Incransom ransomware group claims Aidon Oy (Gridspertise / Enel Group) smart meter platform breach

Key facts

Detection coverage

As of 2026-11-12, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-5850 across Splunk SPL, Microsoft KQL and Sigma, covering 27 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: INC Ransom winupd Service / Renamed PsExec Remote Execution (Execution Phase)

Detects the winupd service name that MITRE G1032 documents for the INC Ransom encryptor and for a PsExec binary masqueraded as a Windows update, plus PsExec executed under a non-stock filename. Covers service execution (T1569.002), masquerading (T1036.005) and lateral tool transfer (T1570) used by INC affiliates in the Incransom claim against Aidon Oy (TL-2026-5850). Group-level TTP, not confirmed as used against Aidon.

• Languages: Splunk SPL, Microsoft KQL, Sigma
• ATT&CK: T1569.002, T1036.005, T1570
• Data sources: sysmon (index=sysmon, XmlWinEventLog:Microsoft-Windows-Sysmon/Operational EventCode 1), windows_system (index=wineventlog, WinEventLog:System EventCode 7045), DeviceProcessEvents, DeviceEvents
• Severity: high
• Confidence: high

Splunk SPL

(index=wineventlog sourcetype="WinEventLog:System" EventCode=7045 (Service_Name="winupd" OR Service_File_Name="*winupd*")) OR (index=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1 (Image="*\\winupd.exe" OR ((OriginalFileName="psexec.c" OR Description="Execute processes remotely") NOT (Image="*\\psexec.exe" OR Image="*\\psexec64.exe")))) earliest=-24h
```Branch 1: Service Control Manager 7045 for the winupd service name used to run the INC encryptor. Branch 2: winupd.exe, or PsExec renamed away from its stock filename (MITRE G1032 documents a PsExec binary masqueraded as winupd).```
| eval detection_reason=case(EventCode=7045, "Service winupd installed (INC encryptor service name)", match(Image, "(?i)winupd[.]exe$"), "Process named winupd.exe executed (masqueraded PsExec)", true(), "PsExec renamed away from stock filename")
| stats count AS events min(_time) AS first_seen max(_time) AS last_seen values(detection_reason) AS reason values(Service_File_Name) AS service_file values(Image) AS image values(CommandLine) AS command_line values(ParentImage) AS parent_image BY host
| eval first_seen=strftime(first_seen, "%Y-%m-%dT%H:%M:%SZ"), last_seen=strftime(last_seen, "%Y-%m-%dT%H:%M:%SZ")

Microsoft KQL

// INC Ransom winupd service / renamed PsExec (TL-2026-5850) - T1569.002, T1036.005, T1570
let lookback = 24h;
let proc = DeviceProcessEvents
| where Timestamp > ago(lookback)
| where FileName =~ "winupd.exe" or (ProcessVersionInfoOriginalFileName =~ "psexec.c" and FileName !in~ ("psexec.exe", "psexec64.exe"))
| project Timestamp, DeviceName, AccountName, FileName, ProcessCommandLine, InitiatingProcessFileName, Reason = "winupd binary or renamed PsExec executed";
let svc = DeviceEvents
| where Timestamp > ago(lookback)
| where ActionType == "ServiceInstalled" and AdditionalFields has "winupd"
| project Timestamp, DeviceName, AccountName = InitiatingProcessAccountName, FileName = InitiatingProcessFileName, ProcessCommandLine = InitiatingProcessCommandLine, InitiatingProcessFileName, Reason = "Service winupd installed";
union proc, svc
| order by Timestamp desc

Sigma

title: INC Ransom winupd Binary or Renamed PsExec Execution
id: 3b6f0f7e-5c1d-4a8e-9f21-7d4c2a9e1b10
status: experimental
description: Detects execution of a binary named winupd.exe, or PsExec renamed away from its stock filename (OriginalFileName psexec.c), as documented for INC Ransom affiliates that run the encryptor as the winupd service and masquerade PsExec as a Windows update.
references:
  - https://attack.mitre.org/groups/G1032/
  - https://www.acronis.com/en/tru/posts/from-emerging-threat-to-top-tier-ransomware-as-a-service-the-evolution-of-inc-ransomware.md
  - https://intel.threadlinqs.com
author: Threadlinqs Team
date: 2026/11/12
tags:
  - attack.execution
  - attack.t1569.002
  - attack.defense-evasion
  - attack.t1036.005
  - attack.lateral-movement
  - attack.t1570
  - attack.s0029
  - attack.s1139
logsource:
  category: process_creation
  product: windows
detection:
  selection_winupd:
    Image|endswith: '\winupd.exe'
  selection_psexec_renamed:
