Ransomware Leak-Site Cadence Analysis: INCRANSOM, TheGentlemen and Audit Team Run Active Intrusion Pipelines Amid Group Consolidation

Key facts

Detection coverage

As of 2026-11-14, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-6076 across Splunk SPL, Microsoft KQL and Sigma, covering 23 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: Exfiltration and Staging — Rclone, MEGAsync, WinSCP and Archive Staging (INC Ransom / TheGentlemen)

Detects Rclone transfers, MEGAsync/MEGA DNS from non-browser processes, WinSCP scripted transfers and 7-Zip/WinRAR password archiving or staging in C:\ProgramData\data. Both INC Ransom (Rclone, MegaSync, 7-Zip/WinRAR) and TheGentlemen (Rclone, WinSCP, C:\ProgramData\data) exfiltrate 24-72 hours before encryption, so a hit is the last practical point to contain.

• Languages: Splunk SPL, Microsoft KQL, Sigma
• ATT&CK: T1567.002, T1537, T1560.001, T1074.001
• Data sources: sysmon:EventCode=1 and EventCode=22, DeviceProcessEvents, DeviceNetworkEvents, process_creation logsource
• Severity: high
• Confidence: medium

Splunk SPL

index=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" (EventCode=1 OR EventCode=22) earliest=-24h
| eval proc=lower(mvindex(split(coalesce(Image,""),"\\"),-1)), cmd=lower(coalesce(CommandLine,"")), orig=lower(coalesce(OriginalFileName,"")), dnsq=lower(coalesce(QueryName,""))
| eval stage=case(
    (proc="rclone.exe" OR orig="rclone.exe") AND match(cmd,"(^|\s)(copy|sync|copyto|move)\s|mega:|--transfers|--config|--no-check-certificate"), "rclone_exfil",
    match(proc,"^(megasync|megacmd|megaclient)\.exe$"), "megasync_client",
    EventCode=22 AND match(dnsq,"(^|\.)mega\.(nz|io|co\.nz)$") AND NOT match(proc,"^(chrome|msedge|firefox|brave|iexplore)\.exe$"), "mega_dns_non_browser",
    match(proc,"^winscp\.(exe|com)$") AND match(cmd,"(^|\s)/(command|script)|sftp://|ftp://"), "winscp_transfer",
    match(proc,"^(7z|7zg|rar|winrar)\.exe$") AND match(cmd,"(^|\s)a\s") AND match(cmd,"-p|programdata.data"), "archive_staging",
    true(), null())
| where isnotnull(stage)
| stats count as events min(_time) as first_seen max(_time) as last_seen values(stage) as stages values(cmd) as sample_commands by Computer User
| convert ctime(first_seen) ctime(last_seen)

Microsoft KQL

let BrowserProcs = dynamic(["chrome.exe","msedge.exe","firefox.exe","brave.exe","iexplore.exe"]);
let ToolActivity = DeviceProcessEvents
| where Timestamp > ago(24h)
| extend Stage = case(
    (FileName =~ "rclone.exe" or ProcessVersionInfoOriginalFileName =~ "rclone.exe") and ProcessCommandLine matches regex @"(?i)(^|\s)(copy|sync|copyto|move)\s|mega:|--transfers|--config|--no-check-certificate", "rclone_exfil",
    FileName in~ ("megasync.exe","megacmd.exe","megaclient.exe"), "megasync_client",
    FileName in~ ("winscp.exe","winscp.com") and ProcessCommandLine matches regex @"(?i)(^|\s)/(command|script)|sftp://|ftp://", "winscp_transfer",
    FileName in~ ("7z.exe","7zg.exe","rar.exe","winrar.exe") and ProcessCommandLine matches regex @"(?i)(^|\s)a\s" and ProcessCommandLine matches regex @"(?i)-p|programdata.data", "archive_staging",
    "")
| where Stage != ""
| project Timestamp, DeviceName, AccountName, Stage, FileName, ProcessCommandLine;
let MegaNetwork = DeviceNetworkEvents
| where Timestamp > ago(24h)
| where RemoteUrl matches regex @"(?i)(^|\.|//)mega\.(nz|io|co\.nz)(/|:|$)"
| where InitiatingProcessFileName !in~ (BrowserProcs)
| project Timestamp, DeviceName, AccountName = InitiatingProcessAccountName, Stage = "mega_network_non_browser", FileName = InitiatingProcessFileName, ProcessCommandLine = InitiatingProcessCommandLine;
union ToolActivity, MegaNetwork
| summarize Events=count(), Stages=make_set(Stage), SampleCommands=make_set(ProcessCommandLine, 5), FirstSeen=min(Timestamp), LastSeen=max(Timestamp) by DeviceName, AccountName

