# Ransomware Leak-Site Cadence Analysis: INCRANSOM, TheGentlemen and Audit Team Run Active Intrusion Pipelines Amid Group Consolidation

> DarkOwl's leak-site analysis (published 2026-11-12) reports ransomware consolidating among a few dominant groups, with the top 10 groups accounting for 71.1% of Q1 2026 victims. For early September 2026 it names INCRANSOM (11 victims in five days across eight countries), THEGENTLEMEN (5 victims, including an airline) and Audit Team (4 victims across South Korea, Germany and Argentina).

- **Published:** 2026-11-14T12:47:07Z
- **Last reviewed:** 2026-11-14T12:47:07Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-6076
- **Card image:** https://intel.threadlinqs.com/og/threat/TL-2026-6076.png
- **ID:** TL-2026-6076
- **Severity:** MEDIUM
- **Category:** RANSOMWARE
- **Status:** ACTIVE
- **Actor:** Incransom
- **Detections:** 9 (1 shown free below) · **IOCs:** 23 (3 shown free below)
- **CVEs:** CVE-2023-3519, CVE-2024-1708

## Description

This record tracks group-level ransomware activity rather than a single vulnerability or new technique. DarkOwl's article, 'Ransomware's Assembly Line: What the Leak Site Data Actually Shows' (2026-11-12), argues that leak-site postings reveal an 'intrusion pipeline' in which compromised footholds are queued and monetized in bursts. Reported statistics: a weekly total of 195 victims from 46 active operators in the first week of September 2026 (from an unnamed weekly count); monthly disclosures of 646-808 victims in 2026; a projection of roughly 8,660 victims for 2026, up 24.9% on the prior 12 months; and the top 10 groups holding 71.1% of Q1 2026 victims, up from 57% two quarters earlier. Qilin held the top spot for five straight months before TheGentlemen overtook it in June 2026 with 94 victims; Akira recorded 194 victims in Q1 2026; LockBit's strongest 2026 month was June with 43 victims. DarkOwl attributes most figures to third parties (Security Arsenal, ASEC/AhnLab, Industrial Cyber, Cybersecurity Insiders, BreachSense, Black Kite); they were not independently verified here.

INCRANSOM (INC Ransom, MITRE G1032, active since at least July 2023): Security Arsenal lists 11 claimed postings between 2026-08-31 and 2026-09-03 (3 on 08-31, 7 on 09-01, 1 on 09-03) across the US, Malaysia, Panama, Spain, Italy, Mexico, the UK and Canada, mainly manufacturing plus healthcare, education, financial services, transportation and technology. MITRE documents initial access via exploitation of Citrix NetScaler CVE-2023-3519 and phishing, valid accounts, RDP lateral movement, PsExec renamed 'winupd', WMIC to deploy the encryptor, 7-Zip/WinRAR staging and exfiltration via MegaSync and Rclone. Security Arsenal describes an estimated 5-14 day dwell time with exfiltration 24-72 hours before encryption. The ACSC/NCSC-NZ/CERT Tonga joint advisory describes an affiliate model and overlap with Lynx, Nemty, Karma and Nokoyawa TTPs.

TheGentlemen (RaaS, first clearly seen August 2025): Trend Micro documented a FortiGate or compromised-credential entry point (unconfirmed), Advanced IP Scanner, Nmap, PowerRun, PsExec, AnyDesk and WinSCP, a BYOVD anti-AV tool (All.exe loading the signed vulnerable driver ThrottleBlood.sys), GPO-based deployment through NETLOGON, defense impairment, log clearing, shadow-copy deletion and double extortion; the locker targets Windows, Linux and ESXi per other vendor reporting. Security Arsenal lists victims for 2026-09-01 to 09-05 in IN, US, PL and BR, and says perimeter-device exploitation, phishing and ScreenConnect/RDP abuse are the likely access paths; its CVE associations (e.g. CVE-2026-50751, CVE-2026-48027) are described by that source as probable or consistent, not confirmed, and were not independently verified. Note a discrepancy: DarkOwl describes an airline victim as Canadian, while Security Arsenal lists the airline victim (Lider Aviacao) with country BR.

