Threat reportRansomwareTL-2026-4121
INC Ransomware: Evolution into a Top-Tier RaaS Operation (Rust Windows/ESXi payloads, edge-device exploitation CVE-2023-3519/CVE-2023-48788/CVE-2024-57727/CVE-2025-5777, modified Veeam credential dumper)
INC Ransomware (TL-2026-4121), also tracked as INC Ransom, is a high-severity ransomware operation, first published 2026-10-22. It is attributed to INC Ransom with medium confidence, affects Citrix NetScaler ADC / NetScaler Gateway, references 4 CVEs (CVE-2023-3519, CVE-2023-48788, CVE-2024-57727), maps to 20 MITRE ATT&CK techniques (T1018, T1021.001, T1021.002), and is covered by 9 detection rules and 30 indicators of compromise.
- Severity
- HIGHAssessed severity
- CVEs
- 4Referenced vulnerabilities
- Techniques
- 20MITRE ATT&CK
- Actors
- 1INC Ransom
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 30Indicators of compromise
Key facts for TL-2026-4121
- Threat ID
- TL-2026-4121
- Also known as
- INC Ransom, GOLD IONIC
- Severity
- HIGH
- Status
- ACTIVE
- Category
- RANSOMWARE
- First published
- Last reviewed
- Attribution
- INC Ransom
- Attribution confidence
- MEDIUM
- Motivation
- FINANCIAL
- Target sectors
- legal, manufacturing, technology, health, construction, education
- Target regions
- North America, australia, canada, germany, taiwan, united kingdom
- Detection rules
- 9
- Indicators of compromise
- 30
Malware and tooling in INC Ransomware
Malware and tooling: AnyDesk, Cobalt Strike, INC Ransomware - S1139, TeamViewer, inc ransom, PSEXEC, Rclone - S1040, ScreenConnect, SimpleHelp
How INC Ransomware works
Acronis TRU reports that INC ransomware, a RaaS that emerged in mid-2023, has claimed over 800 victims and ranks among the top five most active ransomware groups in 2026. Affiliates gain access through phishing, IAB-sold credentials and four edge/RMM CVEs, dump Veeam credentials with a modified PowerShell script, exfiltrate with rclone and encrypt with Rust-based Windows and Linux/ESXi payloads for double extortion.
INC ransomware (tracked by some vendors as GOLD IONIC) emerged in mid-2023 as a semi-private ransomware-as-a-service operation, initially focused on education and healthcare. According to Acronis TRU (published 2026-06-17), it has since claimed more than 800 victims (other coverage cites 830+), ranks among the top five most active ransomware groups in 2026 (4th in Q1 2026 with 120+ incidents per The Hacker News), and about 65.3% of victims are in the United States. Top targeted sectors are legal services, manufacturing, technology, healthcare and construction. Notable victims include NHS Scotland, Xerox and the Texas State Bar. The absence of CIS-region victims suggests CIS-based operators. After the LockBit disruption and BlackCat shutdown, affiliates migrated to INC, and Vice Society was observed deploying INC ransomware.
Initial access comes from spear phishing, valid credentials bought from Initial Access Brokers, and exploitation of public-facing systems: CVE-2023-3519 (Citrix NetScaler code injection / RCE), CVE-2023-48788 (Fortinet FortiClient EMS SQL injection), CVE-2024-57727 (SimpleHelp RMM path traversal) and CVE-2025-5777 (Citrix Bleed 2, NetScaler out-of-bounds read). Operators perform discovery with ping/net commands and scanners (Angry IP Scanner, Advanced IP Scanner, netscan.exe). For credential access they run a base64-encoded PowerShell script launched via cmd.exe, a modified derivative of the public Veeam-Get-Creds.ps1 (sadshade/veeam-creds). It uses hardcoded SQL parameters, queries the Veeam SQL Credentials table and decrypts stored passwords with standard DPAPI, falling back to salted DPAPI for newer Veeam versions.
Lateral movement uses RDP, PsExec and commercial RMM tools. Defenses are impaired with PsKill and a custom ProcessTerminator that installs vulnerable drivers (filwfp.sys, filnk.sys, fildds.sys) as a service (BYOVD-style). C2 and remote access rely on Cobalt Strike, AnyDesk, ScreenConnect and TeamViewer. Data is compressed with password-protected 7-Zip archives and exfiltrated with rclone to attacker-controlled cloud storage before encryption (double extortion).
Both the Windows and Linux/ESXi payloads have been rewritten in Rust. The Windows payload is a 64-bit PE packed with VMProtect 3.x. It uses multithreading (cores x 4), tiered partial encryption, exclusions (.msi, .exe, .dll, .inc; Windows, Program Files, appdata, $RECYCLE.BIN, programdata) and a Curve25519 plus AES-128-CTR/Salsa20 hybrid scheme. It appends the .INC extension and an INC footer, drops INC-README.txt notes, changes the wallpaper and prints notes on network printers. The ELF payload takes --daemon, --esxi, --motd, --delay, --dir, --file, --mode (fast/medium/slow) and --skip arguments. It enumerates and powers off VMs with vim-cmd (/vmsvc/getallvms, /vmsvc/power.off), writes the ransom note to /etc/motd, and encrypts with X25519 ECDH, SHA-256 derived keys and AES-128-CTR. The footer mode byte is 0x0C, 0x04 or 0x01 followed by INC.
In May 2024 a seller using the alias 'salfetka' (linked by researcher 3xp0rt to 'rinc' and 'farnetwork') listed the Windows and Linux/ESXi source code for $300,000, limited to three buyers, on Exploit and XSS. The Lynx ransomware then emerged with substantial code overlap (shared registry email on leak sites per reporting), and Sinobi later showed similar characteristics. Acronis assesses INC's success as coming from established techniques rather than advanced tradecraft. CVSS is not stated in the source, so the platform-level score is left null.