Sigma

title: Rclone, MEGAsync, WinSCP and Archive Staging for Ransomware Data Exfiltration
id: 0e8a6d27-91c4-4b3f-a5d2-6f7e3c1b8094
status: experimental
description: Detects Rclone transfers, MEGAsync execution, WinSCP scripted transfers and 7-Zip/WinRAR archiving into C:\ProgramData\data, the exfiltration and staging tooling used by INC Ransom (Rclone, MegaSync) and TheGentlemen (Rclone, WinSCP, C:\ProgramData\data) 24-72 hours before encryption.
references:
  - https://attack.mitre.org/groups/G1032
  - https://trendmicro.com/en/research/25/i/unmasking-the-gentlemen-ransomware.html
  - https://www.cyber.gov.au/advisory/inc-ransom-affiliate-model-enabling-targeting-of-critical-networks
  - https://www.darkowl.com/blog-content/ransomewares-assembly-line/
author: Threadlinqs Team
date: 2026/11/14
tags:
  - attack.exfiltration
  - attack.collection
  - attack.t1567.002
  - attack.t1537
  - attack.t1560.001
  - attack.t1074.001
  - attack.tool.rclone
logsource:
  category: process_creation
  product: windows
detection:
  selection_rclone_image:
    Image|endswith: '\rclone.exe'
  selection_rclone_orig:
    OriginalFileName: 'rclone.exe'
  selection_rclone_cmd:
    CommandLine|contains:
      - ' copy '
      - ' sync '
      - ' copyto '
      - 'mega:'
      - '--transfers'
      - '--no-check-certificate'
  selection_mega:
    Image|endswith:
      - '\MEGAsync.exe'
      - '\MEGAcmdShell.exe'
  selection_winscp:
    Image|endswith:
      - '\WinSCP.exe'
      - '\WinSCP.com'
    CommandLine|contains:
      - '/script='
      - '/command'
      - 'sftp://'
  selection_archive:
    Image|endswith:
      - '\7z.exe'
      - '\7zG.exe'
      - '\rar.exe'
      - '\WinRAR.exe'
    CommandLine|contains: 'ProgramData\data'
  condition: (selection_rclone_image and selection_rclone_cmd) or (selection_rclone_orig and selection_rclone_cmd) or selection_mega or selection_winscp or selection_archive
falsepositives:
  - Sanctioned backup jobs using Rclone
  - Users running MEGAsync or WinSCP for legitimate file transfer
  - Admins archiving with password-protected 7-Zip
level: high

Known false positives:

• Approved backup or sync jobs using Rclone/MEGAsync/WinSCP
• Admins creating password-protected archives

Tuning notes: Allowlist sanctioned Rclone/WinSCP hosts and service accounts. Where Sysmon EventCode 22 is not collected, rely on the process stages and add proxy or DNS logs for mega.nz/mega.io. Correlate with large outbound byte counts from the same host for higher fidelity.

• 🔒 ConnectWise ScreenConnect CVE-2024-1708 Exploitation — Shell Spawned by ScreenConnect Service · unlock with TL Creds
• 🔒 BYOVD Anti-AV and Defender Tampering — [indicator], [indicator], [indicator], PowerRun (TheGentlemen / INC) · unlock with TL Creds
• 🔒 Lateral Movement and Ransomware Deployment — PsExec 'winupd' Service, PSEXESVC and WMIC Remote Execution · unlock with TL Creds
• 🔒 Unauthorized Remote Access Tool Install — AnyDesk and ScreenConnect (INC Ransom / TheGentlemen) · unlock with TL Creds
• 🔒 Inhibit System Recovery — Shadow Copy Deletion, bcdedit Tampering and Backup Service Stop (INC / TheGentlemen) · unlock with TL Creds
• 🔒 C2 Triage — Connections to Community-Observed Sibling Infrastructure (INC Ransom / Cobalt Strike tags) · unlock with TL Creds
• 🔒 INC Ransom Initial Access — Citrix NetScaler CVE-2023-3519 Exploitation Patterns · unlock with TL Creds
• 🔒 Post-Exploitation Discovery — Advanced IP Scanner, [indicator], Nmap and AD Account Enumeration (INC / TheGentlemen) · unlock with TL Creds

Indicators of compromise

As of 2026-11-14, Threadlinqs Intelligence tracks 23 indicators of compromise for TL-2026-6076.