Audit Team: DarkOwl cites 4 victims in South Korea, Germany and Argentina and links an ASEC/AhnLab post; the content of that post could not be verified here. A third-party leak tracker (Dexpose) reports an Audit Team claim against the South Korean institution dg.ac.kr on 2026-09-16. No IOCs or TTPs for Audit Team were found in sources. Leak-site postings are criminal claims and may be unverified or disputed. No network IOCs (IPs/domains) were published in the sources, so no BeaconBeagle correlation was applicable. Defender takeaway: monitor group-level posting cadence, prioritize hardening of VPN/perimeter appliances and RMM tools, and detect pre-encryption behaviors (RMM install, PsExec-style service creation, archive-and-exfil, shadow-copy deletion).

## MITRE ATT&CK

- T1190 Exploit Public-Facing Application
- T1566 Phishing
- T1078 Valid Accounts
- T1047 Windows Management Instrumentation
- T1569.002 Service Execution
- T1685 Disable or Modify Tools
- T1070.004 File Deletion
- T1484.001 Group Policy Modification
- T1046 Network Service Discovery
- T1087.002 Domain Account
- T1021.001 Remote Desktop Protocol
- T1021.002 SMB/Windows Admin Shares
- T1560.001 Archive via Utility
- T1074.001 Local Data Staging
- T1219 Remote Access Tools
- T1567.002 Exfiltration to Cloud Storage
- T1537 Transfer Data to Cloud Account
- T1490 Inhibit System Recovery
- T1489 Service Stop

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**Exfiltration and Staging — Rclone, MEGAsync, WinSCP and Archive Staging (INC Ransom / TheGentlemen)** (`TL-2026-6076-SPL-003`)

Detects Rclone transfers, MEGAsync/MEGA DNS from non-browser processes, WinSCP scripted transfers and 7-Zip/WinRAR password archiving or staging in C:\ProgramData\data. Both INC Ransom (Rclone, MegaSync, 7-Zip/WinRAR) and TheGentlemen (Rclone, WinSCP, C:\ProgramData\data) exfiltrate 24-72 hours before encryption, so a hit is the last practical point to contain.

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1567.002, T1537, T1560.001, T1074.001
- **Data sources:** sysmon:EventCode=1 and EventCode=22, DeviceProcessEvents, DeviceNetworkEvents, process_creation logsource
- **Severity:** high
- **Confidence:** medium

### Splunk SPL

```spl
index=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" (EventCode=1 OR EventCode=22) earliest=-24h
| eval proc=lower(mvindex(split(coalesce(Image,""),"\\"),-1)), cmd=lower(coalesce(CommandLine,"")), orig=lower(coalesce(OriginalFileName,"")), dnsq=lower(coalesce(QueryName,""))
| eval stage=case(
    (proc="rclone.exe" OR orig="rclone.exe") AND match(cmd,"(^|\s)(copy|sync|copyto|move)\s|mega:|--transfers|--config|--no-check-certificate"), "rclone_exfil",
    match(proc,"^(megasync|megacmd|megaclient)\.exe$"), "megasync_client",
    EventCode=22 AND match(dnsq,"(^|\.)mega\.(nz|io|co\.nz)$") AND NOT match(proc,"^(chrome|msedge|firefox|brave|iexplore)\.exe$"), "mega_dns_non_browser",
    match(proc,"^winscp\.(exe|com)$") AND match(cmd,"(^|\s)/(command|script)|sftp://|ftp://"), "winscp_transfer",
    match(proc,"^(7z|7zg|rar|winrar)\.exe$") AND match(cmd,"(^|\s)a\s") AND match(cmd,"-p|programdata.data"), "archive_staging",
    true(), null())
| where isnotnull(stage)
| stats count as events min(_time) as first_seen max(_time) as last_seen values(stage) as stages values(cmd) as sample_commands by Computer User
| convert ctime(first_seen) ctime(last_seen)
```