    OriginalFileName: 'psexec.c'
  filter_stock_name:
    Image|endswith:
      - '\psexec.exe'
      - '\psexec64.exe'
  condition: selection_winupd or (selection_psexec_renamed and not filter_stock_name)
falsepositives:
  - Legitimate software coincidentally named winupd.exe
  - Administrators who rename PsExec in internal deployment tooling
level: high

Known false positives:

• Administrators using a renamed PsExec copy in approved deployment tooling
• Third-party software or updaters that legitimately install a service or binary called winupd

Tuning notes: Allow-list approved deployment hosts and service accounts that run PsExec under a custom name. Confirm winupd is not a legitimate update service in your estate before enabling alerting. Scope to servers first, especially SQL Server and backup hosts, and pivot on the affected host for INC-README files and rclone/7-Zip activity.

• 🔒 INC Ransom Remote Access Tools (AnyDesk, ScreenConnect) and Toolset Ingress · unlock with TL Creds
• 🔒 INC Ransom Defence Impairment (Vulnerable Drivers, Defender Tampering, Toolset Deletion) · unlock with TL Creds
• 🔒 INC Ransom Encryptor Impact (INC-README Notes, [indicator] Rename, Known Sample Hashes) · unlock with TL Creds
• 🔒 INC Ransom Edge Appliance Exploitation (CVE-2023-3519, CVE-2024-57727) with Valid-Account Follow-on · unlock with TL Creds
• 🔒 INC Ransom Lateral Movement (Remote WMI, RDP Enablement, mstsc) · unlock with TL Creds
• 🔒 INC Ransom Network Indicators (Leak Infrastructure, MEGA Exfiltration, Community Sibling IPs) · unlock with TL Creds
• 🔒 INC Ransom Network and AD Discovery Tooling (Advanced IP Scanner, NETSCAN, AdFind, Nltest) · unlock with TL Creds
• 🔒 INC Ransom Data Staging and Cloud Exfiltration (7-Zip/WinRAR, rclone, MEGAsync) · unlock with TL Creds

Indicators of compromise

As of 2026-11-12, Threadlinqs Intelligence tracks 27 indicators of compromise for TL-2026-5850.

Sample indicators (3 of 27)

• Domain: incblog[.]su
• File hash: 31800380c359143ae82c4f9011eee653dd22443d03d6a499148203bbfc275502
• Domain: incblog6qu4y4mm4zvw5nrmue6qbwtgjsxpw6b7ixzssu36tsajldoad[.]onion

Defanged, TLP:CLEAR. Full set of 27 indicators: unlock with TL Creds.

Community OSINT corroboration

2 of this threat's indicators have also been reported by the open-source security community. Community sightings are unverified and are kept separate from Threadlinqs' curated indicators. Indicator values, reporters and campaign linkage are available to authenticated Red-tier users.

Technical analysis

All claims are group-asserted and unverified; Aidon, Gridspertise and Finnish authorities have not confirmed them.

Ransomware.live lists aidon.com (Aidon Oy, Finland) as an Incransom victim, discovered 2026-11-12 10:19 UTC. Aidon Oy provides smart-metering and metering-as-a-service to Nordic distribution system operators, and has been part of Gridspertise (Enel Group / CVC Capital Partners joint venture) since the acquisition completed in November 2023. The group's claim describes the Smart Meter Operations (SMO) head-end platform serving Finnish DSOs.

Claimed data (all unverified, per the leak-site entry as mirrored by ransomware.live): 9,899 files totalling 8.41 TB from 8 SQL Server instances and 25+ databases (about 2.4 TB on disk); 520,796 AES-128 keys (unicast, authentication, multicast) for smart meters; about 1.5 million Finnish customers (names, addresses, 91,430+ GPS coordinates, consumption profiles); 74 user accounts with password hashes and TOTP secrets; 23 API keys; 108,000+ SIM/IMSI records; 368 full backups, 9,079 transaction logs and 218 live database files. The group names 10+ affected energy utilities (including Porvoon Energia, Keravan Energia, Helen Oy and Etelä-Savon Energia) and asserts exposure above EUR 20 million.

Claimed timeline: initial access 2026-04-19, exfiltration 2026-04-19 to 2026-05-01, contact attempts in July 2026 (sent to the wrong entity), 2026-08-15 (attribution corrected) and about 2026-08-20 (CEO and CFO contacted directly), with no response from Aidon as of September 2026. The group states data will not be published while a resolution remains possible. No ransom amount, deadline or negotiation transcript is shown. Ransomware.live's estimated attack date (2026-09-03) conflicts with the claimed April access date, and Breachsense records the listing as discovered 2026-09-17. The initial access vector for this incident is not stated by any source. Infostealer/exposure telemetry on the page (HudsonRock: 1 compromised employee, 6 third-party employee credentials; ParanoidLab: 36 exposed passwords and 1 cookie) is context only and not shown to be linked to the intrusion.