Sample indicators (3 of 23)

• File hash: c12c4d58541cc4f75ae19b65295a52c559570054
• File hash: c0979ec20b87084317d1bfa50405f7149c3b5c5f
• File hash: df249727c12741ca176d5f1ccba3ce188a546d28

Defanged, TLP:CLEAR. Full set of 23 indicators: unlock with TL Creds.

Technical analysis

This record tracks group-level ransomware activity rather than a single vulnerability or new technique. DarkOwl's article, 'Ransomware's Assembly Line: What the Leak Site Data Actually Shows' (2026-11-12), argues that leak-site postings reveal an 'intrusion pipeline' in which compromised footholds are queued and monetized in bursts. Reported statistics: a weekly total of 195 victims from 46 active operators in the first week of September 2026 (from an unnamed weekly count); monthly disclosures of 646-808 victims in 2026; a projection of roughly 8,660 victims for 2026, up 24.9% on the prior 12 months; and the top 10 groups holding 71.1% of Q1 2026 victims, up from 57% two quarters earlier. Qilin held the top spot for five straight months before TheGentlemen overtook it in June 2026 with 94 victims; Akira recorded 194 victims in Q1 2026; LockBit's strongest 2026 month was June with 43 victims. DarkOwl attributes most figures to third parties (Security Arsenal, ASEC/AhnLab, Industrial Cyber, Cybersecurity Insiders, BreachSense, Black Kite); they were not independently verified here.

INCRANSOM (INC Ransom, MITRE G1032, active since at least July 2023): Security Arsenal lists 11 claimed postings between 2026-08-31 and 2026-09-03 (3 on 08-31, 7 on 09-01, 1 on 09-03) across the US, Malaysia, Panama, Spain, Italy, Mexico, the UK and Canada, mainly manufacturing plus healthcare, education, financial services, transportation and technology. MITRE documents initial access via exploitation of Citrix NetScaler CVE-2023-3519 and phishing, valid accounts, RDP lateral movement, PsExec renamed 'winupd', WMIC to deploy the encryptor, 7-Zip/WinRAR staging and exfiltration via MegaSync and Rclone. Security Arsenal describes an estimated 5-14 day dwell time with exfiltration 24-72 hours before encryption. The ACSC/NCSC-NZ/CERT Tonga joint advisory describes an affiliate model and overlap with Lynx, Nemty, Karma and Nokoyawa TTPs.

TheGentlemen (RaaS, first clearly seen August 2025): Trend Micro documented a FortiGate or compromised-credential entry point (unconfirmed), Advanced IP Scanner, Nmap, PowerRun, PsExec, AnyDesk and WinSCP, a BYOVD anti-AV tool (All.exe loading the signed vulnerable driver ThrottleBlood.sys), GPO-based deployment through NETLOGON, defense impairment, log clearing, shadow-copy deletion and double extortion; the locker targets Windows, Linux and ESXi per other vendor reporting. Security Arsenal lists victims for 2026-09-01 to 09-05 in IN, US, PL and BR, and says perimeter-device exploitation, phishing and ScreenConnect/RDP abuse are the likely access paths; its CVE associations (e.g. CVE-2026-50751, CVE-2026-48027) are described by that source as probable or consistent, not confirmed, and were not independently verified. Note a discrepancy: DarkOwl describes an airline victim as Canadian, while Security Arsenal lists the airline victim (Lider Aviacao) with country BR.

Audit Team: DarkOwl cites 4 victims in South Korea, Germany and Argentina and links an ASEC/AhnLab post; the content of that post could not be verified here. A third-party leak tracker (Dexpose) reports an Audit Team claim against the South Korean institution dg.ac.kr on 2026-09-16. No IOCs or TTPs for Audit Team were found in sources. Leak-site postings are criminal claims and may be unverified or disputed. No network IOCs (IPs/domains) were published in the sources, so no BeaconBeagle correlation was applicable. Defender takeaway: monitor group-level posting cadence, prioritize hardening of VPN/perimeter appliances and RMM tools, and detect pre-encryption behaviors (RMM install, PsExec-style service creation, archive-and-exfil, shadow-copy deletion).