### Microsoft KQL

```kql
let BrowserProcs = dynamic(["chrome.exe","msedge.exe","firefox.exe","brave.exe","iexplore.exe"]);
let ToolActivity = DeviceProcessEvents
| where Timestamp > ago(24h)
| extend Stage = case(
    (FileName =~ "rclone.exe" or ProcessVersionInfoOriginalFileName =~ "rclone.exe") and ProcessCommandLine matches regex @"(?i)(^|\s)(copy|sync|copyto|move)\s|mega:|--transfers|--config|--no-check-certificate", "rclone_exfil",
    FileName in~ ("megasync.exe","megacmd.exe","megaclient.exe"), "megasync_client",
    FileName in~ ("winscp.exe","winscp.com") and ProcessCommandLine matches regex @"(?i)(^|\s)/(command|script)|sftp://|ftp://", "winscp_transfer",
    FileName in~ ("7z.exe","7zg.exe","rar.exe","winrar.exe") and ProcessCommandLine matches regex @"(?i)(^|\s)a\s" and ProcessCommandLine matches regex @"(?i)-p|programdata.data", "archive_staging",
    "")
| where Stage != ""
| project Timestamp, DeviceName, AccountName, Stage, FileName, ProcessCommandLine;
let MegaNetwork = DeviceNetworkEvents
| where Timestamp > ago(24h)
| where RemoteUrl matches regex @"(?i)(^|\.|//)mega\.(nz|io|co\.nz)(/|:|$)"
| where InitiatingProcessFileName !in~ (BrowserProcs)
| project Timestamp, DeviceName, AccountName = InitiatingProcessAccountName, Stage = "mega_network_non_browser", FileName = InitiatingProcessFileName, ProcessCommandLine = InitiatingProcessCommandLine;
union ToolActivity, MegaNetwork
| summarize Events=count(), Stages=make_set(Stage), SampleCommands=make_set(ProcessCommandLine, 5), FirstSeen=min(Timestamp), LastSeen=max(Timestamp) by DeviceName, AccountName
```

### Sigma

```yaml
title: Rclone, MEGAsync, WinSCP and Archive Staging for Ransomware Data Exfiltration
id: 0e8a6d27-91c4-4b3f-a5d2-6f7e3c1b8094
status: experimental
description: Detects Rclone transfers, MEGAsync execution, WinSCP scripted transfers and 7-Zip/WinRAR archiving into C:\ProgramData\data, the exfiltration and staging tooling used by INC Ransom (Rclone, MegaSync) and TheGentlemen (Rclone, WinSCP, C:\ProgramData\data) 24-72 hours before encryption.
references:
  - https://attack.mitre.org/groups/G1032
  - https://trendmicro.com/en/research/25/i/unmasking-the-gentlemen-ransomware.html
  - https://www.cyber.gov.au/advisory/inc-ransom-affiliate-model-enabling-targeting-of-critical-networks
  - https://www.darkowl.com/blog-content/ransomewares-assembly-line/
author: Threadlinqs Team
date: 2026/11/14
tags:
  - attack.exfiltration
  - attack.collection
  - attack.t1567.002
  - attack.t1537
  - attack.t1560.001
  - attack.t1074.001
  - attack.tool.rclone
logsource:
  category: process_creation
  product: windows
detection:
  selection_rclone_image:
    Image|endswith: '\rclone.exe'
  selection_rclone_orig:
    OriginalFileName: 'rclone.exe'
  selection_rclone_cmd:
    CommandLine|contains:
      - ' copy '
      - ' sync '
      - ' copyto '
      - 'mega:'
      - '--transfers'
      - '--no-check-certificate'
  selection_mega:
    Image|endswith:
      - '\MEGAsync.exe'
      - '\MEGAcmdShell.exe'
  selection_winscp:
    Image|endswith:
      - '\WinSCP.exe'
      - '\WinSCP.com'
    CommandLine|contains:
      - '/script='
      - '/command'
      - 'sftp://'
  selection_archive:
    Image|endswith:
      - '\7z.exe'
      - '\7zG.exe'
      - '\rar.exe'
      - '\WinRAR.exe'
    CommandLine|contains: 'ProgramData\data'
  condition: (selection_rclone_image and selection_rclone_cmd) or (selection_rclone_orig and selection_rclone_cmd) or selection_mega or selection_winscp or selection_archive
falsepositives:
  - Sanctioned backup jobs using Rclone
  - Users running MEGAsync or WinSCP for legitimate file transfer
  - Admins archiving with password-protected 7-Zip
level: high

```

**Known false positives:**

- Approved backup or sync jobs using Rclone/MEGAsync/WinSCP
- Admins creating password-protected archives

**Tuning notes:** Allowlist sanctioned Rclone/WinSCP hosts and service accounts. Where Sysmon EventCode 22 is not collected, rely on the process stages and add proxy or DNS logs for mega.nz/mega.io. Correlate with large outbound byte counts from the same host for higher fidelity.