INC Ransom is a ransomware-as-a-service operation (MITRE G1032, S1139; also tracked as GOLD IONIC) first seen in mid-2023. Public reporting (MITRE ATT&CK, ACSC/NCSC-NZ, Acronis TRU, Cyble, CERT Orange Polska) documents affiliate tradecraft: initial access via spear phishing, valid credentials from initial access brokers and exploitation of public-facing applications (CVE-2023-3519 Citrix NetScaler, CVE-2023-48788 Fortinet EMS, CVE-2024-57727 SimpleHelp, CVE-2025-5777 Citrix Bleed 2); discovery with Advanced IP Scanner, NETSCAN.EXE, AdFind and Nltest; lateral movement via RDP and PsExec (including a PsExec binary renamed winupd); remote tools such as AnyDesk, ScreenConnect and Cobalt Strike; staging with 7-Zip/WinRAR; exfiltration with rclone and MegaSync; and a Windows/Linux/ESXi encryptor dropping INC-README.txt/.html and appending .INC. These are group-level TTPs and are NOT evidenced as the specific methods used against Aidon; the MITRE mappings below reflect the group's documented playbook limited to techniques cited by those sources.

Defender relevance: if the claim is accurate, exposed smart-meter keys and head-end credentials create downstream risk for DSOs and consumers (key rotation, credential and API-key rotation, GDPR notification). Utilities and integrators connected to Aidon-hosted platforms should review access, rotate secrets and hunt for the INC TTPs listed here.

MITRE ATT&CK techniques by tactic:

Lateral Movement

T1021.001 Remote Services: Remote Desktop Protocol; T1570 Lateral Tool Transfer

Defense Evasion

T1036.005 Masquerading: Match Legitimate Resource Name or Location; T1070.004 Indicator Removal: File Deletion

Discovery

T1046 Network Service Discovery; T1087.002 Account Discovery: Domain Account

Execution

T1047 Windows Management Instrumentation; T1569.002 System Services: Service Execution

Initial Access

T1078 Valid Accounts; T1190 Exploit Public-Facing Application; T1566 Phishing

Command and Control

T1219 Remote Access Tools

Collection

T1560.001 Archive Collected Data: Archive via Utility

Exfiltration

T1567.002 Exfiltration Over Web Service: Exfiltration to Cloud Storage

Impact

T1657 Financial Theft

defense-impairment

T1685 Disable or Modify Tools

Remediation

Patches

• Citrix NetScaler CVE-2023-3519 and CVE-2025-5777 vendor fixes
• Fortinet EMS CVE-2023-48788 vendor fix
• SimpleHelp CVE-2024-57727 vendor fix

Immediate actions

• Aidon/Gridspertise customers (DSOs): request written confirmation of incident scope and treat smart-meter AES-128 keys, API keys and SMO user credentials as potentially compromised until confirmed otherwise
• Rotate credentials, API keys and TOTP secrets for any accounts on Aidon-hosted or Aidon-integrated platforms
• Hunt for INC TTPs: PsExec renamed winupd, Advanced IP Scanner/NETSCAN.EXE, AnyDesk/ScreenConnect, rclone/MegaSync egress, 7-Zip archiving on SQL Server hosts
• Block and alert on rclone and Mega cloud-storage egress from database and server segments

Workarounds

• Restrict inbound remote-access tooling to allow-listed RMM products and block unapproved AnyDesk/ScreenConnect/TeamViewer
• Disable or restrict RDP between server segments and require jump hosts

Longer-term hardening

• Plan smart-meter key rotation procedures and key-management segregation from operational SQL databases
• Enforce phishing-resistant MFA on VPN, remote-access and edge appliances; patch edge devices (Citrix NetScaler, Fortinet EMS) promptly
• Segment SQL Server and backup infrastructure; protect backup credentials (e.g. Veeam) and restrict admin shares/RDP
• Deploy EDR with tamper protection and monitoring for vulnerable-driver loading and Defender tampering
• Monitor infostealer and credential-exposure feeds for employee and third-party accounts

Affected and fixed versions

