# Incransom ransomware group claims Aidon Oy (Gridspertise / Enel Group) smart meter platform breach

> The Incransom (INC Ransom) extortion group listed Aidon Oy (aidon.com), a Finnish smart-metering and smart-grid vendor owned by Gridspertise, as a victim on 2026-11-12. The group claims 8.41 TB (9,899 files) exfiltrated from eight SQL Server instances, including 520,796 smart-meter AES-128 keys and about 1.5 million Finnish customer records. All claims are group-asserted and unverified; Aidon, Gridspertise and Finnish authorities have not confirmed them.

- **Published:** 2026-11-12T10:44:55Z
- **Last reviewed:** 2026-11-12T10:44:55Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-5850
- **Card image:** https://intel.threadlinqs.com/og/threat/TL-2026-5850.png
- **ID:** TL-2026-5850
- **Severity:** HIGH
- **Category:** RANSOMWARE
- **Status:** ACTIVE
- **Actor:** Incransom
- **Detections:** 9 (1 shown free below) · **IOCs:** 27 (3 shown free below)

## Description

Ransomware.live lists aidon.com (Aidon Oy, Finland) as an Incransom victim, discovered 2026-11-12 10:19 UTC. Aidon Oy provides smart-metering and metering-as-a-service to Nordic distribution system operators, and has been part of Gridspertise (Enel Group / CVC Capital Partners joint venture) since the acquisition completed in November 2023. The group's claim describes the Smart Meter Operations (SMO) head-end platform serving Finnish DSOs.

Claimed data (all unverified, per the leak-site entry as mirrored by ransomware.live): 9,899 files totalling 8.41 TB from 8 SQL Server instances and 25+ databases (about 2.4 TB on disk); 520,796 AES-128 keys (unicast, authentication, multicast) for smart meters; about 1.5 million Finnish customers (names, addresses, 91,430+ GPS coordinates, consumption profiles); 74 user accounts with password hashes and TOTP secrets; 23 API keys; 108,000+ SIM/IMSI records; 368 full backups, 9,079 transaction logs and 218 live database files. The group names 10+ affected energy utilities (including Porvoon Energia, Keravan Energia, Helen Oy and Etelä-Savon Energia) and asserts exposure above EUR 20 million.

Claimed timeline: initial access 2026-04-19, exfiltration 2026-04-19 to 2026-05-01, contact attempts in July 2026 (sent to the wrong entity), 2026-08-15 (attribution corrected) and about 2026-08-20 (CEO and CFO contacted directly), with no response from Aidon as of September 2026. The group states data will not be published while a resolution remains possible. No ransom amount, deadline or negotiation transcript is shown. Ransomware.live's estimated attack date (2026-09-03) conflicts with the claimed April access date, and Breachsense records the listing as discovered 2026-09-17. The initial access vector for this incident is not stated by any source. Infostealer/exposure telemetry on the page (HudsonRock: 1 compromised employee, 6 third-party employee credentials; ParanoidLab: 36 exposed passwords and 1 cookie) is context only and not shown to be linked to the intrusion.

INC Ransom is a ransomware-as-a-service operation (MITRE G1032, S1139; also tracked as GOLD IONIC) first seen in mid-2023. Public reporting (MITRE ATT&CK, ACSC/NCSC-NZ, Acronis TRU, Cyble, CERT Orange Polska) documents affiliate tradecraft: initial access via spear phishing, valid credentials from initial access brokers and exploitation of public-facing applications (CVE-2023-3519 Citrix NetScaler, CVE-2023-48788 Fortinet EMS, CVE-2024-57727 SimpleHelp, CVE-2025-5777 Citrix Bleed 2); discovery with Advanced IP Scanner, NETSCAN.EXE, AdFind and Nltest; lateral movement via RDP and PsExec (including a PsExec binary renamed winupd); remote tools such as AnyDesk, ScreenConnect and Cobalt Strike; staging with 7-Zip/WinRAR; exfiltration with rclone and MegaSync; and a Windows/Linux/ESXi encryptor dropping INC-README.txt/.html and appending .INC. These are group-level TTPs and are NOT evidenced as the specific methods used against Aidon; the MITRE mappings below reflect the group's documented playbook limited to techniques cited by those sources.

Defender relevance: if the claim is accurate, exposed smart-meter keys and head-end credentials create downstream risk for DSOs and consumers (key rotation, credential and API-key rotation, GDPR notification). Utilities and integrators connected to Aidon-hosted platforms should review access, rotate secrets and hunt for the INC TTPs listed here.

