Rising INC Ransom Attacks](https://cyble.com/blog/inc-ransom-attacks-australia-new-zealand/)
- [Huntress: Investigating New INC Ransom Group Activity](https://www.huntress.com/blog/investigating-new-inc-ransom-group-activity)
- [Unit 42: INC Ransomware Rebrand to Lynx](https://unit42.paloaltonetworks.com/inc-ransomware-rebrand-to-lynx/)
- [HvS Consulting: INC Ransom FortiGate Exploit Analysis](https://www.hvs-consulting.de/en/blog/inc-ransom-ransomware)
- [SentinelOne: INC Ransomware Analysis, Detection, and Mitigation](https://www.sentinelone.com/anthology/inc-ransom/)
- [Trend Micro: Ransomware Spotlight INC](https://www.trendmicro.com/vinfo/us/security/news/ransomware-spotlight/ransomware-spotlight-inc)
- [The Cyber Express: INC Ransom Franchise Model Targeting Critical Infrastructure](https://thecyberexpress.com/inc-ransom-franchise-model/)
- [Matangi Tonga: Ransomware Attack Takes Down National Health Information System](https://matangitonga.to/2025/06/20/ransomware-attack-takes-down-Tonga-national-health-information-system)
- [Matangi Tonga: Tonga Govt Refuses to Pay $1M Ransom](https://matangitonga.to/2025/06/26/tonga-govt-refuses-pay-usd1million-ransom-health-hackers)
- [Kaniva Tonga: Joint AU-NZ Probe Identifies Roman Khubov](https://kanivatonga.co.nz/2026/03/joint-australia-nz-probe-identifies-roman-khubov-in-tonga-health-ransomware-attack/)
- [CISA Advisory: Threat Actors Exploiting Citrix CVE-2023-3519](https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-201a)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-0199