MITRE ATT&CK techniques used in TL-2026-4121
Discovery
Lateral Movement
T1021.001 Remote Services: Remote Desktop Protocol; T1021.002 Remote Services: SMB/Windows Admin Shares
Defense Evasion
T1027 Obfuscated Files or Information; T1140 Deobfuscate/Decode Files or Information
Execution
T1059.001 Command and Scripting Interpreter: PowerShell; T1569.002 System Services: Service Execution
Initial Access
T1078 Valid Accounts; T1190 Exploit Public-Facing Application; T1566.001 Phishing: Spearphishing Attachment
Command and Control
Impact
T1489 Service Stop; T1490 Inhibit System Recovery; T1491.001 Defacement: Internal Defacement; T1529 System Shutdown/Reboot
Persistence
T1543.003 Create or Modify System Process: Windows Service
Credential Access
T1555 Credentials from Password Stores
Collection
T1560.001 Archive Collected Data: Archive via Utility
Exfiltration
T1567.002 Exfiltration Over Web Service: Exfiltration to Cloud Storage
defense-impairment
Affected products and versions in INC Ransomware
- Citrix — NetScaler ADC / NetScaler Gateway
Vulnerable versions: Builds affected by CVE-2023-3519 and CVE-2025-5777
Fixed in: Vendor-fixed builds per Citrix advisories - Fortinet — FortiClient EMS
Vulnerable versions: Versions affected by CVE-2023-48788
Fixed in: Vendor-fixed versions per Fortinet advisory - SimpleHelp — SimpleHelp RMM
Vulnerable versions: 5.5.7 and earlier
Fixed in: Later versions per vendor advisory - Veeam — Veeam Backup & Replication (credential store targeted)
Vulnerable versions: Deployments using legacy and salted DPAPI credential encryption - VMware — ESXi
Vulnerable versions: Hosts with exposed shell/SSH and vim-cmd access
Remediation for INC Ransomware
Patches
- Apply Citrix fixes for CVE-2023-3519 and CVE-2025-5777
- Apply Fortinet FortiClient EMS fix for CVE-2023-48788
- Upgrade SimpleHelp beyond 5.5.7 for CVE-2024-57727
Immediate actions
- Patch or mitigate CVE-2023-3519, CVE-2025-5777 (Citrix NetScaler), CVE-2023-48788 (Fortinet FortiClient EMS) and CVE-2024-57727 (SimpleHelp) and review edge devices for prior compromise and hijacked sessions
- Hunt for INC-README.txt, .INC extension files and the filwfp.sys / filnk.sys / fildds.sys drivers
- Block listed IOCs; alert on rclone, PsExec, PsKill, AnyDesk, ScreenConnect and TeamViewer outside approved use
- Rotate credentials stored in Veeam and restrict access to Veeam SQL databases and servers
Workarounds
- Remove internet exposure of RMM and EMS management interfaces where patching is delayed
- Block known vulnerable driver hashes and enable the Microsoft vulnerable driver blocklist
Longer-term hardening
- Maintain 3-2-1 backups with offline/immutable copies and test restores
- Deploy EDR with behavioral ransomware detection and anti-tamper enabled
- Enforce MFA, segment networks, restrict outbound traffic and disable unneeded services
- Prioritize known-exploited vulnerabilities in patch management and run phishing awareness training
- Restrict ESXi shell/SSH access and monitor vim-cmd and /etc/motd changes
CVEs associated with INC Ransomware
CVE-2023-3519, CVE-2023-48788, CVE-2024-57727, CVE-2025-5777
Timeline of INC Ransomware
- INC ransomware emerges as a semi-private RaaS (mid-2023; vendors cite July-August 2023), initially targeting education and healthcare.
- INC Ransom announces migration to a new data leak site (new site lists 64 victims, legacy site 91 posts).
- Actor 'salfetka' lists INC Windows and Linux/ESXi source code for $300,000 (max three buyers) on Exploit and XSS; BleepingComputer reports it.
- Lynx ransomware, showing substantial code overlap with INC, is publicly analyzed (BlackBerry); Sinobi later shows similar characteristics.
- INC ranks 4th among RaaS groups in Q1 2026 with 120+ incidents (The Hacker News).
- Acronis TRU publishes analysis of INC's Rust Windows/ESXi payloads, modified Veeam credential dumper, exploited CVEs, YARA rules and IOCs; 800+ victims, top-five ranking.
Sources cited for INC Ransomware
- From emerging threat to top-tier ransomware-as-a-service: the evolution of INC ransomware (Acronis TRU)
- INC Ransomware Claims 830 Victims Since 2023 (The Hacker News)
- INC Ransomware: Rust-Based RaaS Exploiting Public-Facing Edge Devices (Hive Pro)
- INC Ransomware Expands to 800 Victims with Rust Encryptors and Veeam Credential Theft (Ampcus Cyber)
- INC ransomware source code selling on hacking forums for $300,000 (BleepingComputer)
- Cybercriminal puts INC Ransom source code up for sale (SC Media)
- Lynx ransomware (BlackBerry)
- Veeam-Get-Creds.ps1 (sadshade/veeam-creds) - base of the modified dumper
- SecPod: INC ransomware surpasses 830 victims
Detection coverage for TL-2026-4121
As of 2026-10-22, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-4121 across Splunk SPL, Microsoft KQL and Sigma, covering 30 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.
Community OSINT corroboration for TL-2026-4121
2 of this threat's indicators have also been reported by the open-source security community. Community sightings are unverified and are kept separate from Threadlinqs' curated indicators. Indicator values, reporters and campaign linkage are available to authenticated Red-tier users.