## MITRE ATT&CK

- T1190 Exploit Public-Facing Application
- T1078 Valid Accounts
- T1566 Phishing
- T1047 Windows Management Instrumentation
- T1569.002 System Services: Service Execution
- T1685 Disable or Modify Tools
- T1036.005 Masquerading: Match Legitimate Resource Name or Location
- T1070.004 Indicator Removal: File Deletion
- T1046 Network Service Discovery
- T1087.002 Account Discovery: Domain Account
- T1021.001 Remote Services: Remote Desktop Protocol
- T1570 Lateral Tool Transfer
- T1560.001 Archive Collected Data: Archive via Utility
- T1219 Remote Access Tools
- T1567.002 Exfiltration Over Web Service: Exfiltration to Cloud Storage
- T1657 Financial Theft

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**INC Ransom winupd Service / Renamed PsExec Remote Execution (Execution Phase)** (`TL-2026-5850-SPL-001`)

Detects the winupd service name that MITRE G1032 documents for the INC Ransom encryptor and for a PsExec binary masqueraded as a Windows update, plus PsExec executed under a non-stock filename. Covers service execution (T1569.002), masquerading (T1036.005) and lateral tool transfer (T1570) used by INC affiliates in the Incransom claim against Aidon Oy (TL-2026-5850). Group-level TTP, not confirmed as used against Aidon.

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1569.002, T1036.005, T1570
- **Data sources:** sysmon (index=sysmon, XmlWinEventLog:Microsoft-Windows-Sysmon/Operational EventCode 1), windows_system (index=wineventlog, WinEventLog:System EventCode 7045), DeviceProcessEvents, DeviceEvents
- **Severity:** high
- **Confidence:** high

### Splunk SPL

````spl
(index=wineventlog sourcetype="WinEventLog:System" EventCode=7045 (Service_Name="winupd" OR Service_File_Name="*winupd*")) OR (index=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1 (Image="*\\winupd.exe" OR ((OriginalFileName="psexec.c" OR Description="Execute processes remotely") NOT (Image="*\\psexec.exe" OR Image="*\\psexec64.exe")))) earliest=-24h
```Branch 1: Service Control Manager 7045 for the winupd service name used to run the INC encryptor. Branch 2: winupd.exe, or PsExec renamed away from its stock filename (MITRE G1032 documents a PsExec binary masqueraded as winupd).```
| eval detection_reason=case(EventCode=7045, "Service winupd installed (INC encryptor service name)", match(Image, "(?i)winupd[.]exe$"), "Process named winupd.exe executed (masqueraded PsExec)", true(), "PsExec renamed away from stock filename")
| stats count AS events min(_time) AS first_seen max(_time) AS last_seen values(detection_reason) AS reason values(Service_File_Name) AS service_file values(Image) AS image values(CommandLine) AS command_line values(ParentImage) AS parent_image BY host
| eval first_seen=strftime(first_seen, "%Y-%m-%dT%H:%M:%SZ"), last_seen=strftime(last_seen, "%Y-%m-%dT%H:%M:%SZ")
````

### Microsoft KQL

```kql
// INC Ransom winupd service / renamed PsExec (TL-2026-5850) - T1569.002, T1036.005, T1570
let lookback = 24h;
let proc = DeviceProcessEvents
| where Timestamp > ago(lookback)
| where FileName =~ "winupd.exe" or (ProcessVersionInfoOriginalFileName =~ "psexec.c" and FileName !in~ ("psexec.exe", "psexec64.exe"))
| project Timestamp, DeviceName, AccountName, FileName, ProcessCommandLine, InitiatingProcessFileName, Reason = "winupd binary or renamed PsExec executed";
let svc = DeviceEvents
| where Timestamp > ago(lookback)
| where ActionType == "ServiceInstalled" and AdditionalFields has "winupd"
| project Timestamp, DeviceName, AccountName = InitiatingProcessAccountName, FileName = InitiatingProcessFileName, ProcessCommandLine = InitiatingProcessCommandLine, InitiatingProcessFileName, Reason = "Service winupd installed";
union proc, svc
| order by Timestamp desc
```

### Sigma

