# INC Ransomware: Evolution into a Top-Tier RaaS Operation (Rust Windows/ESXi payloads, edge-device exploitation CVE-2023-3519/CVE-2023-48788/CVE-2024-57727/CVE-2025-5777, modified Veeam credential dumper)

> Acronis TRU reports that INC ransomware, a RaaS that emerged in mid-2023, has claimed over 800 victims and ranks among the top five most active ransomware groups in 2026. Affiliates gain access through phishing, IAB-sold credentials and four edge/RMM CVEs, dump Veeam credentials with a modified PowerShell script, exfiltrate with rclone and encrypt with Rust-based Windows and Linux/ESXi payloads for double extortion.

- **Published:** 2026-10-22T07:27:53Z
- **Last reviewed:** 2026-10-22T07:27:53Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-4121
- **ID:** TL-2026-4121
- **Severity:** HIGH
- **Category:** RANSOMWARE
- **Status:** ACTIVE
- **Actor:** INC Ransom
- **Detections:** 9 · **IOCs:** 30 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2023-3519, CVE-2023-48788, CVE-2024-57727, CVE-2025-5777

## Description

INC ransomware (tracked by some vendors as GOLD IONIC) emerged in mid-2023 as a semi-private ransomware-as-a-service operation, initially focused on education and healthcare. According to Acronis TRU (published 2026-06-17), it has since claimed more than 800 victims (other coverage cites 830+), ranks among the top five most active ransomware groups in 2026 (4th in Q1 2026 with 120+ incidents per The Hacker News), and about 65.3% of victims are in the United States. Top targeted sectors are legal services, manufacturing, technology, healthcare and construction. Notable victims include NHS Scotland, Xerox and the Texas State Bar. The absence of CIS-region victims suggests CIS-based operators. After the LockBit disruption and BlackCat shutdown, affiliates migrated to INC, and Vice Society was observed deploying INC ransomware.

Initial access comes from spear phishing, valid credentials bought from Initial Access Brokers, and exploitation of public-facing systems: CVE-2023-3519 (Citrix NetScaler code injection / RCE), CVE-2023-48788 (Fortinet FortiClient EMS SQL injection), CVE-2024-57727 (SimpleHelp RMM path traversal) and CVE-2025-5777 (Citrix Bleed 2, NetScaler out-of-bounds read). Operators perform discovery with ping/net commands and scanners (Angry IP Scanner, Advanced IP Scanner, netscan.exe). For credential access they run a base64-encoded PowerShell script launched via cmd.exe, a modified derivative of the public Veeam-Get-Creds.ps1 (sadshade/veeam-creds). It uses hardcoded SQL parameters, queries the Veeam SQL Credentials table and decrypts stored passwords with standard DPAPI, falling back to salted DPAPI for newer Veeam versions.

Lateral movement uses RDP, PsExec and commercial RMM tools. Defenses are impaired with PsKill and a custom ProcessTerminator that installs vulnerable drivers (filwfp.sys, filnk.sys, fildds.sys) as a service (BYOVD-style). C2 and remote access rely on Cobalt Strike, AnyDesk, ScreenConnect and TeamViewer. Data is compressed with password-protected 7-Zip archives and exfiltrated with rclone to attacker-controlled cloud storage before encryption (double extortion).

Both the Windows and Linux/ESXi payloads have been rewritten in Rust. The Windows payload is a 64-bit PE packed with VMProtect 3.x. It uses multithreading (cores x 4), tiered partial encryption, exclusions (.msi, .exe, .dll, .inc; Windows, Program Files, appdata, $RECYCLE.BIN, programdata) and a Curve25519 plus AES-128-CTR/Salsa20 hybrid scheme. It appends the .INC extension and an INC footer, drops INC-README.txt notes, changes the wallpaper and prints notes on network printers. The ELF payload takes --daemon, --esxi, --motd, --delay, --dir, --file, --mode (fast/medium/slow) and --skip arguments. It enumerates and powers off VMs with vim-cmd (/vmsvc/getallvms, /vmsvc/power.off), writes the ransom note to /etc/motd, and encrypts with X25519 ECDH, SHA-256 derived keys and AES-128-CTR. The footer mode byte is 0x0C, 0x04 or 0x01 followed by INC.

In May 2024 a seller using the alias 'salfetka' (linked by researcher 3xp0rt to 'rinc' and 'farnetwork') listed the Windows and Linux/ESXi source code for $300,000, limited to three buyers, on Exploit and XSS. The Lynx ransomware then emerged with substantial code overlap (shared registry email on leak sites per reporting), and Sinobi later showed similar characteristics. Acronis assesses INC's success as coming from established techniques rather than advanced tradecraft. CVSS is not stated in the source, so the platform-level score is left null.

## MITRE ATT&CK

- T1190 Exploit Public-Facing Application
- T1566.001 Phishing: Spearphishing Attachment
- T1078 Valid Accounts
- T1059.001 Command and Scripting Interpreter: PowerShell
- T1569.002 System Services: Service Execution
- T1543.003 Create or Modify System Process: Windows Service
- T1685 Disable or Modify Tools
- T1027 Obfuscated Files or Information
- T1140 Deobfuscate/Decode Files or Information
- T1555 Credentials from Password Stores
- T1018 Remote System Discovery
- T1021.001 Remote Services: Remote Desktop Protocol
- T1021.002 Remote Services: SMB/Windows Admin Shares
- T1560.001 Archive Collected Data: Archive via Utility
- T1219 Remote Access Tools
- T1567.002 Exfiltration Over Web Service: Exfiltration to Cloud Storage
- T1490 Inhibit System Recovery
- T1489 Service Stop
- T1529 System Shutdown/Reboot
- T1491.001 Defacement: Internal Defacement

## Sources

- [From emerging threat to top-tier ransomware-as-a-service: the evolution of INC ransomware (Acronis TRU)](https://www.acronis.com/en/tru/posts/from-emerging-threat-to-top-tier-ransomware-as-a-service-the-evolution-of-inc-ransomware/)
- [INC Ransomware Claims 830 Victims Since 2023 (The Hacker News)](https://thehackernews.com/2026/06/inc-ransomware-claims-830-victims-since.html)
- [INC Ransomware: Rust-Based RaaS Exploiting Public-Facing Edge Devices (Hive Pro)](https://www.hivepro.com/threat-advisory/inc-ransomware-rust-based-raas-exploiting-public-facing-edge-devices)
- [INC Ransomware Expands to 800 Victims with Rust Encryptors and Veeam Credential Theft (Ampcus Cyber)](https://www.ampcuscyber.com/shadowopsintel/ransomware-expands-to-victims-with-rust-encryptors-veeam-credential-theft/)
- [INC ransomware source code selling on hacking forums for $300,000 (BleepingComputer)](https://www.bleepingcomputer.com/news/security/inc-ransomware-source-code-selling-on-hacking-forums-for-300-000/)
- [Cybercriminal puts INC Ransom source code up for sale (SC Media)](https://scworld.com/brief/cybercriminal-puts-inc-ransom-source-code-up-for-sale)
- [Lynx ransomware (BlackBerry)](https://blogs.blackberry.com/en/2024/10/lynx-ransomware)
- [Veeam-Get-Creds.ps1 (sadshade/veeam-creds) - base of the modified dumper](https://github.com/sadshade/veeam-creds)
- [SecPod: INC ransomware surpasses 830 victims](https://secpod.com/learn/security-research/from-emergence-to-dominance-inc-ransomware-surpasses-830-victims-and-strengthens-its-raa-s-operations)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-4121