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- ConnectWise ScreenConnect CVE-2024-1708 Exploitation — Shell Spawned by ScreenConnect Service (locked: unlock with TL Creds)
- BYOVD Anti-AV and Defender Tampering — [indicator], [indicator], [indicator], PowerRun (TheGentlemen / INC) (locked: unlock with TL Creds)
- Lateral Movement and Ransomware Deployment — PsExec 'winupd' Service, PSEXESVC and WMIC Remote Execution (locked: unlock with TL Creds)
- Unauthorized Remote Access Tool Install — AnyDesk and ScreenConnect (INC Ransom / TheGentlemen) (locked: unlock with TL Creds)
- Inhibit System Recovery — Shadow Copy Deletion, bcdedit Tampering and Backup Service Stop (INC / TheGentlemen) (locked: unlock with TL Creds)
- C2 Triage — Connections to Community-Observed Sibling Infrastructure (INC Ransom / Cobalt Strike tags) (locked: unlock with TL Creds)
- INC Ransom Initial Access — Citrix NetScaler CVE-2023-3519 Exploitation Patterns (locked: unlock with TL Creds)
- Post-Exploitation Discovery — Advanced IP Scanner, [indicator], Nmap and AD Account Enumeration (INC / TheGentlemen) (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sample indicators (3 of 23)

Defanged, TLP:CLEAR.

- File hash: `c12c4d58541cc4f75ae19b65295a52c559570054`
- File hash: `c0979ec20b87084317d1bfa50405f7149c3b5c5f`
- File hash: `df249727c12741ca176d5f1ccba3ce188a546d28`

Full set of 23 indicators unlocks with TL Creds: https://threadlinqs.com/tl-creds

## Sources

- [Ransomware's Assembly Line: What the Leak Site Data Actually Shows (DarkOwl)](https://www.darkowl.com/blog-content/ransomewares-assembly-line/)
- [INCRANSOM Ransomware Gang: 11 New Victims in 5 Days (Security Arsenal)](https://securityarsenal.com/blog/incransom-ransomware-gang-11-new-victims-in-5-days-manufacturing-and-healthcare-surge-detection-rules-inside)
- [THEGENTLEMEN Ransomware Gang: 5 Victims in 5 Days (Security Arsenal)](https://securityarsenal.com/blog/thegentlemen-ransomware-gang-5-victims-in-5-days-transportation-healthcare-and-technology-under-active-fire)
- [Unmasking The Gentlemen Ransomware: TTPs Revealed (Trend Micro)](https://trendmicro.com/en/research/25/i/unmasking-the-gentlemen-ransomware.html)
- [MITRE ATT&CK: INC Ransom (G1032)](https://attack.mitre.org/groups/G1032)
- [INC Ransom Affiliate Model Enabling Targeting of Critical Networks (ACSC / NCSC-NZ / CERT Tonga)](https://www.cyber.gov.au/advisory/inc-ransom-affiliate-model-enabling-targeting-of-critical-networks)
- [Ransomware sector reconsolidating as Qilin, LockBit and The Gentlemen expand influence in Q1 2026 (Industrial Cyber)](https://industrialcyber.co/ransomware/ransomware-sector-reconsolidating-as-qilin-lockbit-and-the-gentlemen-expand-influence-in-q1-2026/)
- [ASEC AhnLab post cited by DarkOwl for Audit Team](https://asec.ahnlab.com/en/95338/)
- [AuditTeam Strikes South Korean Institution dg.ac.kr (Dexpose)](https://www.dexpose.io/auditteam-strikes-south-korean-institution-dg-ac-kr/)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-6076