```yaml
title: INC Ransom winupd Binary or Renamed PsExec Execution
id: 3b6f0f7e-5c1d-4a8e-9f21-7d4c2a9e1b10
status: experimental
description: Detects execution of a binary named winupd.exe, or PsExec renamed away from its stock filename (OriginalFileName psexec.c), as documented for INC Ransom affiliates that run the encryptor as the winupd service and masquerade PsExec as a Windows update.
references:
  - https://attack.mitre.org/groups/G1032/
  - https://www.acronis.com/en/tru/posts/from-emerging-threat-to-top-tier-ransomware-as-a-service-the-evolution-of-inc-ransomware.md
  - https://intel.threadlinqs.com
author: Threadlinqs Team
date: 2026/11/12
tags:
  - attack.execution
  - attack.t1569.002
  - attack.defense-evasion
  - attack.t1036.005
  - attack.lateral-movement
  - attack.t1570
  - attack.s0029
  - attack.s1139
logsource:
  category: process_creation
  product: windows
detection:
  selection_winupd:
    Image|endswith: '\winupd.exe'
  selection_psexec_renamed:
    OriginalFileName: 'psexec.c'
  filter_stock_name:
    Image|endswith:
      - '\psexec.exe'
      - '\psexec64.exe'
  condition: selection_winupd or (selection_psexec_renamed and not filter_stock_name)
falsepositives:
  - Legitimate software coincidentally named winupd.exe
  - Administrators who rename PsExec in internal deployment tooling
level: high
```

**Known false positives:**

- Administrators using a renamed PsExec copy in approved deployment tooling
- Third-party software or updaters that legitimately install a service or binary called winupd

**Tuning notes:** Allow-list approved deployment hosts and service accounts that run PsExec under a custom name. Confirm winupd is not a legitimate update service in your estate before enabling alerting. Scope to servers first, especially SQL Server and backup hosts, and pivot on the affected host for INC-README files and rclone/7-Zip activity.

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- INC Ransom Remote Access Tools (AnyDesk, ScreenConnect) and Toolset Ingress (locked: unlock with TL Creds)
- INC Ransom Defence Impairment (Vulnerable Drivers, Defender Tampering, Toolset Deletion) (locked: unlock with TL Creds)
- INC Ransom Encryptor Impact (INC-README Notes, [indicator] Rename, Known Sample Hashes) (locked: unlock with TL Creds)
- INC Ransom Edge Appliance Exploitation (CVE-2023-3519, CVE-2024-57727) with Valid-Account Follow-on (locked: unlock with TL Creds)
- INC Ransom Lateral Movement (Remote WMI, RDP Enablement, mstsc) (locked: unlock with TL Creds)
- INC Ransom Network Indicators (Leak Infrastructure, MEGA Exfiltration, Community Sibling IPs) (locked: unlock with TL Creds)
- INC Ransom Network and AD Discovery Tooling (Advanced IP Scanner, NETSCAN, AdFind, Nltest) (locked: unlock with TL Creds)
- INC Ransom Data Staging and Cloud Exfiltration (7-Zip/WinRAR, rclone, MEGAsync) (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sample indicators (3 of 27)

Defanged, TLP:CLEAR.

- Domain: `incblog[.]su`
- File hash: `31800380c359143ae82c4f9011eee653dd22443d03d6a499148203bbfc275502`
- Domain: `incblog6qu4y4mm4zvw5nrmue6qbwtgjsxpw6b7ixzssu36tsajldoad[.]onion`

Full set of 27 indicators unlocks with TL Creds: https://threadlinqs.com/tl-creds

## Sources

- [ransomware.live victim entry: aidon.com (Incransom)](https://www.ransomware.live/id/YWlkb24uY29tQGluY3JhbnNvbQ)
- [ransomware.live: Incransom group profile](https://www.ransomware.live/group/incransom)
- [Breachsense: Aidon Oy data breach](https://www.breachsense.com/breaches/aidon-oy-data-breach/)
- [MITRE ATT&CK: INC Ransom (G1032)](https://attack.mitre.org/groups/G1032/)
- [Acronis TRU: From emerging threat to top-tier RaaS - the evolution of INC ransomware](https://www.acronis.com/en/tru/posts/from-emerging-threat-to-top-tier-ransomware-as-a-service-the-evolution-of-inc-ransomware.md)
- [ACSC / NCSC-NZ: INC Ransom affiliate model enabling targeting of critical networks](https://www.cyber.gov.au/about-us/view-all-content/alerts-and-advisories/inc-ransom-affiliate-model-enabling-targeting-of-critical-networks)
- [CERT Orange Polska: INCransom threat actor profile](https://cert.orange.pl/wp-content/uploads/2026/07/CERTOPL_CTI_TA-Profile-INCransom-EN.pdf)
- [Cyble: INC Ransom threat actor profile](https://cyble.com/threat-actor-profiles/inc-ransom/)
- [US Coast Guard Maritime Cyber Alert 01-26](https://www.uscg.mil/Portals/0/Images/cyber/Maritime%20Cyber%20Alert%2001-26%20TLP%20CLEAR.pdf)
- [Gridspertise completes acquisition of Aidon](https://gridspertise.com/search-news/news/2023/11/gridspertise-completes-acquisition-aidon)
- [Aidon (Wikipedia)](https://en.wikipedia.org/wiki/Aidon)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-5850