MITRE ATT&CK techniques by tactic:

Lateral Movement

T1021.001 Remote Desktop Protocol; T1021.002 SMB/Windows Admin Shares

Discovery

T1046 Network Service Discovery; T1087.002 Domain Account

Execution

T1047 Windows Management Instrumentation; T1569.002 Service Execution

Defense Evasion

T1070.004 File Deletion

Collection

T1074.001 Local Data Staging; T1560.001 Archive via Utility

Initial Access

T1078 Valid Accounts; T1190 Exploit Public-Facing Application; T1566 Phishing

Command and Control

T1219 Remote Access Tools

defense-impairment

T1484.001 Group Policy Modification; T1685 Disable or Modify Tools

Impact

T1489 Service Stop; T1490 Inhibit System Recovery

Exfiltration

T1537 Transfer Data to Cloud Account; T1567.002 Exfiltration to Cloud Storage

Remediation

Patches

• Citrix NetScaler fixes for CVE-2023-3519
• ConnectWise ScreenConnect fixes for CVE-2024-1708

Immediate actions

• Patch and restrict internet exposure of VPN gateways, firewalls and Citrix NetScaler (CVE-2023-3519) and review for prior compromise
• Patch ConnectWise ScreenConnect (CVE-2024-1708) and inventory/allowlist all remote access tools (AnyDesk, ScreenConnect, TeamViewer)
• Hunt for PsExec/PSEXESVC service installs (Event ID 7045), renamed PsExec ('winupd'), and unusual RMM process creation
• Alert on vssadmin/wmic shadow copy deletion, bcdedit recovery tampering and backup service termination

Workarounds

• Restrict management interfaces of perimeter appliances to trusted networks
• Disable or tightly control unneeded remote access tools

Longer-term hardening

• Enforce MFA on all remote access and privileged accounts; remove exposed RDP
• Maintain offline/immutable backups and test restoration
• Block known vulnerable drivers (e.g. ThrottleBlood.sys) via driver blocklist / WDAC and tamper protection on EDR
• Monitor egress for Rclone, MEGA and WinSCP/FileZilla transfers; segment networks and restrict GPO and NETLOGON write access

Affected and fixed versions

• Citrix — NetScaler
  Vulnerable versions: Versions affected by CVE-2023-3519
  Fixed in: Vendor-fixed builds per Citrix advisory
• ConnectWise — ScreenConnect
  Vulnerable versions: Versions affected by CVE-2024-1708
  Fixed in: Vendor-fixed builds per ConnectWise advisory
• Microsoft — Windows
  Vulnerable versions: Windows endpoints and servers
• Linux/VMware — Linux and ESXi hosts
  Vulnerable versions: Hosts targeted by TheGentlemen locker

Timeline

• 2023-07-01 MITRE ATT&CK records INC Ransom (G1032) as active since at least July 2023 (earliest observed, not confirmed first use).
• 2025-09-09 Trend Micro publishes 'Unmasking The Gentlemen Ransomware' from an August 2025 investigation, documenting BYOVD anti-AV tooling, GPO/NETLOGON deployment and double extortion.
• 2026-06-01 During June 2026 TheGentlemen overtakes Qilin as the most active leak-site group with 94 victims that month, per DarkOwl; LockBit has its strongest 2026 month (43 victims).
• 2026-08-31 INCRANSOM posts 3 victims to its leak site, beginning an 11-victim burst (7 more on 2026-09-01, 1 on 2026-09-03) across eight countries.
• 2026-09-01 TheGentlemen begins a run of roughly one victim per day (Seasia Infotech first), reaching 5 victims by 2026-09-05 per Security Arsenal.
• 2026-09-05 Security Arsenal publishes its TheGentlemen brief; weekly total for the first week of September reaches 195 victims from 46 active operators per DarkOwl.
• 2026-09-16 Dexpose reports Audit Team claimed an attack on South Korean institution dg.ac.kr (single third-party source).
• 2026-11-12 DarkOwl publishes its leak-site analysis reporting 71.1% top-10 concentration in Q1 2026 and a ~8,660-victim 2026 projection (+24.9%).