• Aidon Oy (Gridspertise / Enel Group) — Smart Meter Operations (SMO) head-end system and associated SQL Server databases (claimed)

Timeline

• 2023-11-09 Gridspertise (Enel Group / CVC Capital Partners) completes its acquisition of Aidon Oy, which continues as an independent unit.
• 2026-04-19 Incransom claims initial access to Aidon's environment and the start of data exfiltration (group claim, unverified).
• 2026-05-01 Claimed end of the exfiltration window (2026-04-19 to 2026-05-01) covering 8.41 TB from eight SQL Server instances (unverified).
• 2026-06-17 Acronis TRU publishes an analysis of INC ransomware TTPs, tools and sample hashes (page later updated 2026-10-27).
• 2026-08-15 Incransom claims it corrected the victim attribution and re-sent its contact to Aidon after an earlier July message reached the wrong entity.
• 2026-08-20 Incransom claims it contacted Aidon's CEO and CFO directly around this date; no response as of September 2026 per the group.
• 2026-09-03 Ransomware.live metadata lists 2026-09-03 as the estimated attack date, which conflicts with the claimed April access date.
• 2026-09-17 Breachsense records the Incransom claim against Aidon Oy as discovered; leak size listed as unknown.
• 2026-11-12 Ransomware.live lists aidon.com as an Incransom victim with detailed claims (8.41 TB, 520,796 AES-128 keys, about 1.5M PII records, 74 user accounts); data not yet published.

Sources cited

• ACSC / NCSC-NZ: INC Ransom affiliate model enabling targeting of critical networks cyber.gov.au · Advisory
• US Coast Guard Maritime Cyber Alert 01-26 uscg.mil · Advisory
• ransomware.live victim entry: aidon.com (Incransom) ransomware.live · Research · 2026-11-12
• ransomware.live: Incransom group profile ransomware.live · Research · 2026-11-12
• MITRE ATT&CK: INC Ransom (G1032) MITRE · Research
• Acronis TRU: From emerging threat to top-tier RaaS - the evolution of INC ransomware acronis.com · Vendor report · 2026-06-17
• CERT Orange Polska: INCransom threat actor profile cert.orange.pl · Research · 2026-07-01
• Cyble: INC Ransom threat actor profile cyble.com · Vendor report
• Aidon (Wikipedia) en.wikipedia.org · Research
• Breachsense: Aidon Oy data breach breachsense.com · News · 2026-09-17
• Gridspertise completes acquisition of Aidon gridspertise.com · News · 2023-11-09

More in ransomware

• Pixelleaks (new group) claims data leak from Huangshi Medical Laboratory / Ezong Medical Group x Getein JV (China, healthcare)
• Ransomware Leak-Site Cadence Analysis: INCRANSOM, TheGentlemen and Audit Team Run Active Intrusion Pipelines Amid Group Consolidation
• Vexy Ransomware lists Upper Web (Brazil, Technology) as a victim
• AI-Enabled Ransomware Evolution: Machine-Speed Kill Chains and Initial Access Broker Disruption (TrendAI Assessment, ARTEX Agentic Exploitation Context)
• Everest ransomware leak-site listing: "Final Notice Before Publication" (victim unnamed)

More from INC Ransom

• INC Ransomware: Evolution into a Top-Tier RaaS Operation (Rust Windows/ESXi payloads, edge-device exploitation CVE-2023-3519/CVE-2023-48788/CVE-2024-57727/CVE-2025-5777, modified Veeam credential dumper)
• Team Cymru Infrastructure Analysis: Seven Active Ransomware Gangs (Akira, DragonForce, Clop, MedusaLocker, Qilin, INC Ransom, Lynx) Abuse Dual-Use Tools and Exploit SonicWall, Gladinet CentreStack, and FortiGate Devices
• 2026 Ransomware Surge Targeting US Organizations: Identity-First Compromise, BYOVD, and Living-Off-the-Cloud Exfiltration (Qilin, Akira, Clop, INC Ransom, Play, DragonForce, Sinobi)
• FortiBleed: Mass Credential Compromise Campaign Against Internet-Exposed Fortinet FortiGate Devices (86,644 Devices, 194 Countries)
• FortiBleed: Russian-Speaking Credential-Harvesting Campaign Against Internet-Exposed FortiGate Firewalls and SSL VPN Gateways
• INC Ransom Affiliate Network Targeting Pacific Critical Infrastructure (AU/NZ/Tonga Joint Advisory)

Previous and next in ransomware

• Cisco Secure FMC Exploitation (CVE-2026-20079, CVE-2026-20316) by Qilin Affiliate UAT-11988 and Sandworm-Linked UAT-11823, with ScreenConnect (CVE-2026-84869) and PaperCut (CVE-2026-81578/82078) Management-Layer Exploitation Previous report
• Vexy Ransomware claims Franc-Oil (Nigeria, Energy & Utilities) - 200 MB exfiltration claimed Next report