Sources cited

• INC Ransom Affiliate Model Enabling Targeting of Critical Networks (ACSC / NCSC-NZ / CERT Tonga) cyber.gov.au · Advisory
• Unmasking The Gentlemen Ransomware: TTPs Revealed (Trend Micro) Trend Micro · Vendor report · 2025-09-09
• MITRE ATT&CK: INC Ransom (G1032) MITRE · Research
• ASEC AhnLab post cited by DarkOwl for Audit Team asec.ahnlab.com · Research
• Ransomware's Assembly Line: What the Leak Site Data Actually Shows (DarkOwl) darkowl.com · Blog · 2026-11-12
• INCRANSOM Ransomware Gang: 11 New Victims in 5 Days (Security Arsenal) securityarsenal.com · Blog
• THEGENTLEMEN Ransomware Gang: 5 Victims in 5 Days (Security Arsenal) securityarsenal.com · Blog · 2026-09-05
• Ransomware sector reconsolidating as Qilin, LockBit and The Gentlemen expand influence in Q1 2026 (Industrial Cyber) industrialcyber.co · News
• AuditTeam Strikes South Korean Institution dg.ac.kr (Dexpose) dexpose.io · News · 2026-09-16

More in ransomware

• Pixelleaks (new group) claims data leak from Huangshi Medical Laboratory / Ezong Medical Group x Getein JV (China, healthcare)
• Vexy Ransomware lists Upper Web (Brazil, Technology) as a victim
• AI-Enabled Ransomware Evolution: Machine-Speed Kill Chains and Initial Access Broker Disruption (TrendAI Assessment, ARTEX Agentic Exploitation Context)
• Everest ransomware leak-site listing: "Final Notice Before Publication" (victim unnamed)
• Qilin Ransomware Claims Cyberattack on University of Texas at Arlington; Personal Data Stolen

More from INC Ransom

• Incransom ransomware group claims Aidon Oy (Gridspertise / Enel Group) smart meter platform breach
• INC Ransomware: Evolution into a Top-Tier RaaS Operation (Rust Windows/ESXi payloads, edge-device exploitation CVE-2023-3519/CVE-2023-48788/CVE-2024-57727/CVE-2025-5777, modified Veeam credential dumper)
• Team Cymru Infrastructure Analysis: Seven Active Ransomware Gangs (Akira, DragonForce, Clop, MedusaLocker, Qilin, INC Ransom, Lynx) Abuse Dual-Use Tools and Exploit SonicWall, Gladinet CentreStack, and FortiGate Devices
• 2026 Ransomware Surge Targeting US Organizations: Identity-First Compromise, BYOVD, and Living-Off-the-Cloud Exfiltration (Qilin, Akira, Clop, INC Ransom, Play, DragonForce, Sinobi)
• FortiBleed: Mass Credential Compromise Campaign Against Internet-Exposed Fortinet FortiGate Devices (86,644 Devices, 194 Countries)
• FortiBleed: Russian-Speaking Credential-Harvesting Campaign Against Internet-Exposed FortiGate Firewalls and SSL VPN Gateways

Other reports on CVE-2023-3519

• INC Ransom Affiliate Network Targeting Pacific Critical Infrastructure (AU/NZ/Tonga Joint Advisory)
• Citrix NetScaler Mass Reconnaissance Campaign via Residential Proxies

Other reports on CVE-2024-1708

• Emperador Ransomware Group Claims 3.9GB Data Theft from AB InBev (Budweiser, Corona Maker) - Unverified $1M Bitcoin Extortion
• Healthcare Sector Ransomware Targeting and Expanding Attack Surface (Qilin, Akira, DragonForce, LockBit, The Gentlemen)
• Q3 2026 Record Ransomware Surge: 2,627 Claimed Attacks, Qilin and The Gentlemen Lead, Clop Resurgence via PTC Windchill CVE-2026-12569
• Multi-Stage Abuse of Legitimate Remote Access Tools (ConnectWise, N-Able, SimpleHelp, Datto RMM, GoTo) by Initial Access Brokers
• The Remote Access Blind Spot: Acronis TRU Analysis of RMM Tool Proliferation and Abuse Risk in SMB Environments
• ConnectWise ScreenConnect Path Traversal (CVE-2024-1708) Added to CISA KEV — Storm-1175 / Medusa Ransomware Active Exploitation